UserFrosting表單 - 無效或遺漏的CSRF令牌

Question

我想在UserFrosting中提交一個簡單的表單，並且作爲測試只顯示成功消息，不進行數據修改。我跟着指導意見Lesson 2但我跑進CSRF問題：

UserFrosting返回以下錯誤：

Invalid or missing CSRF token.

我缺少什麼？直到此時UserFrosting很容易消化:(

形式：

<form class="form-horizontal" role="form" name="requestDescription" action="{{site.uri.public}}/soap/requests/desc/edit/{{ keyname }}" method="post"> 
    <div class="form-group"> 
     <label for="input_group" class="col-md-2 control-label">Name</label> 
     <div class="col-md-10"> 
      <input type="text" id="input_name" class="form-control" name="lgname" placeholder="{{ name }}"> 
     </div> 
    </div> 
    <div class="form-group text-center"> 
     <button type="submit" class="btn btn-success text-center">Update</button> 
    </div> 
</form> 

添加了腳本部分樹枝文件的底部：

<script> 
    $(document).ready(function() { 
     // Load the validator rules for this form 
     var validators = {{validators | raw}}; 
     ufFormSubmit(
       $("form[name='requestDescription']"), 
       validators, 
       $("#userfrosting-alerts"), 
       function(data, statusText, jqXHR) { 
        // Reload the page on success 
        window.location.reload(true); 
       } 
     ); 
    }); 
</script> 

這裏是我的來自控制器的兩個功能：

public function soapRequestDescriptionEditPage($keyname){ 
    if (!$this->_app->user->checkAccess('uri_soap_requests')){ 
     $this->_app->notFound(); 
    } 
    $requestDetails = $this->soapRequestReadMeta($keyname); 

    $schema = new \Fortress\RequestSchema($this->_app->config('schema.path') . "/forms/soap-request-description-edit.json"); 
    $this->_app->jsValidator->setSchema($schema); 

    $this->_app->render('soap/soap-request-description-edit.twig', [ 
     "name" => $requestDetails['name'], 
     "description" => $requestDetails['description'], 
     "keyname" => $keyname, 
     "validators" => $this->_app->jsValidator->rules() 
    ]); 
} 

public function test(){ 
    if (!$this->_app->user->checkAccess('uri_soap_requests')) { 
     $this->_app->notFound(); 
    } 
    $post = $this->_app->request->post(); 
    $ms = $this->_app->alerts; 
    $requestSchema = new \Fortress\RequestSchema($this->_app->config('schema.path') . "/forms/soap-request-description-edit.json"); 
    $rf = new \Fortress\HTTPRequestFortress($ms, $requestSchema, $post); 
    $ms->addMessageTranslated("success", "Everyone's title has been updated!", $post); 
    $rf->sanitize(); 
    if (!$rf->validate()) { 
     $this->_app->halt(400); 
    } 
    $data = $rf->data(); 
} 

Entr從的index.php文件 IES：

$app->post('/soap/requests/desc/edit/:request_id/?', function() use ($app) { 
    $controller = new UF\SoapController($app); 
    return $controller->test(); 
}); 
$app->get('/soap/requests/desc/edit/:request_id/?', function ($request_id) use ($app) { 
    $controller = new UF\SoapController($app); 
    return $controller->soapRequestDescriptionEditPage($request_id); 
}); 

最後，模式：

{ 
    "lgname" : { 
    "validators" : { 
     "length" : { 
     "min" : 1, 
     "max" : 150, 
     "message" : "The new title must be between 1 and 150 characters long." 
     } 
    }, 
    "sanitizers" : { 
     "raw" : "" 
    } 
    } 
} 

Answer 1

原來，我的代碼被罰款。影響UserFrosting表單處理的頁面上存在無關的javascript錯誤。解決這些錯誤允許UserFrosting處理表單。

自我提醒...使它成爲一個習慣，尋找到控制檯的JavaScript錯誤:)

Answer 2

由於UserFrosting 4，你應該明確地添加隱藏CSRF輸入字段到表單中。有一個包含這些字段，您可以插入使用枝杈的include標籤部分模板forms/csrf.html.twig：

<form class="form-horizontal" role="form" name="requestDescription" action="{{site.uri.public}}/soap/requests/desc/edit/{{ keyname }}" method="post"> 
    {% include "forms/csrf.html.twig" %} 
    <div class="form-group"> 
     <label for="input_group" class="col-md-2 control-label">Name</label> 
     <div class="col-md-10"> 
      <input type="text" id="input_name" class="form-control" name="lgname" placeholder="{{ name }}"> 
     </div> 
    </div> 
    <div class="form-group text-center"> 
     <button type="submit" class="btn btn-success text-center">Update</button> 
    </div> 
</form> 

對於請求所沒有的形式作出（例如，如果已在Javascript純粹構建它），你可以從全局變量site.csrf搶CSRF令牌名稱和值：

var userName = 'luke'; 
var fieldName = 'lgname'; 

var data = { 
    'value': fieldValue 
}; 

data[site.csrf.keys.name] = site.csrf.name; 
data[site.csrf.keys.value] = site.csrf.value; 

var url = site.uri.public + '/api/users/u/' + userName + '/' + fieldName; 

return $.ajax({ 
    type: "PUT", 
    url: url, 
    data: data 
}).done(function (response) { 
    window.location.reload(); 
});