Comments on: How to change CSRF attack message in Symfony 1.2

By: Sid

Sid — Thu, 17 Mar 2011 19:52:26 +0000

Hi Matt,

It would be. Someone just need to test it and make sure it is working (and with what version of Symfony).

May be I’ll test your code next time I need something like this.

Cheers

By: Matt Farmer

Matt Farmer — Thu, 17 Mar 2011 19:41:39 +0000

Wouldn’t it be better to no loop over all of the erros in changeCSRFErrorMessage and instead do something like (untested):

public static function changeCSRFErrorMessage(sfForm $form)
{
$errors = $form->getErrorSchema()->getNamedErrors();
if ( $errors && isset($errors['_csrf_token']) )
{
$csrf_error = $errors['_csrf_token'];
$validator = $error->getValidator();
$validator->setMessage(‘csrf_attack’, ‘This session has expired. Please return to the home page and try again.’);
}
}

By: Sid

Sid — Thu, 20 Jan 2011 20:23:21 +0000

Removing CSRF? You can call $this->disableCSRFProtection() to remove the CSRF protection of a form. Or to disable all CSRF on all forms, go to the frontend/config/settings.yml and set “csrf_secret: false”

By: Jerome

Jerome — Thu, 20 Jan 2011 17:19:33 +0000

This is great. Symfony prepends the message w/ “_csrf_token:” with is a bit cryptic for end users. Is there a solution for removing it?