[Form] Decoupled FormBuilder from CSRF protection

src/Symfony/Component/Form/FormBuilder.php

@@ -11,7 +11,6 @@
 
 namespace Symfony\Component\Form;
 
-use Symfony\Component\Form\CsrfProvider\CsrfProviderInterface;
 use Symfony\Component\Form\DataMapper\DataMapperInterface;
 use Symfony\Component\Form\DataTransformer\DataTransformerInterface;
 use Symfony\Component\Form\Renderer\ThemeRenderer;
@@ -53,10 +52,6 @@ class FormBuilder
 
     private $dataClass;
 
-    private $csrfFieldName;
-
-    private $csrfProvider;
-
     private $fields = array();
 
     private $dataMapper;
@@ -451,54 +446,6 @@ class FormBuilder
         return $fields;
     }
 
-    public function addCsrfProtection(CsrfProviderInterface $provider = null, $fieldName = '_token')
-    {
-        if (null !== $provider) {
-            $this->csrfProvider = $provider;
-        }
-
-        $this->csrfFieldName = $fieldName;
-    }
-
-    public function removeCsrfProtection()
-    {
-        $this->csrfFieldName = null;
-
-        return $this;
-    }
-
-    /**
-     * @return true if this form is CSRF protected
-     */
-    public function hasCsrfProtection()
-    {
-        return isset($this->csrfFieldName);
-    }
-
-    public function getCsrfFieldName()
-    {
-        return $this->csrfFieldName;
-    }
-
-    public function getCsrfProvider()
-    {
-        return $this->csrfProvider;
-    }
-
-    protected function buildCsrfProtection()
-    {
-        if ($this->hasCsrfProtection()) {
-            // need a page ID here, maybe FormType class?
-            $options = array('page_id' => null);
-
-            if ($this->csrfProvider) {
-                $options['csrf_provider'] = $this->csrfProvider;
-            }
-
-            $this->add($this->csrfFieldName, 'csrf', $options);
-        }
-    }
-
     public function setDataClass($class)
     {
         $this->dataClass = $class;
@@ -513,8 +460,6 @@ class FormBuilder
 
     public function getForm()
     {
-        $this->buildCsrfProtection();
-
         $instance = new Form(
             $this->getName(),
             $this->buildDispatcher(),

src/Symfony/Component/Form/Type/FormType.php

@@ -31,7 +31,13 @@ class FormType extends AbstractType
             ));
 
         if ($options['csrf_protection']) {
-            $builder->addCsrfProtection($options['csrf_provider'], $options['csrf_field_name']);
+            $csrfOptions = array('page_id' => $options['csrf_page_id']);
+
+            if ($options['csrf_provider']) {
+                $csrfOptions['csrf_provider'] = $options['csrf_provider'];
+            }
+
+            $builder->add($options['csrf_field_name'], 'csrf', $csrfOptions);
         }
     }
 
@@ -44,6 +50,7 @@ class FormType extends AbstractType
             'csrf_protection' => true,
             'csrf_field_name' => '_token',
             'csrf_provider' => null,
+            'csrf_page_id' => get_class($this),
             'validation_groups' => null,
             'virtual' => false,
             // Errors in forms bubble by default, so that form errors will

tests/Symfony/Tests/Component/Form/Type/FormTypeTest.php

@@ -100,11 +100,11 @@ class FormTest extends TestCase
 
     public function testCsrfProtectionByDefault()
     {
-        $builder =  $this->factory->createBuilder('form', 'author');
-        $form = $builder->getForm();
+        $builder =  $this->factory->create('form', 'author', array(
+            'csrf_field_name' => 'csrf',
+        ));
 
-        $this->assertTrue($builder->hasCsrfProtection());
-        $this->assertTrue($form->has($builder->getCsrfFieldName()));
+        $this->assertTrue($builder->has('csrf'));
     }
 
     public function testCsrfProtectionCanBeDisabled()
@@ -116,91 +116,6 @@ class FormTest extends TestCase
         $this->assertEquals(0, count($form));
     }
 
-    public function testCsrfFieldNameCanBeSet()
-    {
-        $form =  $this->factory->create('form', 'author', array(
-            'csrf_field_name' => 'foobar',
-        ));
-
-        $this->assertTrue($form->has('foobar'));
-        $this->assertEquals(1, count($form));
-    }
-
-    public function testCsrfProtectedFormsHaveExtraField()
-    {
-        $this->markTestSkipped('CSRF protection needs to be fixed');
-
-        $provider = $this->createMockCsrfProvider();
-        $provider->expects($this->once())
-        ->method('generateCsrfToken')
-        ->with($this->equalTo('Symfony\Component\Form\Form'))
-        ->will($this->returnValue('ABCDEF'));
-
-        $form = $this->factory->create('form', 'author', array(
-            'csrf_provider' => $provider,
-        ));
-
-        $this->assertTrue($form->has($this->form->getCsrfFieldName()));
-
-        $field = $form->get($form->getCsrfFieldName());
-
-        $this->assertTrue($field instanceof HiddenField);
-        $this->assertEquals('ABCDEF', $field->getClientData());
-    }
-
-    public function testIsCsrfTokenValidPassesIfCsrfProtectionIsDisabled()
-    {
-        $this->markTestSkipped('CSRF protection needs to be fixed');
-
-        $this->form->bind(array());
-
-        $this->assertTrue($this->form->isCsrfTokenValid());
-    }
-
-    public function testIsCsrfTokenValidPasses()
-    {
-        $this->markTestSkipped('CSRF protection needs to be fixed');
-
-        $provider = $this->createMockCsrfProvider();
-        $provider->expects($this->once())
-        ->method('isCsrfTokenValid')
-        ->with($this->equalTo('Symfony\Component\Form\Form'), $this->equalTo('ABCDEF'))
-        ->will($this->returnValue(true));
-
-        $form = $this->factory->create('form', 'author', array(
-            'csrf_provider' => $provider,
-            'validator' => $this->validator,
-        ));
-
-        $field = $form->getCsrfFieldName();
-
-        $form->bind(array($field => 'ABCDEF'));
-
-        $this->assertTrue($form->isCsrfTokenValid());
-    }
-
-    public function testIsCsrfTokenValidFails()
-    {
-        $this->markTestSkipped('CSRF protection needs to be fixed');
-
-        $provider = $this->createMockCsrfProvider();
-        $provider->expects($this->once())
-        ->method('isCsrfTokenValid')
-        ->with($this->equalTo('Symfony\Component\Form\Form'), $this->equalTo('ABCDEF'))
-        ->will($this->returnValue(false));
-
-        $form = $this->factory->create('form', 'author', array(
-            'csrf_provider' => $provider,
-            'validator' => $this->validator,
-        ));
-
-        $field = $form->getCsrfFieldName();
-
-        $form->bind(array($field => 'ABCDEF'));
-
-        $this->assertFalse($form->isCsrfTokenValid());
-    }
-
     public function testValidationGroupNullByDefault()
     {
         $this->assertNull($this->form->getAttribute('validation_groups'));