Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't submit unnamed form without any data on non POST request. #1

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

das-peter
Copy link
Member

Q A
Bug fix? yes
New feature? no
BC breaks? Don't know
Deprecations? no

I've no idea why the METHOD check of the original Smyonfy code should be removed and there's not documentation I've found which would explain why that is done or how it is supposed to work with other components.
I just got the bundle as a dependency of the dpfaffenbauer/process-manager package I installed. And now this dependency is interfering with all our forms.
Most obvious issue so far is that due the permanent form submits the CSRF Token validation is triggered even on actual non-submissions, leading to bogus CSRF errors on our forms without user interaction.

Now given there's a name check for named forms in order to determine if a submission is suitable I think the least thing to do for unnamed forms is to check whether there's any data at all before just submitting empty data.
An extended approach would be to check if there are matching parameters for the form fields before triggering a submit.
Maybe something like !empty(array_intersect_key($data, $form->all())) as check could do - however, this would be more restrictive than the original Symfony handler and hence could lead to more trouble.

zoidbergx pushed a commit that referenced this pull request Mar 6, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant