Skip to content

Commit

Permalink
Form: added disableSameSiteProtection()
Browse files Browse the repository at this point in the history
  • Loading branch information
dg committed Oct 21, 2019
1 parent a07984d commit 7e42997
Showing 1 changed file with 13 additions and 1 deletion.
14 changes: 13 additions & 1 deletion src/Application/UI/Form.php
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,9 @@ class Form extends Nette\Forms\Form implements ISignalReceiver
/** @var callable[]&(callable(Form $sender): void)[]; Occurs when form is attached to presenter */
public $onAnchor;

/** @var bool */
private $sameSiteProtection = true;


/**
* Application form constructor.
Expand Down Expand Up @@ -97,6 +100,15 @@ public function isAnchored(): bool
}


/**
* Disables CSRF protection using a SameSite cookie.
*/
public function disableSameSiteProtection(): void
{
$this->sameSiteProtection = false;
}


/**
* Internal: returns submitted HTTP data or null when form was not submitted.
*/
Expand Down Expand Up @@ -143,7 +155,7 @@ public function signalReceived(string $signal): void
$class = get_class($this);
throw new BadSignalException("Missing handler for signal '$signal' in $class.");

} elseif (!$this->getPresenter()->getHttpRequest()->isSameSite()) {
} elseif ($this->sameSiteProtection && !$this->getPresenter()->getHttpRequest()->isSameSite()) {
$this->getPresenter()->detectedCsrf();

} elseif (!$this->getPresenter()->getRequest()->hasFlag(Nette\Application\Request::RESTORED)) {
Expand Down

0 comments on commit 7e42997

Please sign in to comment.