From a5eda979b94f7de4dbb422e1d5a4dd229a2530ea Mon Sep 17 00:00:00 2001
From: Jan-Wijbrand Kolman <janwijbrand@gmail.com>
Date: Fri, 4 Oct 2013 13:15:06 +0200
Subject: [PATCH] Update default form rendering templates to be compatible with
 zope.formlib's CSRF protection (still on a branch).

---
 buildout.cfg                                           | 5 ++++-
 src/grokcore/formlib/templates/default_display_form.pt | 7 ++++++-
 src/grokcore/formlib/templates/default_edit_form.pt    | 5 +++++
 3 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/buildout.cfg b/buildout.cfg
index 99adcfe..440b159 100644
--- a/buildout.cfg
+++ b/buildout.cfg
@@ -1,5 +1,7 @@
 [buildout]
-develop = .
+develop =
+  .
+  ../zope.formlib-csrfprotection
 parts = interpreter test
 extends = https://raw.github.com/zopefoundation/groktoolkit/master/grok.cfg
 versions = versions
@@ -8,6 +10,7 @@ extensions = buildout.dumppickedversions
 
 [versions]
 grokcore.formlib =
+zope.formlib =
 
 [interpreter]
 recipe = zc.recipe.egg
diff --git a/src/grokcore/formlib/templates/default_display_form.pt b/src/grokcore/formlib/templates/default_display_form.pt
index bfd6c3d..e9e5586 100644
--- a/src/grokcore/formlib/templates/default_display_form.pt
+++ b/src/grokcore/formlib/templates/default_display_form.pt
@@ -26,7 +26,12 @@
     <tfoot>
       <tr class="controls">
         <td colspan="2" class="align-right">
-          <input tal:repeat="action view/actions" 
+          <input type="hidden"
+            name="___csrftoken__"
+            tal:condition="view/protected"
+            tal:attributes="value view/csrftoken"
+          />
+          <input tal:repeat="action view/actions"
             tal:replace="structure action/render" />
         </td>
       </tr>
diff --git a/src/grokcore/formlib/templates/default_edit_form.pt b/src/grokcore/formlib/templates/default_edit_form.pt
index 8d5a544..5f9f8ed 100644
--- a/src/grokcore/formlib/templates/default_edit_form.pt
+++ b/src/grokcore/formlib/templates/default_edit_form.pt
@@ -57,6 +57,11 @@
   </table>
 
   <div id="actionsView">
+    <input type="hidden"
+      name="___csrftoken__"
+      tal:condition="view/protected"
+      tal:attributes="value view/csrftoken"
+    />
     <span class="actionButtons" tal:condition="view/availableActions">
       <input tal:repeat="action view/actions"
              tal:replace="structure action/render"