haskell/yesod
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

generateForm produces nonce hidden field

Browse Source
This commit is contained in:
Michael Snoyman 2010-10-24 22:38:16 +02:00
parent 1a752d4343
commit 0fc2cccfef
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
Yesod/Form.hs
View File

@ -113,9 +113,11 @@ runFormPost f = do
_ -> res
return (res', xml, enctype, hidden nonce)
where
nonceName = "_nonce"
hidden nonce = [$hamlet|%input!type=hidden!name=$nonceName$!value=$nonce$|]
nonceName :: String
nonceName = "_nonce"
-- | Run a form against POST parameters. Please note that this does not provide
-- CSRF protection.
runFormMonadPost :: GFormMonad s m a -> GHandler s m (a, Enctype)
@ -144,11 +146,13 @@ helper (FormSuccess a, _, _) = return a
helper (FormFailure e, _, _) = invalidArgs e
helper (FormMissing, _, _) = invalidArgs ["No input found"]
-- | Generate a form, feeding it no data.
generateForm :: GForm s m xml a -> GHandler s m (xml, Enctype)
-- | Generate a form, feeding it no data. The third element in the result tuple
-- is a nonce hidden field.
generateForm :: GForm s m xml a -> GHandler s m (xml, Enctype, Html)
generateForm f = do
(_, b, c) <- runFormGeneric [] [] f
return (b, c)
nonce <- fmap reqNonce getRequest
return (b, c, [$hamlet|%input!type=hidden!name=$nonceName$!value=$nonce$|])
-- | Run a form against GET parameters.
runFormGet :: GForm s m xml a -> GHandler s m (FormResult a, xml, Enctype)