- Implemented CSRF check, some bugfixes also included

src/Method/Form.php

@@ -32,22 +32,6 @@ class Form implements Extension {
         $context->pushFunction("form", [ $this, 'formClass' ]);
     }
 
-    public function form_csrf(string $field, string $value) {
-        $values = $this->session("View.form.csrf.$field") ?: [];
-
-        # keeps 20 (from config) latest CSRF key for this form into session,
-        # allowing more than one tab opened and preventing information loss
-        if ( count($values) >= 20 ) {
-            #array_shift($values);
-        }
-
-        $values[] = $value;
-
-        $this->session("View.form.csrf.$field", $values);
-
-        return $value;
-    }
-
     public function formClass(FormInterface $form, ? FormContext $formContext = null) : FormHandler
     {
         return new FormHandler($this->request, $form, $formContext);

src/Method/FormHandler.php

@@ -5,8 +5,11 @@ namespace Picea\Ui\Method;
 use Psr\Http\Message\ServerRequestInterface;
 
 class FormHandler {
+
     public bool $sent = false;
 
+    public bool $validateCsrfToken = true;
+
     public ? bool $executionStatus = null;
     
     public FormContext $context;
@@ -38,7 +41,20 @@ class FormHandler {
     {
         if ( false !== $this->context->formSent = $this->sent ) {
             if ( $this->context->formName ?? false ) {
-                $this->sent = $this->context->formSent = (bool) ( $this->request->getParsedBody()['picea-ui-form'][$this->context->formName] ?? false );
+                $sent = false;
+
+                $token = $this->context->{'picea-ui-form'}[$this->context->formName] ?? false;
+
+                if ( $token ) {
+                    if ($this->validateCsrfToken) {
+                        $sent = in_array($token, $_SESSION["picea-ui.form:{$this->context->formName}"] ?? []);
+                    }
+                    else {
+                        $sent = (bool) $token;
+                    }
+                }
+
+                $this->sent = $this->context->formSent =  $sent;
             }
         }
     }
@@ -50,8 +66,6 @@ class FormHandler {
         if ( $this->sent ) {
             if ( $this->form->validate($this->context) ) {
                 $this->executionStatus = $this->form->execute($this->context);
-
-                $this->context->formExecuted = true;
             }
         }
     }