- Implemented CSRF check, some bugfixes also included

src/Form/UiForm.php

@@ -54,7 +54,7 @@ class UiForm extends UiElement implements Extension {
     public function buildHtml(string $method = "get", string $name = "", string $action = "", array $attributes = []) : string
     {
         $method = strtolower($method);
-        
+
         $this->option('tag-type', 'single');
         
 
@@ -66,11 +66,23 @@ class UiForm extends UiElement implements Extension {
         $this->attributes([ 'method' => $method, 'action' => $action ] + $attributes);
         
         if ( $method !== "get" ) {
-            $this->append( ( new UiHidden() )->attributes([ 'name' =>"picea-ui-form[$name]", 'value' => md5( $name . microtime() ) ]) );
+            $token = md5( $name . microtime());
+            $key = "picea-ui.form:{$name}";
+
+            if (count($_SESSION[$key] ?? []) > 100) {
+                array_shift($_SESSION[$key]);
+            }
+
+            $_SESSION[$key][] = $token;
+
+            $this->append( ( new UiHidden() )->attributes([ 
+                'name' => "picea-ui-form[$name]",
+                'value' => $token,
+            ]));
             
             $this->attributes([ 'enctype' => "multipart/form-data" ]);
         }
-        
+
         return $this->render() . PHP_EOL;
     }
 }