Blue Horn

Symfony Framework

How to change CSRF attack message in Symfony 1.2

July 15, 2010 by Sid in Symfony Framework with 4 Comments

I wanted to change the symfony 1.2 CSRF attack message from “CSRF attack detected.” to “This session has expired. Please return to the home page and try again.”.

The default scary error message is hard coded in sfValidatorCSRFToken.class.php like this:

$this->addMessage('csrf_attack', 'CSRF attack detected.');

There aren’t that many clues out there about how to change it without modifying the core class either. Kris Wallsmith (Symfony Release Manager) suggested I look at using event dispatcher.¬†Then I found his article on the net which gave me more clues.

So here’s the solution that I ended up with. First let’s create a listener class and save it in the project lib folder as myTemplateFilterParametersListener.php

class myTemplateFilterParametersListener
{
  public function connect(sfEventDispatcher $dispatcher)
  {
    $dispatcher->connect('template.filter_parameters',
      array($this, 'filterParameters'));
  }

  public function filterParameters(sfEvent $event, $parameters)
  {
    foreach ($parameters as $name => $param)
    {
      if ($param instanceof sfForm)
      {
        $form = $param; /* @var $form sfForm */

        self::changeCSRFErrorMessage($form);
      }
    }

    return $parameters;
  }

  public static function changeCSRFErrorMessage(sfForm $form)
  {
    $errors = $form->getErrorSchema()->getNamedErrors();
    if ($errors)
    {
      foreach ($errors as $i => $error)
      { /* @var $error sfValidatorError */

        if ($i == '_csrf_token')
        {
          $validator = $error->getValidator();
          /* @var $validator sfValidatorCSRFToken */
          $validator->setMessage('csrf_attack', 'This session has expired. Please return to the home page and try again.');
        }
      }
    }
  }
}

Then hook it to the event dispatcher in apps/frontend/config/frontendConfiguration.class.php


class frontendConfiguration extends sfApplicationConfiguration
{
  public function  initialize() {
    $listener = new myTemplateFilterParametersListener($this->getConfigCache());
    $listener->connect($this->dispatcher);
  }

  public function configure()
  {
  }
}

./symfony cc

That’s it :)

Use Firebug to test it. Open your webpage containing the form, use Firebug to change the _csrf_token value to trigger CSRF attack error, and you should see “This session has expired. Please return to the home page and try again.” error message.

4 Comments

  1. JeromeJanuary 21, 2011 at 6:19 am

    This is great. Symfony prepends the message w/ “_csrf_token:” with is a bit cryptic for end users. Is there a solution for removing it?

  2. SidJanuary 21, 2011 at 9:23 amAuthor

    Removing CSRF? You can call $this->disableCSRFProtection() to remove the CSRF protection of a form. Or to disable all CSRF on all forms, go to the frontend/config/settings.yml and set “csrf_secret: false”

  3. Matt FarmerMarch 18, 2011 at 8:41 am

    Wouldn’t it be better to no loop over all of the erros in changeCSRFErrorMessage and instead do something like (untested):

    public static function changeCSRFErrorMessage(sfForm $form)
    {
    $errors = $form->getErrorSchema()->getNamedErrors();
    if ( $errors && isset($errors['_csrf_token']) )
    {
    $csrf_error = $errors['_csrf_token'];
    $validator = $error->getValidator();
    $validator->setMessage(‘csrf_attack’, ‘This session has expired. Please return to the home page and try again.’);
    }
    }

  4. SidMarch 18, 2011 at 8:52 am

    Hi Matt,

    It would be. Someone just need to test it and make sure it is working (and with what version of Symfony).

    May be I’ll test your code next time I need something like this.

    Cheers

Leave a reply

Your email address will not be published. Required fields are marked *

*

My Projects
Restaurant Websites
Websites