CSRF token error when a form is loaded but not submitted

[alexweissman]

Kind of a weird error. When I click for example "create group", it loads the group creation form. Now, if I cancel that action, instead of inputting and submitting the form, but then go and try to edit details for an existing group, it fails when I submit that second form. The error I get is the CSRF token error.

So, something strange is going on with the CSRF middleware.

There is no submitHandler attached to the "edit existing group" form.

After "create group", "cancel", "edit existing group" the DOM looks like this.

<div id="dialog-group-create">
  <form name="group" method="post" action="http:​/​/​uf.app/​groups" novalidate="novalidate"></form>
</div>

<div id="dialog-group-edit">
    <form name="group" method="post" action="http:​/​/​uf.app/​groups/​g/​3"></form>
</div>

The selector $("form[name='group']") in widget-groups.js now returns two items.

// Link submission buttons
ufFormSubmit(
  $("form[name='group']"),
  validators,
  $("#form-alerts"),

The call to formElement.validate() inside ufFormSubmit() will set the submitHandler for the first item only (form inside div dialog-group-create).

See jquery.validate.js

// check if a validator for this form was already created
var validator = $.data( this[ 0 ], "validator" );
if ( validator ) {
  return validator;
}

Finaly, no submitHandler means no csrf token in the following post request.

[alexweissman]

Thanks for figuring this out, @blink01! I'll try to get this fixed in the next hotfix.