Skip to content

Don't submit unnamed form without any data on non POST request.#1

Draft
das-peter wants to merge 1 commit into
masterfrom
HttpFoundationRequestHandler-more-defensive-form-submission
Draft

Don't submit unnamed form without any data on non POST request.#1
das-peter wants to merge 1 commit into
masterfrom
HttpFoundationRequestHandler-more-defensive-form-submission

Conversation

@das-peter

Copy link
Copy Markdown
Member
Q A
Bug fix? yes
New feature? no
BC breaks? Don't know
Deprecations? no

I've no idea why the METHOD check of the original Smyonfy code should be removed and there's not documentation I've found which would explain why that is done or how it is supposed to work with other components.
I just got the bundle as a dependency of the dpfaffenbauer/process-manager package I installed. And now this dependency is interfering with all our forms.
Most obvious issue so far is that due the permanent form submits the CSRF Token validation is triggered even on actual non-submissions, leading to bogus CSRF errors on our forms without user interaction.

Now given there's a name check for named forms in order to determine if a submission is suitable I think the least thing to do for unnamed forms is to check whether there's any data at all before just submitting empty data.
An extended approach would be to check if there are matching parameters for the form fields before triggering a submit.
Maybe something like !empty(array_intersect_key($data, $form->all())) as check could do - however, this would be more restrictive than the original Symfony handler and hence could lead to more trouble.

zoidbergx pushed a commit that referenced this pull request Mar 6, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant