merged branch vicb/csrffix (PR #7060)

fabpot · fabpot · commit 83fc5ed98f26 · 2013-02-15T10:56:14.000+01:00
This PR was squashed before being merged into the 2.2 branch (closes #7060). Commits ------- f842ae6 [FrameworkBundle] CSRF should be on by default Discussion ---------- [FrameworkBundle] CSRF should be on by default --------------------------------------------------------------------------- by stof at 2013-02-13T11:27:32Z :+1: --------------------------------------------------------------------------- by vicb at 2013-02-15T08:54:39Z Oops seems like a file is missing... will update --------------------------------------------------------------------------- by vicb at 2013-02-15T09:04:13Z @fabpot the fix is fixed, ready to be merged ! --------------------------------------------------------------------------- by stloyd at 2013-02-15T09:05:24Z Shouldn't this be noted in upgrade/changelog file? It's kinda of BC break... --------------------------------------------------------------------------- by vicb at 2013-02-15T09:13:18Z don't fix so, this is something I did break a few weeks ago, just reverting to how it is supposed to work. --------------------------------------------------------------------------- by fabpot at 2013-02-15T09:49:21Z If you broke CSRF configuration, I suppose that you also broke form, ESI, framgents, translator, validator, and profiler configuration, no (see fde7585)? --------------------------------------------------------------------------- by vicb at 2013-02-15T09:51:51Z Hey @fabpot I am not that BAD :) "form, ESI, framgents, translator, validator, and profiler" are off by default. Only CSRF should be on by default.
diff --git a/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php b/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php
@@ -94,7 +94,7 @@ private function addFormSection(ArrayNodeDefinition $rootNode)
                     ->canBeEnabled()
                 ->end()
                 ->arrayNode('csrf_protection')
-                    ->canBeEnabled()
+                    ->canBeDisabled()
                     ->children()
                         ->scalarNode('field_name')->defaultValue('_token')->end()
                     ->end()
diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/ConfigurationTest.php b/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/ConfigurationTest.php
@@ -94,7 +94,7 @@ protected static function getBundleDefaultConfig()
             'default_locale'      => 'en',
             'form'                => array('enabled' => false),
             'csrf_protection'     => array(
-                'enabled'    => false,
+                'enabled'    => true,
                 'field_name' => '_token',
             ),
             'esi'                 => array('enabled' => false),
diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/yml/csrf.yml b/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/yml/csrf.yml
@@ -0,0 +1,6 @@
+framework:
+    secret: s3cr3t
+    form: ~
+    session: ~
+    # CSRF should be enabled by default
+    # csrf_protection: ~
diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/YamlFrameworkExtensionTest.php b/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/YamlFrameworkExtensionTest.php
@@ -22,4 +22,11 @@ protected function loadFromFile(ContainerBuilder $container, $file)
         $loader = new YamlFileLoader($container, new FileLocator(__DIR__.'/Fixtures/yml'));
         $loader->load($file.'.yml');
     }
+
+    public function testCsrfProtectionShouldBeEnabledByDefault()
+    {
+        $container = $this->createContainerFromFile('csrf');
+
+        $this->assertTrue($container->getParameter('form.type_extension.csrf.enabled'));
+    }
 }

Original file line number	Diff line number	Diff line change
`@@ -22,4 +22,11 @@ protected function loadFromFile(ContainerBuilder $container, $file)`
`22`	`22`	`$loader = new YamlFileLoader($container, new FileLocator(__DIR__.'/Fixtures/yml'));`
`23`	`23`	`$loader->load($file.'.yml');`
`24`	`24`	`}`
	`25`	`+`
	`26`	`+ public function testCsrfProtectionShouldBeEnabledByDefault()`
	`27`	`+ {`
	`28`	`+ $container = $this->createContainerFromFile('csrf');`
	`29`	`+`
	`30`	`+ $this->assertTrue($container->getParameter('form.type_extension.csrf.enabled'));`
	`31`	`+ }`
`25`	`32`	`}`