php/yii2
1
0
Fork 0
mirror of https://github.com/yiisoft/yii2.git synced 2025-08-16 23:48:16 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fixes issue #539: Yii2 Csrf protection broken

Browse Source
This commit is contained in:
Qiang Xue
2013-06-15 15:33:27 -04:00
parent 5a8e4b648b
commit 36f6ebab7f
3 changed files with 15 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
framework/yii/validators/CaptchaValidator.php
View File

@ -21,6 +21,9 @@ use yii\helpers\Html;
*/
class CaptchaValidator extends Validator
{
/**
* @var boolean whether to skip this validator if the input is empty.
*/
public $skipOnEmpty = false;
/**
* @var boolean whether the comparison is case sensitive. Defaults to false.

2
framework/yii/web/CaptchaAction.php
View File

@ -173,7 +173,7 @@ class CaptchaAction extends Action
{
$code = $this->getVerifyCode();
$valid = $caseSensitive ? ($input === $code) : strcasecmp($input, $code) === 0;
$session = Yii::$app->session;
$session = Yii::$app->getSession();
$session->open();
$name = $this->getSessionKey() . 'count';
$session[$name] = $session[$name] + 1;

20
framework/yii/web/Request.php
View File

@ -27,7 +27,7 @@ class Request extends \yii\base\Request
* You may use [[\yii\web\Html::beginForm()]] to generate his hidden input.
* @see http://en.wikipedia.org/wiki/Cross-site_request_forgery
*/
public $enableCsrfValidation = false;
public $enableCsrfValidation = true;
/**
* @var string the name of the token used to prevent CSRF. Defaults to 'YII_CSRF_TOKEN'.
* This property is effectively only when {@link enableCsrfValidation} is true.
@ -771,7 +771,10 @@ class Request extends \yii\base\Request
$this->_cookieValidationKey = $value;
}
private $_csrfToken;
/**
* @var Cookie
*/
private $_csrfCookie;
/**
* Returns the random token used to perform CSRF validation.
@ -781,16 +784,15 @@ class Request extends \yii\base\Request
*/
public function getCsrfToken()
{
if ($this->_csrfToken === null) {
$cookies = $this->getCookies();
if (($this->_csrfToken = $cookies->getValue($this->csrfTokenName)) === null) {
$cookie = $this->createCsrfCookie();
$this->_csrfToken = $cookie->value;
$cookies->add($cookie);
if ($this->_csrfCookie === null) {
$this->_csrfCookie = $this->getCookies()->get($this->csrfTokenName);
if ($this->_csrfCookie === null) {
$this->_csrfCookie = $this->createCsrfCookie();
Yii::$app->getResponse()->getCookies()->add($this->_csrfCookie);
}
}
return $this->_csrfToken;
return $this->_csrfCookie->value;
}
/**