Protects against form tampering. It ensures that:
string|null
Error message providing detail for failed validation.
array
Fields list.
array
Unlocked fields.
Create a message for humans to understand why Security token is not matching
Parses the field name to create a dot separated name value for use in field hash. If fieldname is of form Model[field] or Model.field an array of fieldname parts like ['Model', 'field'] is returned.
Generate array of messages for the existing fields in POST data, matching dataFields in $expectedFields will be unset
__construct(array $data)
Construct.
array
$data optional Data array, can contain key unlockedFields
with list of unlocked fields.
__debugInfo()
Return debug info
array
addField(mixed $field, bool $lock, mixed $value)
Determine which fields of a form should be used for hash.
string|array
$field Reference to field to be secured. Can be dot separated string to indicate nesting or array of fieldname parts.
bool
$lock optional Whether this field should be part of the validation or excluded as part of the unlockedFields. Default true
.
mixed
$value optional Field value, if value should not be tampered with.
$this
buildTokenData(string $url, string $sessionId)
Generate the token data.
string
$url optional Form URL.
string
$sessionId optional Session Id.
array
The token data.
debugCheckFields(array $dataFields, array $expectedFields, string $intKeyMessage, string $stringKeyMessage, string $missingMessage)
Iterates data array to check against expected
array
$dataFields Fields array, containing the POST data fields
array
$expectedFields optional Fields array, containing the expected fields we should have in POST
string
$intKeyMessage optional Message string if unexpected found in data fields indexed by int (not protected)
string
$stringKeyMessage optional Message string if tampered found in data fields indexed by string (protected).
string
$missingMessage optional Message string if missing field
string[]
Messages
debugExpectedFields(array $expectedFields, string $missingMessage)
Generate debug message for the expected fields
array
$expectedFields optional Expected fields
string
$missingMessage optional Message template
string|null
Error message about expected fields
debugTokenNotMatching(array $formData, array $hashParts)
Create a message for humans to understand why Security token is not matching
array
$formData Data.
array
$hashParts Elements used to generate the Token hash
string
Message explaining why the tokens are not matching
extractFields(array $formData)
Return the fields list for the hash calculation
array
$formData Data array
array
extractHashParts(array $formData)
Return hash parts for the token generation
array
$formData Form data.
array
extractToken(mixed $formData)
Extract token from data.
mixed
$formData Data to validate.
string|null
Fields token on success, null on failure.
generateHash(array $fields, array $unlockedFields, string $url, string $sessionId)
Generate validation hash.
array
$fields Fields list.
array
$unlockedFields Unlocked fields.
string
$url Form URL.
string
$sessionId Session Id.
string
getError()
Get validation error message.
string|null
getFieldNameArray(string $name)
Parses the field name to create a dot separated name value for use in field hash. If fieldname is of form Model[field] or Model.field an array of fieldname parts like ['Model', 'field'] is returned.
string
$name The form inputs name attribute.
string[]
Array of field name params like ['Model.field'] or ['Model', 'field'] for array fields or empty array if $name is empty.
matchExistingFields(array $dataFields, array $expectedFields, string $intKeyMessage, string $stringKeyMessage)
Generate array of messages for the existing fields in POST data, matching dataFields in $expectedFields will be unset
array
$dataFields Fields array, containing the POST data fields
array
$expectedFields Fields array, containing the expected fields we should have in POST
string
$intKeyMessage Message string if unexpected found in data fields indexed by int (not protected)
string
$stringKeyMessage Message string if tampered found in data fields indexed by string (protected)
string[]
Error messages
sortedUnlockedFields(array $formData)
Get the sorted unlocked string
array
$formData Data array
string[]
unlockField(mixed $name)
Add to the list of fields that are currently unlocked.
Unlocked fields are not included in the field hash.
string
$name The dot separated name for the field.
$this
validate(mixed $formData, string $url, string $sessionId)
Validate submitted form data.
mixed
$formData Form data.
string
$url URL form was POSTed to.
string
$sessionId Session id for hash generation.
bool
Error message providing detail for failed validation.
string|null
Fields list.
array
Unlocked fields.
array
© 2005–present The Cake Software Foundation, Inc.
Licensed under the MIT License.
CakePHP is a registered trademark of Cake Software Foundation, Inc.
We are not endorsed by or affiliated with CakePHP.
https://api.cakephp.org/4.1/class-Cake.Form.FormProtector.html