mirror of
https://github.com/silverstripe/silverstripe-framework
synced 2024-10-22 12:05:37 +00:00
6348f2e3e8
Changed the `strictFormMethodCheck` protected property from false to true to step out on the front foot with this security setting. In the documentation under the title [Cross-Site Request Forgery](https://github.com/silverstripe/silverstripe-framework/blob/master/docs/en/02_Developer_Guides/09_Security/04_Secure_Coding.md#cross-site-request-forgery-csrf) it states, "it is also recommended to limit form submissions to the intended HTTP verb (mostly GET or POST) through [api:Form::setStrictFormMethodCheck()]." The same advice is noted in [Form Security](c2292a4cc1/docs/en/02_Developer_Guides/03_Forms/04_Form_Security.md (strict-form-submission)).
Why not make this the default behaviour? Is there a scenario where this would cause a problem? Have manually tested in the CMS (alpha7) and is working fine.
Note: Original commit that establised the API Form::setStrictFormMethodCheck is 14c59be8.
SilverStripe Framework
PHP5 framework forming the base for the SilverStripe CMS (http://silverstripe.org).
Requires a silverstripe-installer base project. Typically used alongside the cms module.
Installation
See installation on different platforms, and installation from source.
Bugtracker
Bugs are tracked on github.com. Please read our issue reporting guidelines.
Development and Contribution
If you would like to make changes to the SilverStripe core codebase, we have an extensive guide to contributing code.