bug symfony#9662 [FrameworkBundle] Enabled csrf_protection by default if form.csrf_protection is enabled (bschussek)

fabpot · fabpot · commit d4f2ffb27a2a · 2013-11-30T17:55:47.000+01:00
This PR was submitted for the master branch but it was merged into the 2.4 branch instead (closes symfony#9662). Discussion ---------- [FrameworkBundle] Enabled csrf_protection by default if form.csrf_protection is enabled | Q | A | ------------- | --- | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | symfony#9429 | License | MIT | Doc PR | - This PR enables the CSRF protection services automatically if CSRF protection for forms is enabled. In this case, the CSRF protection services cannot be disabled anymore manually (the same as with the validation services). Commits ------- b5e5c71 [FrameworkBundle] Enabled csrf_protection by default if form.csrf_protection is enabled
diff --git a/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php b/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php
@@ -93,14 +93,18 @@ public function load(array $configs, ContainerBuilder $container)
 
         $loader->load('security.xml');
 
-        $this->registerSecurityCsrfConfiguration($config['csrf_protection'], $container, $loader);
-
         if ($this->isConfigEnabled($container, $config['form'])) {
             $this->formConfigEnabled = true;
             $this->registerFormConfiguration($config, $container, $loader);
             $config['validation']['enabled'] = true;
+
+            if ($this->isConfigEnabled($container, $config['form']['csrf_protection'])) {
+                $config['csrf_protection']['enabled'] = true;
+            }
         }
 
+        $this->registerSecurityCsrfConfiguration($config['csrf_protection'], $container, $loader);
+
         if (isset($config['templating'])) {
             $this->registerTemplatingConfiguration($config['templating'], $config['ide'], $container, $loader);
         }
@@ -159,10 +163,6 @@ private function registerFormConfiguration($config, ContainerBuilder $container,
     {
         $loader->load('form.xml');
         if ($this->isConfigEnabled($container, $config['form']['csrf_protection'])) {
-            if (!$this->isConfigEnabled($container, $config['csrf_protection'])) {
-                throw new \LogicException('CSRF protection needs to be enabled in order to use CSRF protection for forms.');
-            }
-
             $loader->load('form_csrf.xml');
 
             $container->setParameter('form.type_extension.csrf.enabled', true);
diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/FrameworkExtensionTest.php b/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/FrameworkExtensionTest.php
@@ -41,13 +41,11 @@ public function testCsrfProtectionNeedsSessionToBeEnabled()
         $this->createContainerFromFile('csrf_needs_session');
     }
 
-    /**
-     * @expectedException \LogicException
-     * @expectedExceptionMessage CSRF protection needs to be enabled in order to use CSRF protection for forms.
-     */
-    public function testCsrfProtectionForFormsNeedCsrfProtectionToBeEnabled()
+    public function testCsrfProtectionForFormsEnablesCsrfProtectionAutomatically()
     {
-        $this->createContainerFromFile('csrf');
+        $container = $this->createContainerFromFile('csrf');
+
+        $this->assertTrue($container->hasDefinition('security.csrf.token_manager'));
     }
 
     public function testSecureRandomIsAvailableIfCsrfIsDisabled()

Original file line number	Diff line number	Diff line change
`@@ -41,13 +41,11 @@ public function testCsrfProtectionNeedsSessionToBeEnabled()`
`41`	`41`	`$this->createContainerFromFile('csrf_needs_session');`
`42`	`42`	`}`
`43`	`43`
`44`		`- /**`
`45`		`- * @expectedException \LogicException`
`46`		`- * @expectedExceptionMessage CSRF protection needs to be enabled in order to use CSRF protection for forms.`
`47`		`- */`
`48`		`- public function testCsrfProtectionForFormsNeedCsrfProtectionToBeEnabled()`
	`44`	`+ public function testCsrfProtectionForFormsEnablesCsrfProtectionAutomatically()`
`49`	`45`	`{`
`50`		`- $this->createContainerFromFile('csrf');`
	`46`	`+ $container = $this->createContainerFromFile('csrf');`
	`47`	`+`
	`48`	`+ $this->assertTrue($container->hasDefinition('security.csrf.token_manager'));`
`51`	`49`	`}`
`52`	`50`
`53`	`51`	`public function testSecureRandomIsAvailableIfCsrfIsDisabled()`