afup#1395 Registration antispam

stakovicz · Jan 4, 2024 · 408484b · 408484b
1 parent 83acb57
commit 408484b
Showing 1 changed file with 19 additions and 0 deletions.
diff --git a/sources/AppBundle/Controller/LegacyController.php b/sources/AppBundle/Controller/LegacyController.php
@@ -14,6 +14,7 @@
 use Symfony\Bundle\FrameworkBundle\Controller\Controller;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpFoundation\Session\SessionInterface;
 
 class LegacyController extends Controller
 {
@@ -130,10 +131,28 @@ public function registerAction(Request $request)
 
         $formulaire->addElement('password', 'mot_de_passe', 'Mot de passe', ['size' => 30, 'maxlength' => 30]);
         $formulaire->addElement('password', 'confirmation_mot_de_passe', '', ['size' => 30, 'maxlength' => 30]);
+        $formulaire->addElement('hidden', 'csrf'); // CSRF token
+        $formulaire->addElement('text', 'lastname', '', ['style' => 'display:none']);   // Pot de miel, doit être vide
         $formulaire->addElement('header', 'boutons', '');
         $formulaire->addElement('submit', 'soumettre', 'Ajouter');
 
         $formulaire->addRule('nom', 'Nom manquant', 'required');
+
+        // CSRF validation
+        $lastCsrf = $this->get('session')->get('csrf');
+        $formulaire->addRule('csrf', 'csrf validation', 'callback', static function ($value) use ($lastCsrf) {
+            return $lastCsrf === $value;
+        });
+
+        // CSRF generation
+        $csrf = md5(uniqid(mt_rand(), true));
+        $this->get('session')->set('csrf', $csrf);
+        $formulaire->getElement('csrf')->setValue($csrf);
+
+        $formulaire->addRule('lastname', 'Lastname manquant', 'callback', static function ($value) {
+            return empty($value);
+        });
+
         $formulaire->addRule('prenom', 'Prénom manquant', 'required');
         $formulaire->addRule('login', 'Login manquant', 'required');
         $formulaire->addRule('login', 'Login déjà existant', 'callback', static function ($value) use ($userRepository) {