csrf validation added to all forms

src/Contact/src/Form/ContactForm.php

@@ -87,6 +87,15 @@ public function init(): void
             ],
             'type' => Textarea::class,
         ]);
+
+        $this->add([
+            'name' => 'contact_csrf',
+            'type' => 'csrf',
+            'options' => [
+                'timeout' => 3600,
+                'message' => 'The form CSRF has expired and was refreshed. Please resend the form',
+            ],
+        ]);
     }
 
     /**

src/Contact/templates/contact/contact-form.html.twig

@@ -71,6 +71,8 @@
                         </div>
                     </div>
 
+                    {{ formElement(form.get('contact_csrf')) }}
+
                     <div class="g-recaptcha" data-sitekey="{{ recaptchaSiteKey }}"
                          data-callback="submitContactUsForm"
                          data-size="invisible">

src/User/src/Form/LoginForm.php

@@ -70,6 +70,15 @@ public function init()
             ],
         ]);
 
+        $this->add([
+            'name' => 'login_csrf',
+            'type' => 'csrf',
+            'options' => [
+                'timeout' => 3600,
+                'message' => 'The form CSRF has expired and was refreshed. Please resend the form',
+            ],
+        ]);
+
         $this->add([
             'name' => 'submit',
             'attributes' => [

src/User/src/Form/ProfileDeleteForm.php

@@ -53,6 +53,15 @@ public function init()
             ]
         ]);
 
+        $this->add([
+            'name' => 'profile_delete_csrf',
+            'type' => 'csrf',
+            'options' => [
+                'timeout' => 3600,
+                'message' => 'The form CSRF has expired and was refreshed. Please resend the form',
+            ],
+        ]);
+
         $this->add([
             'name' => 'submit',
             'attributes' => [

src/User/src/Form/ProfileDetailsForm.php

@@ -45,6 +45,15 @@ public function init()
             'type' => UserDetailFieldset::class
         ]);
 
+        $this->add([
+            'name' => 'profile_details_csrf',
+            'type' => 'csrf',
+            'options' => [
+                'timeout' => 3600,
+                'message' => 'The form CSRF has expired and was refreshed. Please resend the form',
+            ],
+        ]);
+
         $this->add([
             'name' => 'submit',
             'attributes' => [

src/User/src/Form/ProfilePasswordForm.php

@@ -59,6 +59,15 @@ public function init()
             'type' => Password::class
         ]);
 
+        $this->add([
+            'name' => 'profile_password_csrf',
+            'type' => 'csrf',
+            'options' => [
+                'timeout' => 3600,
+                'message' => 'The form CSRF has expired and was refreshed. Please resend the form',
+            ],
+        ]);
+
         $this->add([
             'name' => 'submit',
             'attributes' => [

src/User/src/Form/RegisterForm.php

@@ -81,6 +81,15 @@ public function init()
             'type' => Password::class
         ]);
 
+        $this->add([
+            'name' => 'register_csrf',
+            'type' => 'csrf',
+            'options' => [
+                'timeout' => 3600,
+                'message' => 'The form CSRF has expired and was refreshed. Please resend the form',
+            ],
+        ]);
+
         $this->add([
             'name' => 'submit',
             'attributes' => [

src/User/src/Form/RequestResetPasswordForm.php

@@ -48,6 +48,15 @@ public function init()
             'type' => Email::class
         ]);
 
+        $this->add([
+            'name' => 'request_reset_password_csrf',
+            'type' => 'csrf',
+            'options' => [
+                'timeout' => 3600,
+                'message' => 'The form CSRF has expired and was refreshed. Please resend the form',
+            ],
+        ]);
+
         $this->add([
             'name' => 'submit',
             'attributes' => [

src/User/src/Form/ResetPasswordForm.php

@@ -59,6 +59,15 @@ public function init()
             'type' => Password::class
         ]);
 
+        $this->add([
+            'name' => 'reset_password_csrf',
+            'type' => 'csrf',
+            'options' => [
+                'timeout' => 3600,
+                'message' => 'The form CSRF has expired and was refreshed. Please resend the form',
+            ],
+        ]);
+
         $this->add([
             'name' => 'submit',
             'attributes' => [

src/User/src/Form/UploadAvatarForm.php

@@ -38,6 +38,15 @@ public function init()
             'type' => AvatarFieldset::class
         ]);
 
+        $this->add([
+            'name' => 'upload_avatar_csrf',
+            'type' => 'csrf',
+            'options' => [
+                'timeout' => 3600,
+                'message' => 'The form CSRF has expired and was refreshed. Please resend the form',
+            ],
+        ]);
+
         $this->add([
             'name' => 'submit',
             'attributes' => [

src/User/templates/profile/avatar.html.twig

@@ -19,6 +19,8 @@
 {% set dummy = image.setAttribute('data-url', path('account', {'action': 'avatar'})) %}
 {{ formElement(image) }}
 
+{{ formElement(form.get('upload_avatar_csrf')) }}
+
 {% set submit = form.get('submit') %}
 {% set submitValue = submit.getValue|trans|raw %}
 {% set dummy = submit.setAttribute('value', submitValue) %}

src/User/templates/profile/change-password.html.twig

@@ -16,6 +16,8 @@
 {% set dummy = passwordConfirm.setAttribute('placeholder', elementTranslatePlaceholder) %}
 {{ formElement(passwordConfirm) }}
 
+{{ formElement(form.get('profile_password_csrf')) }}
+
 {% set submit = form.get('submit') %}
 {% set submitValue = submit.getValue|trans|raw %}
 {% set dummy = submit.setAttribute('value', submitValue) %}

src/User/templates/profile/delete-account.html.twig

@@ -12,6 +12,8 @@
     <p>I accept the <a href="#" target="_blank">Terms and Conditions</a> and I want to delete my account with all additional data.</p>
 </div>
 
+{{ formElement(form.get('profile_delete_csrf')) }}
+
 {% set submit = form.get('submit') %}
 {% set submitValue = submit.getValue|trans|raw %}
 {% set dummy = submit.setAttribute('value', submitValue) %}

src/User/templates/profile/details.html.twig

@@ -18,6 +18,8 @@
 {% set dummy = lastName.setAttribute('placeholder', elementTranslatePlaceholder) %}
 {{ formElement(lastName) }}
 
+{{ formElement(form.get('profile_details_csrf')) }}
+
 {% set submit = form.get('submit') %}
 {% set submitValue = submit.getValue|trans|raw %}
 {% set dummy = submit.setAttribute('value', submitValue) %}

src/User/templates/user/login.html.twig

@@ -37,6 +37,9 @@
                         </label>
                     </div>
 
+                    {{ formElement(form.get('login_csrf')) }}
+
+
                     {% set submit = form.get('submit') %}
                     {% set submitValue = submit.getValue|trans|raw %}
                     {% set dummy = submit.setAttribute('value', submitValue) %}

src/User/templates/user/register.html.twig

@@ -44,6 +44,8 @@
                     {% set dummy = passwordConfirm.setAttribute('placeholder', elementTranslatePlaceholder) %}
                     {{ formElement(passwordConfirm) }}
 
+                    {{ formElement(form.get('register_csrf')) }}
+
                     {% set submit = form.get('submit') %}
                     {% set submitValue = submit.getValue|trans|raw %}
                     {% set dummy = submit.setAttribute('value', submitValue) %}

src/User/templates/user/request-reset-form.html.twig

@@ -22,6 +22,8 @@
                     {% set dummy = identity.setAttribute('placeholder', elementTranslatePlaceholder) %}
                     {{ formElement(identity) }}
 
+                    {{ formElement(form.get('request_reset_password_csrf')) }}
+
                     {% set submit = form.get('submit') %}
                     {% set submitValue = submit.getValue|trans|raw %}
                     {% set dummy = submit.setAttribute('value', submitValue) %}

src/User/templates/user/reset-password-form.html.twig

@@ -27,6 +27,8 @@
                     {% set dummy = passwordConfirm.setAttribute('placeholder', elementTranslatePlaceholder) %}
                     {{ formElement(passwordConfirm) }}
 
+                    {{ formElement(form.get('reset_password_csrf')) }}
+
                     {% set submit = form.get('submit') %}
                     {% set submitValue = submit.getValue|trans|raw %}
                     {% set dummy = submit.setAttribute('value', submitValue) %}