Mongo CSRF Form Validation

Question

Mongo CSRF Form Validation

Xerton Dec '16

Created Dec '16	Last Reply None	Replies 0	Views 380	Votes 0

Xerton 7.1k

Dec '16

Hi,

i have some troubles with form validation using ODM.

I have a basic form class

class Update extends Form
{
    public function getCsrf()
    {
        return $this->security->getToken();
    }

    public function initialize($entity = null, $options = [])
    {
        $id = new Hidden('id');
        $id->addValidator( new PresenceOf(['message' => '<b>ID<b> is required.']) );
        $id->setFilters(['trim', 'string']);  // ObjectID
        $id->setAttributes(['id' => null]);
        $this->add($id);

        $type = new Hidden('type');
        $type->addValidator(new PresenceOf(['message' => '<b>Type<b> is required.']) );
        $type->setDefault($options['type']);
        $type->setFilters(['trim', 'string']);
        $type->setAttributes(['id' => null]);
        $this->add($type);

        $csrf = new Hidden('csrf');
        $csrf->addValidator( new PresenceOf(['message' => 'CSRF is required.']) );
        $csrf->addValidator( new Identical( ['value' => $this->security->getSessionToken(), 'message' => 'CSRF validation failed.' ]) );
        $csrf->setAttributes(['id' => null]);
        $csrf->clear();
        $this->add($csrf);

        $name = new Text('name');
        $name->setLabel('Nom');
        $name->addValidator( new PresenceOf(['message' => 'The name is required.']) );
        $name->setAttributes( ['class' => 'form-control', 'id' => null]);
        $name->setFilters(['trim', 'string']);
        $this->add($name);
    }
}

Then when I submit form : ( sample)

public function updateAction()
    {
        $this->view->disable();

        if ($this->request->isPut() == true && $this->request->isAjax() == true) {

            $id = $this->request->getPut('id', ['trim', 'string']);
            $type =  $this->request->getPut('type', ['trim', 'string']);
            $name = $this->request->getPut('name', ['trim', 'string']);

           $entity = Model::findFirst([['_id' => new ObjectID($id)]]);

            $form = new updateForm($entity, ['type' => $type]);

            if ($form->isValid($this->request->getPut()) != false)
            {

            if ($entity->save() === true) {
                $msg['success'][] =  ['message' => 'Updated Successfully'];
            } else {
                foreach ($entity->getMessages() as $message) {
                    $msg['error'][] = ['message' => $message->getMessage()];
                }
            }

        } else {
            foreach ($form->getMessages() as $message) {
                $msg['error'][] = ['message' => $message->getMessage()];
            }
        }

            $this->response->setStatusCode(200, 'OK');
            $this->response->setJsonContent(msg);
            $this->response->send();
        }
    }

The problem is when i set entity to form CSRF token failed at validation.

I try many solution but not result.

Model::findById($id) => Validation FAILED
Model::findFirst([['_id' => new ObjectID($id)]]); => Validation FAILED
Model::findFirst(['_id' => $id]); => return Bad Document

Any solution ?

Thx,

Xerton
7.1k

Accepted
answer

Jan '17

I think I found the problem.

I'm using PUT method to Update and DELETE method to Delete. Then i'm using ajax to delete or update entity. exemple : $router->addDelete('/some/route/{type:[a-z]+}/delete', array( 'action' => 'delete' ))->setName('SomeRouteDelete');

And when we look at => https://github.com/phalcon/cphalcon/blob/master/phalcon/security.zep#L393 Phalcon only check on POST.

In that case I have to change all routes (addDelete and addPut) in POST, all ajax method to POST and CSRF validation in form.

now I have to use CSRF in template file

{{ hidden_field(security.getTokenKey(), "value": security.getToken()) }}

instead CSRF in form class

class DeleteForm extends Form
{
    public function getCsrf()
    {
        return $this->security->getToken();
    }

    public function initialize($entity = null, $options = [])
    {
        // Other Inputs

        $csrf = new Hidden('csrf');
        $csrf->addValidator( new Identical( ['value' => $this->security->getSessionToken(), 'message' => 'CSRF validation failed' ]));
        $csrf->setAttributes(['id' => null]);
        $csrf->clear();
        $this->add($csrf);
    }

}

and

if ($this->security->checkToken()) {
           // 
}