mirror of
https://github.com/silverstripe/silverstripe-framework
synced 2024-08-28 21:46:10 +02:00
Changed the `strictFormMethodCheck` protected property from false to true to step out on the front foot with this security setting. In the documentation under the title [Cross-Site Request Forgery](https://github.com/silverstripe/silverstripe-framework/blob/master/docs/en/02_Developer_Guides/09_Security/04_Secure_Coding.md#cross-site-request-forgery-csrf) it states, "it is also recommended to limit form submissions to the intended HTTP verb (mostly GET or POST) through [api:Form::setStrictFormMethodCheck()]." The same advice is noted in [Form Security]( |
||
---|---|---|
.. | ||
Field_types | ||
How_Tos | ||
00_Introduction.md | ||
01_Validation.md | ||
03_Form_Templates.md | ||
04_Form_Security.md | ||
05_Form_Transformations.md | ||
06_Tabbed_Forms.md | ||
index.md |