CSRF token missing - symfony

That's something driving me crazy.
Take these snippets of code
class CommonController extends Controller
{
/**
* Create delete form
*
* #param int $id
*
* #return Form
*/
protected function createDeleteForm($id)
{
return $this->createFormBuilder(['id' => $id])
->add('id', \Symfony\Component\Form\Extension\Core\Type\HiddenType::class)
->getForm()
;
}
}
and
{% if delete_path is defined %}
<form id="delete" action="{{ path(delete_path, {id: entity.id}) }}" method="POST" class="pull-right" style="margin-top: -43px; margin-right: 10px;">
{{ form_widget(deleteForm) }}
<button type="submit" class="btn btn-default">{{ delete_form_submit_button|trans }}</button>
</form>
{% endif %}
Please pay attention, that's not pseudo-code, is real code I've found into an application a friend of mine asked me to fix.
My question is ... why CSRF token isn't showed in the view?
As a result my form submission are always invalid due to csrf token missing
More details
Symfony version: 2.8
Even if I use form_rest token still not be there so it's seems like is not generated at all but, under the hood, it should have been there (isValid())
EDIT
If I dump deleteForm, _token is there but if I try to use form_widget or form_row or form_rest it is not showed
If I don't use form_widget(deleteForm) or form_row(deleteForm.id), the token in showed.

Related

Symfony 2 FOSUSER issue with is_granted in twig

I'am experiencing an issue with is_granted('') function in twig.
My current user has the following roles : ['ROLE_USER','ROLE_FOOBAR'], checked from the symfony profiler.
With this code : the admin link is printed (KO) :
{% if is_granted('ROLE_BACKOFFICE') or is_granted('ROLE_SYSTEM') %}
<li>
<a href="{{ path('sonata_admin_dashboard') }}">
ADMIN
</a>
</li>
{% endif %}
With this code : the admin link is NOT printed (OK) :
{% if app.user.hasRole('ROLE_BACKOFFICE') or app.user.hasRole('ROLE_SYSTEM') %}
<li>
<a href="{{ path('sonata_admin_dashboard') }}">
ADMIN
</a>
</li>
{% endif %}
I don't understand why the link is printed with is_granted ?
My role hierarchy seems ok, what's wrong with that code ?
If you look at vendor/friendsofsymfony/user-bundle/Model/User.php, it explains that the hasRole must not be used in this context :
/**
* Never use this to check if this user has access to anything!
*
* Use the SecurityContext, or an implementation of AccessDecisionManager
* instead, e.g.
*
* $securityContext->isGranted('ROLE_USER');
*
* #param string $role
*
* #return boolean
*/
public function hasRole($role)
{
return in_array(strtoupper($role), $this->getRoles(), true);
}
Here is a snippet of my role hierarchy from security.yml :
role_hierarchy:
ROLE_FOOBAR: ROLE_USER
...
ROLE_ADMIN: [ROLE_USER, ROLE_MANAGER]
I finally found the problem :
The problem came from an error inside a voter. I change this snippet :
if ($object != null && !$this->supportsClass(get_class($object))) {
return self::ACCESS_ABSTAIN;
}
to :
if (!$this->supportsClass(get_class($object))) {
return self::ACCESS_ABSTAIN;
}
Now, everything is fine, again. just lost my day ! I hope this could help.

Passing multiple arguments through twig path

I have this twig code:
<div style="padding-left: 5em" class="comment">
<p>{{ comment.author.name }} - {{ comment.created|date('j. n. Y H:i') }}</p>
<p>{{ comment.text }}</p>
<p>Odpovědět na komentář</p>
{% for child in comment.children %}
{% include 'BlogApplicationBundle:Post:_comment.html.twig' with {'comment' : child}%}
{% endfor %}
</div>
and this is function that processes the output from link in twig code:
/**
* #Route("/post/{id}/newcommentresponse", name="comment_response_new")
* #Template("BlogApplicationBundle:Post:form.html.twig")
*/
public function commentResponceAction($id,$idc)
{
$comment = new Comment();
$form = $this->createForm(new CommentType(), $comment);
return array(
'form' => $form->createView()
);
}
when i try to run code i get this error :
Controller "Cvut\Fit\BiWt1\Blog\ApplicationBundle\Controller\CommentController::commentResponceAction()"
requires that you provide a value for the "$idc" argument (because
there is no default value or because there is a non optional argument
after this one).
So it seems that second argument passsed through link is ignored and i have no idea what am i doing wrong.
You are missing the $idc definition in your #Route annotation. It should look something like this:
#Route("/post/{id}/newcommentresponse/{idc}", name="comment_response_new")
or this:
#Route("/post/{id}/{idc}/newcommentresponse", name="comment_response_new")
You can also leave it out of the route and function declaration and grab it directly from the Controller:
/**
* #Route("/post/{id}/newcommentresponse", name="comment_response_new")
* #Template("BlogApplicationBundle:Post:form.html.twig")
*/
public function commentResponceAction($id)
{
$idc = $request->query->get('idc');

How do I insert the right path on form creation in Symfony2

I have this code in my template:
<form action="{{ path('wba_create') }}" method="post" {{ form_enctype(form) }}>
{{ form_widget(form) }}
<p>
<button type="submit">Registrar</button>
</p>
</form>
And in my controller I have this annotation:
/**
*
* #Route("/", name="wba_create")
* #Method("POST")
*/
public function createAction(Request $request) {
....
}
But in the rendered HTML I got just <form method="post" action="/app_dev.php/"> why? What I miss here?
There is nothing wrong with your code here ... you're configuring wba_create as route /
#Route("/", name="wba_create")
That's the trailing slash in /app_dev.php / ... app_dev.php is in the url because you're accessing the page through app_dev.php aka in the dev environment.
If you're running your Symfony application in development mode, every page is being treated by app_dev.php (including the page where your form is shown)
Your code should work, don't worry about the /app_dev.php/ added to the URL, it will not be there if you use the production environment.

echoing variable gets "Resource id"

Using symfony2 I load some entities and then try to iterate over them in a twig template.
However, instead of the variable content I am getting the following:
Resource id #23
My twig template looks like this:
<ol>
{% for post in posts %}
<li>
<div>
{{ post.content }}
</div>
</li>
{% endfor %}
</ol>
My controller code is:
$repository = $this->getDoctrine()
->getRepository('AppPostBundle:Post');
$reviews = $repository->findBy(
array('title' => 'my title'))
;
Maybe is too late for this answer (definitely it is LOL) but I recently had the same issue and the problem is that blob datatypes are treated as a buffer, so you have to read the info using buffer functions.
In your entity Post code you may add this method:
public function readContent(){
$content = '';
while(!feof($this->getContent())){
$content.= fread($this->getContent(), 1024);
}
rewind($this->getContent());
return $content;
}
Then in your views you may call the readcontent method instead of content:
<ol>
{% for post in posts %}
<li>
<div>
{{ post.readcontent }}
</div>
</li>
{% endfor %}
</ol>
Is better late than never :)
My entity name is : 'Test'
Blob type field is : 'Details'
in '/src/Vendorname/Bundlename/Entity/entityname.php'
**
* Get details
*
* #return string
*/
public function getDetails()
{
return $this->details;
}
/**
* Reading the blob type of content.
* #return data
*/
public function readDetails(){
$details = '';
while(!feof($this->getDetails())){
$details.= fread($this->getDetails(), 1024);
}
rewind($this->getDetails());
return $details;
}
and in '*.html.twig' file
{% for match in matches %}
{{match.readdetails}}
{%endfor%}

How to clear a date in a form (Symfony2)?

I would like to make a date clearable in a form (for example, with a little cross). The date field is already filled and I want to clear data. Is there an easy way to do this ?
My date is nullable and the option is set to 'required'=>false.
Here is the form class :
// Namespaces...
class FormRre extends AbstractType
{
public function buildForm(FormBuilder $builder, array $options)
{
// Other $builder->add() properties...
$builder->add('rredatefin', 'date', array('required' => false));
}
public function getName()
{
return 'sn';
}
public function getDefaultOptions(array $options)
{
return array(
'data_class' => 'Creasixtine\AFBundle\Entity\Rre',
);
}
}
And here is the way it is currently displayed :
{% extends 'CreasixtineAFBundle:Default:index.html.twig' %}
{% block main_container %}
{# ... #}
<form action="{{ path('planifier') }}" method="post" {{ form_enctype(form) }}>
{{ form_errors(form) }}
<div class="bloc-input">{{ form_label(form.rredatefin, "Date de réexpédition :") }}
{{ form_widget(form.rredatefin) }}
</div>
<input type="submit" />
</form>
{% endblock %}
Thanks by advance.
EDIT : precisions in answer to How to clear a date in a form (Symfony2)?
I'm not quite sure to understand.
If you made your date nullable and not required, just leave the field empty.
It should be enough.
Am I missing something ?
After comment edit
I'd advice you, as usual, to work with jquery.
And the .val() function in particular.
=> http://api.jquery.com/val/
$('#Devis_tarif_bi_horaire_select').change(function()
{
$('#Devis_tarif_bi_horaire_value').val('')
});
For instance, this little script will clear the input with id=Devis_tarif_bi_horaire_value when a select with id=Devis_tarif_bi_horaire_select is modified.
You may trigger the .val() function with a click on a link (http://api.jquery.com/click/), or anything you want.
Have a nice try.

Resources