How to change CSRF attack message in Symfony 1.2
I wanted to change the symfony 1.2 CSRF attack message from "CSRF attack detected." to "This session has expired. Please return to the home page and try again.".
The default scary error message is hard coded in sfValidatorCSRFToken.class.php like this:
$this->addMessage('csrf_attack', 'CSRF attack detected.');
There aren't that many clues out there about how to change it without modifying the core class either. Kris Wallsmith (Symfony Release Manager) suggested I look at using event dispatcher. Then I found his article on the net which gave me more clues.
So here's the solution that I ended up with. First let's create a listener class and save it in the project lib folder as myTemplateFilterParametersListener.php
class myTemplateFilterParametersListener { public function connect(sfEventDispatcher $dispatcher) { $dispatcher->connect('template.filter_parameters', array($this, 'filterParameters')); } public function filterParameters(sfEvent $event, $parameters) { foreach ($parameters as $name => $param) { if ($param instanceof sfForm) { $form = $param; /* @var $form sfForm */ self::changeCSRFErrorMessage($form); } } return $parameters; } public static function changeCSRFErrorMessage(sfForm $form) { $errors = $form->getErrorSchema()->getNamedErrors(); if ($errors) { foreach ($errors as $i => $error) { /* @var $error sfValidatorError */ if ($i == '_csrf_token') { $validator = $error->getValidator(); /* @var $validator sfValidatorCSRFToken */ $validator->setMessage('csrf_attack', 'This session has expired. Please return to the home page and try again.'); } } } } }
Then hook it to the event dispatcher in apps/frontend/config/frontendConfiguration.class.php
class frontendConfiguration extends sfApplicationConfiguration { public function initialize() { $listener = new myTemplateFilterParametersListener($this->getConfigCache()); $listener->connect($this->dispatcher); } public function configure() { } }
./symfony cc
That's it :)
Use Firebug to test it. Open your webpage containing the form, use Firebug to change the _csrf_token value to trigger CSRF attack error, and you should see "This session has expired. Please return to the home page and try again." error message.
No related posts.
Related posts brought to you by Yet Another Related Posts Plugin.
January 21st, 2011 - 06:19
This is great. Symfony prepends the message w/ “_csrf_token:” with is a bit cryptic for end users. Is there a solution for removing it?
January 21st, 2011 - 09:23
Removing CSRF? You can call $this->disableCSRFProtection() to remove the CSRF protection of a form. Or to disable all CSRF on all forms, go to the frontend/config/settings.yml and set “csrf_secret: false”
March 18th, 2011 - 08:41
Wouldn’t it be better to no loop over all of the erros in changeCSRFErrorMessage and instead do something like (untested):
public static function changeCSRFErrorMessage(sfForm $form)
{
$errors = $form->getErrorSchema()->getNamedErrors();
if ( $errors && isset($errors['_csrf_token']) )
{
$csrf_error = $errors['_csrf_token'];
$validator = $error->getValidator();
$validator->setMessage(‘csrf_attack’, ‘This session has expired. Please return to the home page and try again.’);
}
}
March 18th, 2011 - 08:52
Hi Matt,
It would be. Someone just need to test it and make sure it is working (and with what version of Symfony).
May be I’ll test your code next time I need something like this.
Cheers