UserFrosting表单 - 无效或遗漏的CSRF令牌

Question

我想在UserFrosting中提交一个简单的表单，并且作为测试只显示成功消息，不进行数据修改。我跟着指导意见Lesson 2但我跑进CSRF问题：

UserFrosting返回以下错误：

Invalid or missing CSRF token.

我缺少什么？直到此时UserFrosting很容易消化:(

形式：

<form class="form-horizontal" role="form" name="requestDescription" action="{{site.uri.public}}/soap/requests/desc/edit/{{ keyname }}" method="post"> 
    <div class="form-group"> 
     <label for="input_group" class="col-md-2 control-label">Name</label> 
     <div class="col-md-10"> 
      <input type="text" id="input_name" class="form-control" name="lgname" placeholder="{{ name }}"> 
     </div> 
    </div> 
    <div class="form-group text-center"> 
     <button type="submit" class="btn btn-success text-center">Update</button> 
    </div> 
</form> 

添加了脚本部分树枝文件的底部：

<script> 
    $(document).ready(function() { 
     // Load the validator rules for this form 
     var validators = {{validators | raw}}; 
     ufFormSubmit(
       $("form[name='requestDescription']"), 
       validators, 
       $("#userfrosting-alerts"), 
       function(data, statusText, jqXHR) { 
        // Reload the page on success 
        window.location.reload(true); 
       } 
     ); 
    }); 
</script> 

这里是我的来自控制器的两个功能：

public function soapRequestDescriptionEditPage($keyname){ 
    if (!$this->_app->user->checkAccess('uri_soap_requests')){ 
     $this->_app->notFound(); 
    } 
    $requestDetails = $this->soapRequestReadMeta($keyname); 

    $schema = new \Fortress\RequestSchema($this->_app->config('schema.path') . "/forms/soap-request-description-edit.json"); 
    $this->_app->jsValidator->setSchema($schema); 

    $this->_app->render('soap/soap-request-description-edit.twig', [ 
     "name" => $requestDetails['name'], 
     "description" => $requestDetails['description'], 
     "keyname" => $keyname, 
     "validators" => $this->_app->jsValidator->rules() 
    ]); 
} 

public function test(){ 
    if (!$this->_app->user->checkAccess('uri_soap_requests')) { 
     $this->_app->notFound(); 
    } 
    $post = $this->_app->request->post(); 
    $ms = $this->_app->alerts; 
    $requestSchema = new \Fortress\RequestSchema($this->_app->config('schema.path') . "/forms/soap-request-description-edit.json"); 
    $rf = new \Fortress\HTTPRequestFortress($ms, $requestSchema, $post); 
    $ms->addMessageTranslated("success", "Everyone's title has been updated!", $post); 
    $rf->sanitize(); 
    if (!$rf->validate()) { 
     $this->_app->halt(400); 
    } 
    $data = $rf->data(); 
} 

Entr从的index.php文件 IES：

$app->post('/soap/requests/desc/edit/:request_id/?', function() use ($app) { 
    $controller = new UF\SoapController($app); 
    return $controller->test(); 
}); 
$app->get('/soap/requests/desc/edit/:request_id/?', function ($request_id) use ($app) { 
    $controller = new UF\SoapController($app); 
    return $controller->soapRequestDescriptionEditPage($request_id); 
}); 

最后，模式：

{ 
    "lgname" : { 
    "validators" : { 
     "length" : { 
     "min" : 1, 
     "max" : 150, 
     "message" : "The new title must be between 1 and 150 characters long." 
     } 
    }, 
    "sanitizers" : { 
     "raw" : "" 
    } 
    } 
} 

Answer 1

原来，我的代码被罚款。影响UserFrosting表单处理的页面上存在无关的javascript错误。解决这些错误允许UserFrosting处理表单。

自我提醒...使它成为一个习惯，寻找到控制台的JavaScript错误:)

Answer 2

由于UserFrosting 4，你应该明确地添加隐藏CSRF输入字段到表单中。有一个包含这些字段，您可以插入使用枝杈的include标签部分模板forms/csrf.html.twig：

<form class="form-horizontal" role="form" name="requestDescription" action="{{site.uri.public}}/soap/requests/desc/edit/{{ keyname }}" method="post"> 
    {% include "forms/csrf.html.twig" %} 
    <div class="form-group"> 
     <label for="input_group" class="col-md-2 control-label">Name</label> 
     <div class="col-md-10"> 
      <input type="text" id="input_name" class="form-control" name="lgname" placeholder="{{ name }}"> 
     </div> 
    </div> 
    <div class="form-group text-center"> 
     <button type="submit" class="btn btn-success text-center">Update</button> 
    </div> 
</form> 

对于请求所没有的形式作出（例如，如果已在Javascript纯粹构建它），你可以从全局变量site.csrf抢CSRF令牌名称和值：

var userName = 'luke'; 
var fieldName = 'lgname'; 

var data = { 
    'value': fieldValue 
}; 

data[site.csrf.keys.name] = site.csrf.name; 
data[site.csrf.keys.value] = site.csrf.value; 

var url = site.uri.public + '/api/users/u/' + userName + '/' + fieldName; 

return $.ajax({ 
    type: "PUT", 
    url: url, 
    data: data 
}).done(function (response) { 
    window.location.reload(); 
});