CSRF and PDO improvements

src/Controller/Component/CsrfComponent.php

@@ -94,7 +94,7 @@ public function startup(Event $event)
         if ($request->is('get') && $cookieData === null) {
             $this->_setCookie($request, $response);
         }
-        if (!$request->is(['head', 'get', 'options'])) {
+        if ($request->is(['put', 'post', 'delete', 'patch']) || !empty($request->data)) {
             $this->_validateToken($request);
             unset($request->data[$this->_config['field']]);
         }

src/Database/Driver/Mysql.php

@@ -70,7 +70,7 @@ public function connect()
         $config['flags'] += [
             PDO::ATTR_PERSISTENT => $config['persistent'],
             PDO::MYSQL_ATTR_USE_BUFFERED_QUERY => true,
-            PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION
+            PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
         ];
 
         if (!empty($config['ssl_key']) && !empty($config['ssl_cert'])) {

src/Database/Driver/Postgres.php

@@ -56,6 +56,7 @@ public function connect()
         $config = $this->_config;
         $config['flags'] += [
             PDO::ATTR_PERSISTENT => $config['persistent'],
+            PDO::ATTR_EMULATE_PREPARES => false,
             PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION
         ];
         if (empty($config['unix_socket'])) {

src/Database/Driver/Sqlite.php

@@ -55,6 +55,7 @@ public function connect()
         $config = $this->_config;
         $config['flags'] += [
             PDO::ATTR_PERSISTENT => $config['persistent'],
+            PDO::ATTR_EMULATE_PREPARES => false,
             PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION
         ];
 

src/Database/Driver/Sqlserver.php

@@ -60,6 +60,7 @@ public function connect()
         $config = $this->_config;
         $config['flags'] += [
             PDO::ATTR_PERSISTENT => $config['persistent'],
+            PDO::ATTR_EMULATE_PREPARES => false,
             PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION
         ];
 

tests/TestCase/Controller/Component/CsrfComponentTest.php

@@ -83,12 +83,14 @@ public function testSettingCookie()
     /**
      * Data provider for HTTP method tests.
      *
+     * HEAD and GET do not populate $_POST or request->data.
+     *
      * @return void
      */
     public static function safeHttpMethodProvider()
     {
         return [
-            ['GET'], ['OPTIONS'], ['HEAD']
+            ['GET', 'HEAD']
         ];
     }
 
@@ -116,14 +118,14 @@ public function testSafeMethodNoCsrfRequired($method)
     }
 
     /**
-     * Data provider for HTTP method tests.
+     * Data provider for HTTP methods that can contain request bodies.
      *
      * @return void
      */
     public static function httpMethodProvider()
     {
         return [
-            ['PATCH'], ['PUT'], ['POST'], ['DELETE'], ['PURGE'], ['INVALIDMETHOD']
+            ['OPTIONS'], ['PATCH'], ['PUT'], ['POST'], ['DELETE'], ['PURGE'], ['INVALIDMETHOD']
         ];
     }
 
@@ -142,6 +144,7 @@ public function testValidTokenInHeader($method)
                 'REQUEST_METHOD' => $method,
                 'HTTP_X_CSRF_TOKEN' => 'testing123',
             ],
+            'post' => ['a' => 'b'],
             'cookies' => ['csrfToken' => 'testing123']
         ]);
         $controller->response = new Response();
@@ -167,6 +170,7 @@ public function testInvalidTokenInHeader($method)
                 'REQUEST_METHOD' => $method,
                 'HTTP_X_CSRF_TOKEN' => 'nope',
             ],
+            'post' => ['a' => 'b'],
             'cookies' => ['csrfToken' => 'testing123']
         ]);
         $controller->response = new Response();

tests/TestCase/Database/Driver/PostgresTest.php

@@ -53,6 +53,7 @@ public function testConnectionConfigDefault()
 
         $expected['flags'] += [
             PDO::ATTR_PERSISTENT => true,
+            PDO::ATTR_EMULATE_PREPARES => false,
             PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION
         ];
 
@@ -107,6 +108,7 @@ public function testConnectionConfigCustom()
         $expected = $config;
         $expected['flags'] += [
             PDO::ATTR_PERSISTENT => false,
+            PDO::ATTR_EMULATE_PREPARES => false,
             PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION
         ];
 

tests/TestCase/Database/Driver/SqliteTest.php

@@ -47,6 +47,7 @@ public function testConnectionConfigDefault()
 
         $expected['flags'] += [
             PDO::ATTR_PERSISTENT => false,
+            PDO::ATTR_EMULATE_PREPARES => false,
             PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION
         ];
         $driver->expects($this->once())->method('_connect')
@@ -80,6 +81,7 @@ public function testConnectionConfigCustom()
         $expected += ['username' => null, 'password' => null];
         $expected['flags'] += [
             PDO::ATTR_PERSISTENT => true,
+            PDO::ATTR_EMULATE_PREPARES => false,
             PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION
         ];
 

tests/TestCase/Database/Driver/SqlserverTest.php

@@ -67,6 +67,7 @@ public function testConnectionConfigCustom()
         $expected = $config;
         $expected['flags'] += [
             PDO::ATTR_PERSISTENT => false,
+            PDO::ATTR_EMULATE_PREPARES => false,
             PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
             PDO::SQLSRV_ATTR_ENCODING => 'a-language'
         ];