6

I have used the methods described on this page in Joomla many times before:

http://docs.joomla.org/How_to_add_CSRF_anti-spoofing_to_forms

Now I want to implement the same mechanism using the Joomla Framework and the Framework App. So I have tried this:

$token = $this->app->getFormToken();

But this causes the application to exit. I have stepped through the code and the problem starts in the getFormToken function here:

return md5($this->get('secret') . $userId . $this->session->getToken($forceNew));

$this->get('secret') returns here because there is no dot in 'secret':

if (!strpos($path, '.'))
{
    return (isset($this->data->$path) && $this->data->$path !== null && $this->data->$path !== '') ? $this->data->$path : $default;
}

Then this function runs from Symfony:

public function write($sessionId, $data)
{
    return (bool) $this->handler->write($sessionId, $data);
}

And finally this function runs:

public function close()
{
    $this->active = false;

    return (bool) $this->handler->close();
}

Which exits the application.

What am I doing wrong? Do I need to add a 'secret' somewhere? How should I generate a form token which I then check when the form is submitted?

4

I finally worked it out. I needed to create a session and assign it to the app before getFormToken would work. So first I use the Joomla session:

use Joomla\Session\Session;

Then create the session, set it and get the form token:

$session = Session::getInstance('none');
$this->app->setSession($session);
$token = $this->app->getFormToken();

Easy when you know how! I hope this helps someone else.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.