Jelajahi Sumber

[Form] CSRF token is now only validated for root form

Bernhard Schussek 14 tahun lalu
induk
melakukan
d2b07058f4
1 mengubah file dengan 4 tambahan dan 3 penghapusan
  1. 4 3
      src/Symfony/Component/Form/Type/CsrfType.php

+ 4 - 3
src/Symfony/Component/Form/Type/CsrfType.php

@@ -34,9 +34,10 @@ class CsrfType extends AbstractType
         $builder
             ->setData($csrfProvider->generateCsrfToken($pageId))
             ->addValidator(new CallbackValidator(
-                function (FormInterface $field) use ($csrfProvider, $pageId) {
-                    if (!$csrfProvider->isCsrfTokenValid($pageId, $field->getData())) {
-                        $field->addError(new FormError('The CSRF token is invalid. Please try to resubmit the form'));
+                function (FormInterface $form) use ($csrfProvider, $pageId) {
+                    if ($form->hasParent() && $form->getParent()->isRoot()
+                            && !$csrfProvider->isCsrfTokenValid($pageId, $form->getData())) {
+                        $form->addError(new FormError('The CSRF token is invalid. Please try to resubmit the form'));
                     }
                 }
             ));