Skip to content

Commit a07608c

Browse files
committed
Fix incorrect CSRF token fields when using postLink()
Creating a postLink after creating a GET form would result in the incorrect fields being generated. Fixes #2308
1 parent 1f5d1ee commit a07608c

File tree

2 files changed

+30
-0
lines changed

2 files changed

+30
-0
lines changed

lib/Cake/Test/Case/View/Helper/FormHelperTest.php

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7172,6 +7172,35 @@ public function testPostLink() {
71727172
));
71737173
}
71747174

7175+
/**
7176+
* test creating postLinks after a GET form.
7177+
*
7178+
* @return void
7179+
*/
7180+
public function testPostLinkAfterGetForm() {
7181+
$this->Form->request->params['_Token']['key'] = 'testkey';
7182+
$this->Form->create('User', array('type' => 'get'));
7183+
$this->Form->end();
7184+
7185+
$result = $this->Form->postLink('Delete', '/posts/delete/1');
7186+
$this->assertTags($result, array(
7187+
'form' => array(
7188+
'method' => 'post', 'action' => '/posts/delete/1',
7189+
'name' => 'preg:/post_\w+/', 'id' => 'preg:/post_\w+/', 'style' => 'display:none;'
7190+
),
7191+
array('input' => array('type' => 'hidden', 'name' => '_method', 'value' => 'POST')),
7192+
array('input' => array('type' => 'hidden', 'name' => 'data[_Token][key]', 'value' => 'testkey', 'id' => 'preg:/Token\d+/')),
7193+
'div' => array('style' => 'display:none;'),
7194+
array('input' => array('type' => 'hidden', 'name' => 'data[_Token][fields]', 'value' => 'preg:/[\w\d%]+/', 'id' => 'preg:/TokenFields\d+/')),
7195+
array('input' => array('type' => 'hidden', 'name' => 'data[_Token][unlocked]', 'value' => '', 'id' => 'preg:/TokenUnlocked\d+/')),
7196+
'/div',
7197+
'/form',
7198+
'a' => array('href' => '#', 'onclick' => 'preg:/document\.post_\w+\.submit\(\); event\.returnValue = false; return false;/'),
7199+
'Delete',
7200+
'/a'
7201+
));
7202+
}
7203+
71757204
/**
71767205
* Test that postLink adds _Token fields.
71777206
*

lib/Cake/View/Helper/FormHelper.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -523,6 +523,7 @@ public function end($options = null) {
523523
$out .= $this->Html->useTag('formend');
524524

525525
$this->_View->modelScope = false;
526+
$this->requestType = null;
526527
return $out;
527528
}
528529

0 commit comments

Comments
 (0)