haskell/yesod
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

generateForm produces nonce hidden field

Browse Source
This commit is contained in:
Michael Snoyman 2010-10-24 22:38:16 +02:00
parent 1a752d4343
commit 0fc2cccfef
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
Yesod/Form.hs
View File

@ -113,9 +113,11 @@ runFormPost f = do
_ -> res _ -> res
return (res', xml, enctype, hidden nonce) return (res', xml, enctype, hidden nonce)
where where
nonceName = "_nonce"
hidden nonce = [$hamlet|%input!type=hidden!name=$nonceName$!value=$nonce$|] hidden nonce = [$hamlet|%input!type=hidden!name=$nonceName$!value=$nonce$|]
nonceName :: String
nonceName = "_nonce"
-- | Run a form against POST parameters. Please note that this does not provide -- | Run a form against POST parameters. Please note that this does not provide
-- CSRF protection. -- CSRF protection.
runFormMonadPost :: GFormMonad s m a -> GHandler s m (a, Enctype) runFormMonadPost :: GFormMonad s m a -> GHandler s m (a, Enctype)
@ -144,11 +146,13 @@ helper (FormSuccess a, _, _) = return a
helper (FormFailure e, _, _) = invalidArgs e helper (FormFailure e, _, _) = invalidArgs e
helper (FormMissing, _, _) = invalidArgs ["No input found"] helper (FormMissing, _, _) = invalidArgs ["No input found"]
-- | Generate a form, feeding it no data. -- | Generate a form, feeding it no data. The third element in the result tuple
generateForm :: GForm s m xml a -> GHandler s m (xml, Enctype) -- is a nonce hidden field.
generateForm :: GForm s m xml a -> GHandler s m (xml, Enctype, Html)
generateForm f = do generateForm f = do
(_, b, c) <- runFormGeneric [] [] f (_, b, c) <- runFormGeneric [] [] f
return (b, c) nonce <- fmap reqNonce getRequest
return (b, c, [$hamlet|%input!type=hidden!name=$nonceName$!value=$nonce$|])
-- | Run a form against GET parameters. -- | Run a form against GET parameters.
runFormGet :: GForm s m xml a -> GHandler s m (FormResult a, xml, Enctype) runFormGet :: GForm s m xml a -> GHandler s m (FormResult a, xml, Enctype)