noiselabs / SmartyBundle

Smarty3 template engine bundle for Symfony
http://smartybundle.readthedocs.io/
GNU Lesser General Public License v3.0
51 stars 36 forks source link

extend security extension by csrf token manager and csrf token modifier #55

Closed naucon closed 8 years ago

naucon commented 8 years ago

In twig templates a csrf token can be set with {{ csrf_token('your_token_id') }}. The pull request adds this functionality through a modifier plugin {'your_token_id'|csrf_token}.

The functionality is required for using the symfony authentication with csrf protection. Therefore a csrf token with the id "authenticate" has to be set in the login form.

{'authenticate'|csrf_token}

Functionality was mainly ported from the form_extension (branch) to the security extension. Because the form extension branch wouldn't be finished soon and symfony itself handles the csrf functionality in a separate security component - independent from the form component.

I would be grateful if you could merge this PR to the master.

naucon commented 8 years ago

Test breaks because Symfony 2.1 do not have the Symfony\Component\Security\Csrf\CsrfToken class. Looks like it was introduced in Symfony 2.3. Befor 2.3 the CSRF functionality was part of the form component.

I try to fix this problem an keep compatibility.

naucon commented 8 years ago

sorry for a lot of try and error commits. I should have used a real php5.3 environment with a old phpunit version.