vendor/symfony/form/Symfony/Component/Form/Extension/Csrf/Type/FormTypeCsrfExtension.php

   1 <?php
   2
   3 /*
   4  * This file is part of the Symfony package.
   5  *
   6  * (c) Fabien Potencier <fabien@symfony.com>
   7  *
   8  * For the full copyright and license information, please view the LICENSE
   9  * file that was distributed with this source code.
  10  */
  11
  12 namespace Symfony\Component\Form\Extension\Csrf\Type;
  13
  14 use Symfony\Component\Form\AbstractTypeExtension;
  15 use Symfony\Component\Form\Extension\Csrf\CsrfProvider\CsrfProviderInterface;
  16 use Symfony\Component\Form\Extension\Csrf\EventListener\CsrfValidationListener;
  17 use Symfony\Component\Form\FormBuilderInterface;
  18 use Symfony\Component\Form\FormView;
  19 use Symfony\Component\Form\FormInterface;
  20 use Symfony\Component\OptionsResolver\OptionsResolverInterface;
  21 use Symfony\Component\Translation\TranslatorInterface;
  22
  23 /**
  24  * @author Bernhard Schussek <bschussek@gmail.com>
  25  */
  26 class FormTypeCsrfExtension extends AbstractTypeExtension
  27 {
  28     /**
  29      * @var CsrfProviderInterface
  30      */
  31     private $defaultCsrfProvider;
  32
  33     /**
  34      * @var Boolean
  35      */
  36     private $defaultEnabled;
  37
  38     /**
  39      * @var string
  40      */
  41     private $defaultFieldName;
  42
  43     /**
  44      * @var TranslatorInterface
  45      */
  46     private $translator;
  47
  48     /**
  49      * @var null|string
  50      */
  51     private $translationDomain;
  52
  53     public function __construct(CsrfProviderInterface $defaultCsrfProvider, $defaultEnabled = true, $defaultFieldName = '_token', TranslatorInterface $translator = null, $translationDomain = null)
  54     {
  55         $this->defaultCsrfProvider = $defaultCsrfProvider;
  56         $this->defaultEnabled = $defaultEnabled;
  57         $this->defaultFieldName = $defaultFieldName;
  58         $this->translator = $translator;
  59         $this->translationDomain = $translationDomain;
  60     }
  61
  62     /**
  63      * Adds a CSRF field to the form when the CSRF protection is enabled.
  64      *
  65      * @param FormBuilderInterface $builder The form builder
  66      * @param array                $options The options
  67      */
  68     public function buildForm(FormBuilderInterface $builder, array $options)
  69     {
  70         if (!$options['csrf_protection']) {
  71             return;
  72         }
  73
  74         $builder
  75             ->setAttribute('csrf_factory', $builder->getFormFactory())
  76             ->addEventSubscriber(new CsrfValidationListener(
  77                 $options['csrf_field_name'],
  78                 $options['csrf_provider'],
  79                 $options['intention'],
  80                 $options['csrf_message'],
  81                 $this->translator,
  82                 $this->translationDomain
  83             ))
  84         ;
  85     }
  86
  87     /**
  88      * Adds a CSRF field to the root form view.
  89      *
  90      * @param FormView      $view    The form view
  91      * @param FormInterface $form    The form
  92      * @param array         $options The options
  93      */
  94     public function finishView(FormView $view, FormInterface $form, array $options)
  95     {
  96         if ($options['csrf_protection'] && !$view->parent && $options['compound']) {
  97             $factory = $form->getConfig()->getAttribute('csrf_factory');
  98             $data = $options['csrf_provider']->generateCsrfToken($options['intention']);
  99
 100             $csrfForm = $factory->createNamed($options['csrf_field_name'], 'hidden', $data, array(
 101                 'mapped' => false,
 102             ));
 103
 104             $view->children[$options['csrf_field_name']] = $csrfForm->createView($view);
 105         }
 106     }
 107
 108     /**
 109      * {@inheritDoc}
 110      */
 111     public function setDefaultOptions(OptionsResolverInterface $resolver)
 112     {
 113         $resolver->setDefaults(array(
 114             'csrf_protection'   => $this->defaultEnabled,
 115             'csrf_field_name'   => $this->defaultFieldName,
 116             'csrf_provider'     => $this->defaultCsrfProvider,
 117             'csrf_message'      => 'The CSRF token is invalid. Please try to resubmit the form.',
 118             'intention'         => 'unknown',
 119         ));
 120     }
 121
 122     /**
 123      * {@inheritDoc}
 124      */
 125     public function getExtendedType()
 126     {
 127         return 'form';
 128     }
 129 }