1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 <?php
/*-----8<--------------------------------------------------------------------
*
* BEdita - a semantic content management framework
*
* Copyright 2015 ChannelWeb Srl, Chialab Srl
*
* This file is part of BEdita: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published
* by the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
* BEdita is distributed WITHOUT ANY WARRANTY; without even the implied
* warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
* See the GNU Lesser General Public License for more details.
* You should have received a copy of the GNU Lesser General Public License
* version 3 along with BEdita (see LICENSE.LGPL).
* If not, see <http://gnu.org/licenses/lgpl-3.0.html>.
*
*------------------------------------------------------------------->8-----
*/
App::import('Helper', 'Form');
/**
* BeFormHelper class
*
* extends CakePHP FormHelper adding some functionality
*/
class BeFormHelper extends FormHelper {
/**
* Return an input type hidden with a csrf token
* To use in combination with CsrfComponent to prevent CSRF attack
*
* @return string
*/
public function csrf() {
$output = '';
if (isset($this->params['_csrfToken']) && !empty($this->params['_csrfToken'])) {
$output = $this->hidden('_csrfToken.key', array(
'value' => $this->params['_csrfToken']['key'], 'id' => 'csrfToken' . mt_rand())
);
}
return $output;
}
/**
* Returns an HTML FORM element.
* Use parent FormHelper::create() and optionally add csrf input hidden
*
* @see FormHelper::create()
* @param string $model The model object which the form is being defined for
* @param array $options An array of html attributes and options.
* @return string An formatted opening FORM tag.
*/
function create($model = null, $options = array()) {
$output = parent::create($model, $options);
$output .= $this->csrf();
return $output;
}
}