Im trying to secure my Zend form with crsf token. Allways if I add token element to my form, it always send me back notEmpty error message for token. Im I doing something wrong? Thx
class Application_Form_Test3 extends Zend_Form {
public function init() {
$this->setMethod('post');
//..some elements
$note = new Zend_Form_Element_Textarea('note');
$note->addValidator('stringLength', false, array(2, 50));
$note->setRequired(true);
$note->class = 'form-control';
$note->setLabel('Poznámka:');
$note->setAttrib('placeholder', 'poznamka ke spisu');
$note->setOptions(array('cols' => '20', 'rows' => '4'));
$submit = new Zend_Form_Element_Submit('submit');
$submit->class = 'btn btn-success';
$submit->setValue('odeslat');
$this->addElements(array(
$number,
$year,
$owner,
$note,
$submit,
));
$this->addElement('hash', 'no_csrf_foo', array('salt' => 'unique'));
}
}
Action in controller:
public function findAction() {
$request = $this->getRequest();
$form = new Application_Form_Test3();
if ($this->getRequest()->isPost()) {
if ($form->isValid($request->getPost())) {
var_dump($request->getPost());
} else {
var_dump("ERROR");
}
}
$this->view->form = $form;
}
In my view I render form and dump error messages
...
<?php echo $form->renderForm(false); ?>
...
//render single elements here
//eg. <?php echo $form->note->renderViewHelper(); ?>
...
<?php var_dump($form->getMessages()) ?>
...
After each validation of form, i get array of error messages like that:
array(2) { ["note"]=> array(1) { ["isEmpty"]=> string(36) "Value is required and can't be empty" } ["no_csrf_foo"]=> array(1) { ["isEmpty"]=> string(36) "Value is required and can't be empty" } }
if I fill good values to elements, the last one error is always for token - NotEmpty, so my form is never valid.
Problem solved. I didnt render token element in my View so i added to View:
<?php echo $form->no_csrf_foo->renderViewHelper(); ?>
Related
I’m learning Cakephp3.3 and have run into a problem trying to validate a form prior to saving.
I created a new form in ‘src/Template/Users’ called ‘register.ctp’ and added an action called ‘register’ in ‘src/Controller/UsersController’.
I want to validate form submissions before saving but can’t figure out how to make this work.
FWIW, pre-save validation works perfectly for the ‘add’ and ‘edit’ forms, though I think this happens by default in Cakephp3.
Is there a way to make these same validation rules apply for the ‘register’ form?
FYI, the 'register' action is actually updating an existing user record previously created for an anonymous user.
Here's the controller action:
<?php
namespace App\Controller;
use App\Controller\AppController;
use Cake\Event\Event;
class UsersController extends AppController
{
//<snipped methods>
public function register()
{
if($this->request->session()->read('Auth.User'))
{
$id = $this->request->session()->read('Auth.User.id');
if ($this->request->is(['patch', 'post', 'put']))
{
$user = $this->Users->get($id, [
'contain' => []
]);
$user = $this->Users->patchEntity($user, $this->request->data);
if ($this->Users->save($user))
{
$this->Flash->success(__('Your free trial period has started.'));
return $this->redirect("/Home/index");
}
else
{
$this->Flash->error(__('We were unable to start your trial. Please, try again.'));
}
}
}
else
{
$this->Flash->error(__('Your demo session has expired. Please start again.'));
}
$this->set(compact('user'));
$this->set('_serialize', ['user']);
}
}
Here's the UsersTable Model with the validation rules:
<?php
namespace App\Model\Table;
use Cake\ORM\Query;
use Cake\ORM\RulesChecker;
use Cake\ORM\Table;
use Cake\Validation\Validator;
class UsersTable extends Table
{
public function initialize(array $config)
{
parent::initialize($config);
$this->table('users');
$this->displayField('id');
$this->primaryKey('id');
$this->addBehavior('Timestamp');
}
public function validationDefault(Validator $validator)
{
$validator
->integer('id')
->allowEmpty('id', 'create');
$validator
->email('email')
->requirePresence('email')
->notEmpty('An email address is required.');
$validator
->requirePresence('password')
->notEmpty('A password is required.');
$validator
->requirePresence('firstname')
->notEmpty('firstname')
->add('firstname', 'minlength',['rule' => ['minlength', 1]]);
$validator
->requirePresence('lastname')
->notEmpty('lastname')
->add('lastname', 'minlength',['rule' => ['minlength', 1]]);
$validator
->integer('status')
->requirePresence('status', 'create')
->notEmpty('status');
$validator
->add('role', 'inList', [
'rule' => ['inlist', ['admin','author','subscriber']],
'message' => 'Please enter a valid role.'
]);
$validator
->requirePresence('referer', 'create')
->allowEmpty('referer');
$validator
->integer('plan_id')
->requirePresence('plan_id', 'create')
->notEmpty('plan_id');
return $validator;
}
public function buildRules(RulesChecker $rules)
{
$rules->add($rules->isUnique(['email']));
return $rules;
}
}
And here's the register.ctp form:
<div class="users form large-12 columns ">
<?= $this->Form->create() ?>
<fieldset>
<legend><?= __('Sign Up For Your No-Risk Free Trial!') ?></legend>
<?= $this->Form->input('firstname'); ?>
<?= $this->Form->input('lastname'); ?>
<?= $this->Form->input('email'); ?>
<?= $this->Form->input('password'); ?>
</fieldset>
<?= $this->Form->button(__('Start My Free Trial Now')) ?>
<?= $this->Form->end() ?>
</div>
Any help would be greatly appreciated!
if you want to save then the Default validation rules will be apply. if you don't want to apply the default rule then just add the 'validate' => false param
$user = $this->Users->patchEntity($user, $this->request->data,['validate' => false])
if you want to custom validation rule only for register options then need to create new function in your TABLE
class UsersTable extends Table
{
public function validationRegister($validator)
{
$validator
->email('email')
->requirePresence('email')
->notEmpty('An email address is required.');
$validator
->requirePresence('password')
->notEmpty('A password is required.');
$validator
->requirePresence('firstname')
->notEmpty('firstname')
->add('firstname', 'minlength',['rule' => ['minlength', 1]]);
return $validator;
}
}
Now set the 'validate' => 'register' param in your controller newEntity or patchEntity Funciton
$user = $this->Users->patchEntity($user, $this->request->data,['validate' => 'register'])
public function addAction()
{
$form = new ApplicationForm();
$this->view->form = $form;
if ($this->getRequest()->isPost()) {
$formData = $this->getRequest()->getPost();
if ($form->isValid($formData)) {
$name = $form->getvalue('name');
$class = $form->getvalue('class');
$file = new Application_Model_DbTable_Records();
$file->addRecord($name,$class);
$this->_helper->redirector('index');
}
}
}
Above addAction controller part, here when i am clicking AddAction my form is waiting for user inputs when i click submit my inputs recorded in database.
Now my question is i want add some message after the submit form data whether it success or failure.
Could you please help me on this ?
Many Thanks,
viswa
The docs for the action-helper describe an example. But standard usage goes something like this:
After you add the record, before you redirect, set the desired message in your controller:
public function addAction()
{
$form = new ApplicationForm();
$this->view->form = $form;
if ($this->getRequest()->isPost()) {
$formData = $this->getRequest()->getPost();
if ($form->isValid($formData)) {
$name = $form->getValue('name');
$class = $form->getValue('class');
$file = new Application_Model_DbTable_Records();
$file->addRecord($name,$class);
// Add the message here
$this->_helper->getHelper('FlashMessenger')->addMessage('Record added');
$this->_helper->redirector('index');
}
}
}
Then in your indexAction - the controller to which you are redirecting after successful record addition - get the messages and add them to your view:
public function indexAction()
{
// All your existing processing
// Blah, blah..
// Get the messages from the FlashMessenger
$messenger = $this->_helper->getHelper('FlashMessenger');
$messages = $messenger->hasMessages() ? $messenger->getMessages() : [];
// Add the messages into the view
$this->view->messages = $messages;
}
Finally, somewhere in the index view-script where you want the messages to appear, check for the messages and render, something like:
<?php if ($this->messages): ?>
<div id="refresh-messages">
<ul>
<?php foreach ($this->messages as $message): ?>
<li><?= $message ?></li>
<?php endforeach ?>
</ul>
</div>
<?php endif ?>
The wrapping div is just to assist with styling by providing a DOM element id to which you can target your CSS.
Disclaimer: Not tested directly, just coding from memory.
I have a Customer entity that only has a unique Email field to it. I am trying to edit a customer's email and the validation works fine. However I have this in my controller:
public function updateAction(Request $request, $id) {
$em = $this->getDoctrine()->getManager();
$entity = $em->getRepository('AcmeDemoBundle:Customer')->find($id);
if (!$entity) {
throw $this->createNotFoundException('Unable to find Customer entity.');
}
$editForm = $this->createForm(new CustomerType(), $entity);
$editForm->bind($request);
if ($editForm->isValid()) {
$em->persist($entity);
$em->flush();
return $this->redirect($this->generateUrl('ticket_result'));
}
var_dump($editForm->getErrors());
return $this->render('AcmeDemoBundle:Customer:edit.html.twig', array(
'entity' => $entity,
'edit_form' => $editForm->createView(),
));
}
The var_dump returns an empty array but the validator sets a unique error and the $editForm->isValid() returns false. Is there a way to check for that specific error in the controller during validation, also can you explain why it returns an empty error array? Basically, I would like to provide the "merge" option if that error comes up.
EDIT: here is the formtype:
namespace Acme\DemoBundle\Form;
use Symfony\Component\Form\AbstractType;
use Symfony\Component\Form\FormBuilderInterface;
use Symfony\Component\OptionsResolver\OptionsResolverInterface;
class CustomerType extends AbstractType {
public function buildForm(FormBuilderInterface $builder, array $options) {
$builder
->add('email', 'email', array('required'=>true))
;
}
public function setDefaultOptions(OptionsResolverInterface $resolver) {
$resolver->setDefaults(array(
'data_class' => 'Acme\DemoBundle\Entity\Customer',
'cascade_validation' => true,
));
}
public function getName() {
return 'acme_demobundle_customertype';
}
}
And the twig template:
{% extends 'AcmeDemoBundle::layout.html.twig' %}
{% block body -%}
<h1>Customer edit</h1>
<form action="{{ path('customer_update', { 'id': entity.id }) }}" method="post" {{ form_enctype(edit_form) }}>
<input type="hidden" name="_method" value="PUT" />
{{ form_widget(edit_form) }}
<p>
<button type="submit">Edit</button>
</p>
</form>
{% endblock %}
Here is my validation:
Acme\DemoBundle\Entity\Customer:
constraints:
- Symfony\Bridge\Doctrine\Validator\Constraints\UniqueEntity:
fields: email
message: "A customer under that email address already exists"
properties:
email:
- Email: ~
For debug purposes you can use $form->getErrorsAsString() instead of $form->getErrors() if you use Symfony 2.*
Quoted from this answer:
$form->getErrorsAsString() should only be used to debug the form...it
will contain the errors of each child elements which is not the case
of $form->getErrors().
UPDATE 1:
"With more recent Symfony versions, you must use $form->getErrors(true, false); instead. First param corresponds to deep and second to flatten" (see the comment by #Roubi)
Ok, found an answer here:
Symfony2 invalid form without errors
It turns out each form child has it's own separate errors. When doing a var_dump of
$editForm->getChildren()['email']->getErrors()
I get:
array (size=1)
0 =>
object(Symfony\Component\Form\FormError)[531]
private 'message' => string 'A customer under that email address already exists' (length=50)
protected 'messageTemplate' => string 'A customer under that email address already exists' (length=50)
protected 'messageParameters' =>
array (size=0)
empty
protected 'messagePluralization' => null
I am still wondering how to determine that the error is because of a unique conflict without parsing the error message string.
The following solutions works for me:
$form->getErrors(true)
You can use error_bubbling on each field to bubble the error up to your $form.
If not, you can also foreach through the errors
foreach ($children as $child) {
if ($child->hasErrors()) {
$vars = $child->createView()->getVars();
$errors = $child->getErrors();
foreach ($errors as $error) {
$this->allErrors[$vars["name"]][] = $this->convertFormErrorObjToString($error);
}
}
}
In Symfony 2.3, you can use this one :
if ($form->isValid()){
# Code...
} else {
foreach ($form->getIterator() as $key => $child) {
if ($child instanceof Form) {
foreach ($child->getErrors() as $error) {
$errors[$key] = $error->getMessage();
}
}
}
}
This will get you an array ($errors) with the errors from the children.
You could try to use the dump function when the form is submited and not valid. I use it like this
if($form->isSubmited() && $form->isValid()){
//SAVE TO DATABASE AND DO YOUR STUFF
}else if($form->isSubmited()){
//SUBMITED BUT WITH ERRORS
dump($form->getErrors(true));
die();
}
Note this is for debugging purposes only, It will show you your form, the data in it and all the errors any field could have.
In production mode you should return the error to the view and show them to the user.
I'm trying to create an email component/model that will add an email to the database (with certain fields like, to, from, subject, message, created, modified, etc).
AFTER the data has been sucessfully saved (which it currently does), I'd like to actually send the message.
I figure this would be easiest with an afterSave() function, but I cannot get the email to send.
Here is some relevant code:
Email Model
<?php
class Email extends AppModel {
var $name = 'Email';
var $displayField = 'subject';
function afterSave() {
$this->Email->to = $this->data['Email']['email'];
$this->Email->subject = $this->data['Email']['subject'];
$this->Email->replyTo = $this->data['Email']['email'];
$this->Email->from = 'Private Message <' . $this->data['Email']['email'] . '>';
//$this->Email->template = 'simple_message';
$this->Email->send($this->data['Email']['email_text']);
}
}
add.ctp for email
<div class="universities form">
<?php echo $this->Form->create('Email');?>
<fieldset>
<legend><?php __('Add Email'); ?></legend>
<?php
echo $this->Form->input('subject');
echo $this->Form->input('email_text');
echo $this->Form->hidden('email', array('value' => $this->params['named']['contact_email']));
echo $this->Form->hidden('user_from', array('value' => $this->Session->read('User.id')));
echo $this->Form->hidden('created', array('value' => date("Y-m-d")));
echo $this->Form->hidden('modified', array('value' => date("Y-m-d")));
?>
</fieldset>
<?php echo $this->Form->end(__('Submit', true));?>
</div>
Controller save code:
function add() {
if (!empty($this->data)) {
$this->Email->create();
// pr($this->data);
// die;
if ($this->Email->save($this->data)) {
$this->Session->setFlash(__('The email has been saved', true));
} else {
$this->Session->setFlash(__('The email could not be saved. Please, try again.', true));
}
}
}
Error I am getting on trying to send:
Fatal error: Call to undefined method stdClass::send() in /Users/[USER]/Sites/example_app/app/models/email.php on line 14
New Controller Code:
function add() {
if (!empty($this->data)) {
$this->Email->create();
// pr($this->data);
// die;
if ($this->Email->save($this->data)) {
$this->Session->setFlash(__('The email has been saved', true));
function _sendMail() {
$this->Email->to = $this->data['Email']['email'];
$this->Email->subject = $this->data['Email']['subject'];
$this->Email->replyTo = $this->data['Email']['email'];
$this->Email->from = 'Private Message <' . $this->data['Email']['email'] . '>';
$this->Email->sendAs = 'text'; //Send as 'html', 'text' or 'both' (default is 'text')
$email->send();
}
$this->_sendMail();
} else {
$this->Session->setFlash(__('The email could not be saved. Please, try again.', true));
}
}
}
components are meant to be used in a controller, not the model - so the cleanest way is to send the mail from controller when $this->Model->save() returns true.
Because you did name your Model "Email", i dont think you can use the component "Email" the standard way and need to load it manually:
In the controller (function add())
if ($this->Email->save($this->data)) {
// save was successfull
App::import('Component', 'Email');
$email = new EmailComponent();
$email->startup($this);
$email->from='joe#example.com';
$email->to = $this->data['Email']['email'];
$email->subject = $this->data['Email']['subject'];
$email->replyTo = $this->data['Email']['email'];
$email->from = 'Private Message <' . $this->data['Email']['email'] . '>';
$email->sendAs = 'text'; //Send as 'html', 'text' or 'both' (default is 'text')
$email->send();
$this->Session->setFlash(__('The email has been saved', true));
}
Nevertheless it is possible to send mails from the model, see the second answer of this (duplicate) thread:
How do I use the email component from a model in CakePHP?
As the title says, I tried calling the receive() function either of Form Element and the Adapter Object(not one after another of course). I printed the returned value - was 1 in both cases - which means receive() returned true.
The file was not found on the server though. I tried setting encrypt type of zend form to multipart/form-data - didn't help.
I'm totally clueless so any info is welcomed.
Calling receive() on transfer adapter: file location and upload name are constants.
$this->uploadName = $uploadName;
$this->upload = new Zend_File_Transfer_Adapter_Http();
$this->upload->setDestination($this->fileLocation);
...
$val = $this->upload->receive();
$quoteName = $this->upload->getFileName($this->uploadName);
$size = $this->upload->getFileSize($this->uploadName);
calling receive on form element:
//form creation - my form extends zend form
$staticForm = Srm_Form::getForm(my form,null,null,
my config);
$staticForm->setEnctype('multipart/form-data');
$staticForm->getElement(my file element name)->setDestination(my dest);
//calling receive
$form = Srm_Form::getForm(my form,null,null,my config);
$form->setEnctype('multipart/form-data');
if(!$form->isValid($_POST)){
print_r($form->getMessages());
}
// echo $form->getElement(my file element)->getValue();
$val = $form->getElement(my file element)->receive();
echo "bbbbbb".$val;
I should add that this code works when it is called after the file element is added to the form manually and not through use of a config file.
Okay, the problem was found -
The destination was not set for the file element (it was set manually for the transfer adapter in other place)when handling the submitted form.
I define a simple form with the Zend_Form_Element_File element
<?php
class Form_UploadForm extends Zend_Form
{
public function __construct($options = null)
{
parent::__construct($options);
$this->setMethod('post');
$this->setAttrib('enctype', 'multipart/form-data');
$decors = array(
array('ViewHelper'),
array('HtmlTag'),//array('tag'=>'table')),
array('Label', array('separator' => ' ')), // those unpredictable newlines
array('Errors', array('separator' => ' ')), // in the render output
);
$file = new Zend_Form_Element_File('file');
$file->setDestination('/a/b/c/upload');
$file->setLabel('Document File Path')
->setRequired(true)
->addValidator('NotEmpty');
$this->addElement($file);
$submit = new Zend_Form_Element_Submit('submit');
$submit->setLabel('Upload File');
$this->addElement($submit);
}
}
?>
My action method in the Controller is
function uploadAction()
{
$this->view->pageTitle = "Zend_Form File Upload Example";
$this->view->bodyCopy = "<p>Please fill out this form.</p>";
$form = new Form_UploadForm();
if ($this->_request->isPost())
{
$formData = $this->_request->getPost();
if ($form->isValid($formData))
{
try
{
$form->file->receive();
}
catch (Zend_File_Transfer_Exception $e)
{
throw new Exception('unable to recieve : '.$e->getMessage());
}
$uploadedData = $form->getValues();
//Zend_Debug::dump($form->file->getFileName(), 'tmp_file');
$this->processFile($form->file->getFileName());
}
else
{
$form->populate($formData);
}
}
$this->view->form = $form;
}
Note - i don't call the Zend_File_Transfer_Adapter_Http directly
The final piece is the view
<?php echo $this->form; ?>