OpenACS

gustafn
committed
MAIN:gustafn:20250312091326
on 12 Mar
added debugging hook for tracing CSRF livecyle
/tcl/form-processing-procs.tcl (+1 -0)
779 779         # If a confirm template has been specified, it will be
780 780         # returned unless __confirmed_p is set true.  This is most
781 781         # easily done by including resources/forms/confirm-button in
782 782         # the confirm template.
783 783
784 784         template::element create $form_name __confirmed_p -datatype integer -widget hidden -value 0
785 785
786 786         # JavaScript widgets can change a form value and submit the
787 787         # result in order to allow the generating script to fill in a
788 788         # value such as an image.  The widget must set __refreshing_p
789 789         # true.
790 790
791 791         template::element create $form_name __refreshing_p -datatype integer -widget hidden -value 0
792 792
793 793         if {[info exists csrf_protection_p] && $csrf_protection_p} {
794 794             #
795 795             # Add CSRF value to every ad_form. Validation might be
796 796             # application-specific (validation is not always wanted,
797 797             # especially, when high backward compitibility is required).
798 798             #
  799             #ns_log notice "ad_form: adding csrf token $::__csrf_token"
799 800             template::element create $form_name __csrf_token -datatype text -widget hidden -value $::__csrf_token
800 801         }
801 802     }
802 803
803 804     # Use export_vars to serialize variables from -export flag as
804 805     # hidden form fields. We need to do it now rather than later in
805 806     # the rendering, as only now the uplevel variables come from is
806 807     # well known.
807 808     if { [info exists export] } {
808 809         template::form::set_properties $form_name exported_vars \
809 810             [uplevel [list export_vars -form $export]]
810 811     }
811 812
812 813     # We need to track these for submission time and for error checking
813 814
814 815     global af_type
815 816     global af_key_name
816 817     global af_sequence_name
817 818
818 819     foreach element_name $element_names {