tonyair/silverstripe-userforms
1
0
Fork 0
mirror of https://github.com/silverstripe/silverstripe-userforms.git synced 2024-10-22 17:05:42 +02:00
Code Issues Projects Releases Wiki Activity

Add flags to configure use of cookies.

Browse Source 
Adds 2 new flags to the CMS:

- DisableCsrfSecurityToken
- DisableAuthenicatedFinishAction

DisableAuthenicatedFinishAction disables the session check on the finish completed action as this normally validates the user correctly posted a form. This page is normally just basic content so requiring a session cookie is sometimes a hassle.

DisableCsrfSecurityToken allows security token to not be added to the form. Normally acceptable as forms don't usually alter the state of the database.
This commit is contained in:
Will Rossiter 2014-07-27 20:51:23 +12:00
parent 5568ee7875
commit 42932ea47f
1 changed files with 40 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
code/model/UserDefinedForm.php
View File

@ -26,7 +26,9 @@ class UserDefinedForm extends Page {
"ShowClearButton" => "Boolean", "ShowClearButton" => "Boolean",
'DisableSaveSubmissions' => 'Boolean', 'DisableSaveSubmissions' => 'Boolean',
'EnableLiveValidation' => 'Boolean', 'EnableLiveValidation' => 'Boolean',
'HideFieldLabels' => 'Boolean' 'HideFieldLabels' => 'Boolean',
'DisableAuthenicatedFinishAction' => 'Boolean',
'DisableCsrfSecurityToken' => 'Boolean'
); );
/** /**
@ -380,7 +382,9 @@ SQL;
new TextField("ClearButtonText", _t('UserDefinedForm.TEXTONCLEAR', 'Text on clear button:'), $clear), new TextField("ClearButtonText", _t('UserDefinedForm.TEXTONCLEAR', 'Text on clear button:'), $clear),
new CheckboxField("ShowClearButton", _t('UserDefinedForm.SHOWCLEARFORM', 'Show Clear Form Button'), $this->ShowClearButton), new CheckboxField("ShowClearButton", _t('UserDefinedForm.SHOWCLEARFORM', 'Show Clear Form Button'), $this->ShowClearButton),
new CheckboxField("EnableLiveValidation", _t('UserDefinedForm.ENABLELIVEVALIDATION', 'Enable live validation')), new CheckboxField("EnableLiveValidation", _t('UserDefinedForm.ENABLELIVEVALIDATION', 'Enable live validation')),
new CheckboxField("HideFieldLabels", _t('UserDefinedForm.HIDEFIELDLABELS', 'Hide field labels')) new CheckboxField("HideFieldLabels", _t('UserDefinedForm.HIDEFIELDLABELS', 'Hide field labels')),
new CheckboxField('DisableCsrfSecurityToken', _t('UserDefinedForm.DISABLECSRFSECURITYTOKEN', 'Disable CSRF Token')),
new CheckboxField('DisableAuthenicatedFinishAction', _t('UserDefinedForm.DISABLEAUTHENICATEDFINISHACTION', 'Disable Authenication on finish action'))
); );
$this->extend('updateFormOptions', $options); $this->extend('updateFormOptions', $options);
@ -515,6 +519,10 @@ class UserDefinedForm_Controller extends Page_Controller {
$this->extend('updateForm', $form); $this->extend('updateForm', $form);
if($this->DisableCsrfSecurityToken) {
$form->disableSecurityToken();
}
return $form; return $form;
} }
@ -1039,7 +1047,9 @@ JS
$referrer = (isset($data['Referrer'])) ? '?referrer=' . urlencode($data['Referrer']) : ""; $referrer = (isset($data['Referrer'])) ? '?referrer=' . urlencode($data['Referrer']) : "";
// set a session variable from the security ID to stop people accessing the finished method directly // set a session variable from the security ID to stop people accessing
// the finished method directly.
if(!$this->DisableAuthenicatedFinishAction) {
if (isset($data['SecurityID'])) { if (isset($data['SecurityID'])) {
Session::set('FormProcessed',$data['SecurityID']); Session::set('FormProcessed',$data['SecurityID']);
} else { } else {
@ -1052,6 +1062,7 @@ JS
Session::set('FormProcessedNum',$randNum); Session::set('FormProcessedNum',$randNum);
} }
} }
}
if(!$this->DisableSaveSubmissions) { if(!$this->DisableSaveSubmissions) {
Session::set('userformssubmission'. $this->ID, $submittedForm->ID); Session::set('userformssubmission'. $this->ID, $submittedForm->ID);
@ -1075,7 +1086,9 @@ JS
$referrer = isset($_GET['referrer']) ? urldecode($_GET['referrer']) : null; $referrer = isset($_GET['referrer']) ? urldecode($_GET['referrer']) : null;
if(!$this->DisableAuthenicatedFinishAction) {
$formProcessed = Session::get('FormProcessed'); $formProcessed = Session::get('FormProcessed');
if (!isset($formProcessed)) { if (!isset($formProcessed)) {
return $this->redirect($this->Link() . $referrer); return $this->redirect($this->Link() . $referrer);
} else { } else {
@ -1089,8 +1102,9 @@ JS
} }
} }
} }
// remove the session variable as we do not want it to be re-used
Session::clear('FormProcessed'); Session::clear('FormProcessed');
}
return $this->customise(array( return $this->customise(array(
'Content' => $this->customise(array( 'Content' => $this->customise(array(