csrf_verify not work on empty $_POST

[harryxu]

If I post a page without any form data, like post admin/user/delete/1, the csrf_verify will not work and the user will be deleted.

May be this line should change to:

if ($_SERVER['REQUEST_METHOD'] == 'GET' && !isset($_COOKIE[$this->_csrf_cookie_name])

[it-can]

how do you do an empty post? If csrf is enabled than it adds a hidden input field to your form, that should be posted...

[harryxu]

If Im a attacker, I will write a simple html form page with out any input field, set the form action to http://site.com/admin/user/delete/1.

Then I put the html to my server and send the url to site admin, if the site admin open my url and click the submit button, the csrf will not working and perform the user deletion.

If I put some js to the page make the form submit automatically, when the site admin open the url, who even no need to click the submit button.