mardi 24 février 2015

Zend form + csrf protection

Im trying to secure my Zend form with crsf token. Allways if I add token element to my form, it always send me back notEmpty error message for token. Im I doing something wrong? Thx



class Application_Form_Test3 extends Zend_Form {

public function init() {
$this->setMethod('post');

//..some elements

$note = new Zend_Form_Element_Textarea('note');
$note->addValidator('stringLength', false, array(2, 50));
$note->setRequired(true);
$note->class = 'form-control';
$note->setLabel('Poznámka:');
$note->setAttrib('placeholder', 'poznamka ke spisu');
$note->setOptions(array('cols' => '20', 'rows' => '4'));

$submit = new Zend_Form_Element_Submit('submit');
$submit->class = 'btn btn-success';
$submit->setValue('odeslat');

$this->addElements(array(
$number,
$year,
$owner,
$note,
$submit,
));

$this->addElement('hash', 'no_csrf_foo', array('salt' => 'unique'));
}

}


Action in controller:



public function findAction() {
$request = $this->getRequest();
$form = new Application_Form_Test3();

if ($this->getRequest()->isPost()) {
if ($form->isValid($request->getPost())) {
var_dump($request->getPost());
} else {
var_dump("ERROR");
}
}

$this->view->form = $form;
}


In my view I render form and dump error messages



<?php var_dump($form->getMessages()) ?>


After each validation of form, i get array of error messages like that:



array(2) { ["note"]=> array(1) { ["isEmpty"]=> string(36) "Value is required and can't be empty" } ["no_csrf_foo"]=> array(1) { ["isEmpty"]=> string(36) "Value is required and can't be empty" } }


if I fill good values to elements, the last one error is always for token - NotEmpty, so my form is never valid.


Aucun commentaire:

Enregistrer un commentaire