Skip to content

Commit

Permalink
Form::disableSameSiteProtection() replaced with allowCrossOrigin()
Browse files Browse the repository at this point in the history
  • Loading branch information
dg committed Jan 25, 2021
1 parent d2c71f4 commit 72d5945
Showing 1 changed file with 10 additions and 3 deletions.
13 changes: 10 additions & 3 deletions src/Application/UI/Form.php
Expand Up @@ -21,7 +21,7 @@ class Form extends Nette\Forms\Form implements ISignalReceiver
public $onAnchor;

/** @var bool */
private $sameSiteProtection = true;
protected $crossOrigin = false;


/**
Expand Down Expand Up @@ -103,9 +103,16 @@ public function isAnchored(): bool
/**
* Disables CSRF protection using a SameSite cookie.
*/
public function allowCrossOrigin(): void
{
$this->crossOrigin = true;
}


/** @deprecated use allowCrossOrigin() */
public function disableSameSiteProtection(): void
{
$this->sameSiteProtection = false;
$this->crossOrigin = true;
}


Expand Down Expand Up @@ -153,7 +160,7 @@ public function signalReceived(string $signal): void
$class = static::class;
throw new BadSignalException("Missing handler for signal '$signal' in $class.");

} elseif ($this->sameSiteProtection && !$this->getPresenter()->getHttpRequest()->isSameSite()) {
} elseif (!$this->crossOrigin && !$this->getPresenter()->getHttpRequest()->isSameSite()) {
$this->getPresenter()->detectedCsrf();

} elseif (!$this->getPresenter()->getRequest()->hasFlag(Nette\Application\Request::RESTORED)) {
Expand Down

0 comments on commit 72d5945

Please sign in to comment.