Apply CSRF token on demand, so validation is not based on a default

packaged · Jan 16, 2019 · 4ed7457 · 4ed7457
1 parent 78f6fb5
commit 4ed7457
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 0 deletions.
diff --git a/src/Csrf/CsrfDataHandler.php b/src/Csrf/CsrfDataHandler.php
@@ -16,7 +16,12 @@ public function __construct($formSecret, $sessionSecret)
   {
     $this->setFormSecret($formSecret);
     $this->setSessionSecret($sessionSecret);
+  }
+
+  public function applyNewToken()
+  {
     $this->setValue(password_hash($this->_generatePassword(), PASSWORD_DEFAULT));
+    return $this;
   }
 
   protected function _generatePassword()

diff --git a/tests/Csrf/CsrfFormTest.php b/tests/Csrf/CsrfFormTest.php
@@ -10,6 +10,7 @@ public function testCsrfToken()
   {
     $secret = 'user-secret';
     $form = new CsrfForm($secret);
+    $form->csrfToken->applyNewToken();
     $formValue = $form->csrfToken->getValue();
 
     $this->assertTrue($form->csrfToken->isValid());
@@ -30,6 +31,7 @@ public function testRender()
   {
     $secret = 'user-secret';
     $form = new CsrfForm($secret);
+    $form->csrfToken->applyNewToken();
     $html = $form->produceSafeHTML()->getContent();
     $this->assertRegExp(
       '/\<form method="POST"\>\<input type="hidden" value=".*" name="csrfToken" \/\>\<\/form\>/',