From 4b3d8635665775ec9279fa1929f9745e5e38a3e7 Mon Sep 17 00:00:00 2001 From: Kacper Kubacki Date: Mon, 1 Sep 2025 09:27:27 +0200 Subject: [PATCH 001/111] Remove hard coded _token field --- .../templates/catalog_promotion/form.html.twig | 1 - .../Bundle/AdminBundle/templates/channel/form.html.twig | 1 - .../Bundle/AdminBundle/templates/country/form.html.twig | 1 - .../Bundle/AdminBundle/templates/order/form.html.twig | 1 - .../AdminBundle/templates/payment_method/form.html.twig | 1 - .../Bundle/AdminBundle/templates/product/form.html.twig | 1 - .../templates/product/generate_variants/form.html.twig | 1 - .../templates/product_attribute/form.html.twig | 1 - .../AdminBundle/templates/product_option/form.html.twig | 1 - .../AdminBundle/templates/product_variant/form.html.twig | 1 - .../AdminBundle/templates/promotion/form.html.twig | 1 - .../templates/promotion_coupon/generate/form.html.twig | 1 - .../request_password_reset/page/content/form.html.twig | 1 - .../security/reset_password/page/content/form.html.twig | 1 - .../templates/shared/crud/common/content/form.html.twig | 1 - .../AdminBundle/templates/shared/form_theme.html.twig | 9 +++++++++ .../templates/shipment/component/ship.html.twig | 1 - .../AdminBundle/templates/shipping_method/form.html.twig | 1 - .../AdminBundle/templates/taxon/sections/form.html.twig | 1 - .../Bundle/AdminBundle/templates/zone/form.html.twig | 1 - .../account/address_book/common/main/form.html.twig | 1 - .../account/address_book/set_as_default.html.twig | 4 +++- .../change_password/update/content/main/form.html.twig | 1 - .../content/form_container/form.html.twig | 1 - .../profile_update/update/content/main/form.html.twig | 1 - .../templates/account/register/content/form.html.twig | 1 - .../account/reset_password/content/form.html.twig | 1 - .../templates/cart/index/content/form.html.twig | 1 - .../templates/checkout/address/content/form.html.twig | 1 - .../templates/checkout/complete/content/form.html.twig | 1 - .../checkout/select_payment/content/form.html.twig | 1 - .../checkout/select_shipping/content/form.html.twig | 1 - .../contact/contact_request/content/form.html.twig | 1 - .../Bundle/ShopBundle/templates/form/theme.html.twig | 9 +++++++++ .../templates/order/show/content/form.html.twig | 1 - .../show/content/info/summary/add_to_cart.html.twig | 1 - .../product_review/create/content/main/form.html.twig | 1 - 37 files changed, 21 insertions(+), 35 deletions(-) diff --git a/src/Sylius/Bundle/AdminBundle/templates/catalog_promotion/form.html.twig b/src/Sylius/Bundle/AdminBundle/templates/catalog_promotion/form.html.twig index 70c22618cf..aafb551e99 100644 --- a/src/Sylius/Bundle/AdminBundle/templates/catalog_promotion/form.html.twig +++ b/src/Sylius/Bundle/AdminBundle/templates/catalog_promotion/form.html.twig @@ -8,7 +8,6 @@ {% endif %} {{ form_errors(form) }} - {{ form_widget(form._token) }} {% hook 'form' with { form } %} diff --git a/src/Sylius/Bundle/AdminBundle/templates/channel/form.html.twig b/src/Sylius/Bundle/AdminBundle/templates/channel/form.html.twig index 4005a6d0e2..355bb8b04f 100644 --- a/src/Sylius/Bundle/AdminBundle/templates/channel/form.html.twig +++ b/src/Sylius/Bundle/AdminBundle/templates/channel/form.html.twig @@ -8,7 +8,6 @@ {% endif %} {{ form_errors(form) }} - {{ form_widget(form._token) }} {% hook 'form' with { form } %} {{ form_end(form, {render_rest: false}) }} diff --git a/src/Sylius/Bundle/AdminBundle/templates/country/form.html.twig b/src/Sylius/Bundle/AdminBundle/templates/country/form.html.twig index b0668c0db1..611455477c 100644 --- a/src/Sylius/Bundle/AdminBundle/templates/country/form.html.twig +++ b/src/Sylius/Bundle/AdminBundle/templates/country/form.html.twig @@ -6,7 +6,6 @@ {% endif %} {{ form_errors(form) }} - {{ form_widget(form._token) }} {% hook 'form' with { form } %} diff --git a/src/Sylius/Bundle/AdminBundle/templates/order/form.html.twig b/src/Sylius/Bundle/AdminBundle/templates/order/form.html.twig index 2a410f4110..e782355446 100644 --- a/src/Sylius/Bundle/AdminBundle/templates/order/form.html.twig +++ b/src/Sylius/Bundle/AdminBundle/templates/order/form.html.twig @@ -8,7 +8,6 @@ {% endif %} {{ form_errors(form) }} - {{ form_widget(form._token) }} {% hook 'form' with { form } %} diff --git a/src/Sylius/Bundle/AdminBundle/templates/payment_method/form.html.twig b/src/Sylius/Bundle/AdminBundle/templates/payment_method/form.html.twig index ad4d55ed7c..b2f6db8527 100644 --- a/src/Sylius/Bundle/AdminBundle/templates/payment_method/form.html.twig +++ b/src/Sylius/Bundle/AdminBundle/templates/payment_method/form.html.twig @@ -10,7 +10,6 @@ {% endif %} {{ form_errors(form) }} - {{ form_widget(form._token) }} {% hook 'form' with { form } %} diff --git a/src/Sylius/Bundle/AdminBundle/templates/product/form.html.twig b/src/Sylius/Bundle/AdminBundle/templates/product/form.html.twig index fa5b5a3b8b..7526bf6911 100644 --- a/src/Sylius/Bundle/AdminBundle/templates/product/form.html.twig +++ b/src/Sylius/Bundle/AdminBundle/templates/product/form.html.twig @@ -9,7 +9,6 @@ {% endif %} {{ form_errors(form) }} - {{ form_widget(form._token) }} {% hook 'form' with { mapped_product_attributes, diff --git a/src/Sylius/Bundle/AdminBundle/templates/product/generate_variants/form.html.twig b/src/Sylius/Bundle/AdminBundle/templates/product/generate_variants/form.html.twig index e4e7394b2a..8cec2bf69f 100644 --- a/src/Sylius/Bundle/AdminBundle/templates/product/generate_variants/form.html.twig +++ b/src/Sylius/Bundle/AdminBundle/templates/product/generate_variants/form.html.twig @@ -8,7 +8,6 @@ {% endif %} {{ form_errors(form) }} - {{ form_widget(form._token) }} {% hook 'form' with { form } %} diff --git a/src/Sylius/Bundle/AdminBundle/templates/product_attribute/form.html.twig b/src/Sylius/Bundle/AdminBundle/templates/product_attribute/form.html.twig index b30203bb76..6b86b57916 100644 --- a/src/Sylius/Bundle/AdminBundle/templates/product_attribute/form.html.twig +++ b/src/Sylius/Bundle/AdminBundle/templates/product_attribute/form.html.twig @@ -9,7 +9,6 @@ {% if hookable_metadata.configuration.method is defined %} {% endif %} - {{ form_widget(form._token) }} {% hook 'form' with { form } %} diff --git a/src/Sylius/Bundle/AdminBundle/templates/product_option/form.html.twig b/src/Sylius/Bundle/AdminBundle/templates/product_option/form.html.twig index b23a4ee469..0cf7418ce7 100644 --- a/src/Sylius/Bundle/AdminBundle/templates/product_option/form.html.twig +++ b/src/Sylius/Bundle/AdminBundle/templates/product_option/form.html.twig @@ -8,7 +8,6 @@ {% endif %} {{ form_errors(form) }} - {{ form_widget(form._token) }} {% hook 'form' with { form } %} diff --git a/src/Sylius/Bundle/AdminBundle/templates/product_variant/form.html.twig b/src/Sylius/Bundle/AdminBundle/templates/product_variant/form.html.twig index 0f3eb02098..0c30e97642 100644 --- a/src/Sylius/Bundle/AdminBundle/templates/product_variant/form.html.twig +++ b/src/Sylius/Bundle/AdminBundle/templates/product_variant/form.html.twig @@ -7,7 +7,6 @@ {% endif %} {{ form_errors(form, sylius_test_form_attribute('form-validation-errors')) }} - {{ form_widget(form._token) }} {% hook 'form' with { form, resource } %} diff --git a/src/Sylius/Bundle/AdminBundle/templates/promotion/form.html.twig b/src/Sylius/Bundle/AdminBundle/templates/promotion/form.html.twig index 213a880c6c..d40655a853 100644 --- a/src/Sylius/Bundle/AdminBundle/templates/promotion/form.html.twig +++ b/src/Sylius/Bundle/AdminBundle/templates/promotion/form.html.twig @@ -8,7 +8,6 @@ {% endif %} {{ form_errors(form) }} - {{ form_widget(form._token) }} {% hook 'form' with { form } %} diff --git a/src/Sylius/Bundle/AdminBundle/templates/promotion_coupon/generate/form.html.twig b/src/Sylius/Bundle/AdminBundle/templates/promotion_coupon/generate/form.html.twig index 7f011b3fb0..8542c9faff 100644 --- a/src/Sylius/Bundle/AdminBundle/templates/promotion_coupon/generate/form.html.twig +++ b/src/Sylius/Bundle/AdminBundle/templates/promotion_coupon/generate/form.html.twig @@ -4,7 +4,6 @@ {{ form_start(form, {'attr': {'novalidate': 'novalidate', 'id': form.vars.id}}) }}
{{ form_errors(form) }} - {{ form_widget(form._token) }} {% hook 'form' with { form } %}
diff --git a/src/Sylius/Bundle/AdminBundle/templates/security/request_password_reset/page/content/form.html.twig b/src/Sylius/Bundle/AdminBundle/templates/security/request_password_reset/page/content/form.html.twig index d6da99618c..1574a3475b 100644 --- a/src/Sylius/Bundle/AdminBundle/templates/security/request_password_reset/page/content/form.html.twig +++ b/src/Sylius/Bundle/AdminBundle/templates/security/request_password_reset/page/content/form.html.twig @@ -4,5 +4,4 @@ {{ form_start(form, {'action': path('sylius_admin_request_password_reset'), 'attr': {'class': 'ui large loadable form', 'novalidate': 'novalidate'}}) }} {% hook 'form' with { form } %} - {{ form_row(form._token) }} {{ form_end(form, {'render_rest': false}) }} diff --git a/src/Sylius/Bundle/AdminBundle/templates/security/reset_password/page/content/form.html.twig b/src/Sylius/Bundle/AdminBundle/templates/security/reset_password/page/content/form.html.twig index a81e7ffc9c..3bada508b8 100644 --- a/src/Sylius/Bundle/AdminBundle/templates/security/reset_password/page/content/form.html.twig +++ b/src/Sylius/Bundle/AdminBundle/templates/security/reset_password/page/content/form.html.twig @@ -4,5 +4,4 @@ {{ form_start(form, {'action': path('sylius_admin_password_reset', {'token': app.request.attributes.get('token')}), 'attr': {'class': 'ui large loadable form', 'novalidate': 'novalidate'}}) }} {% hook 'form' with { form } %} - {{ form_row(form._token) }} {{ form_end(form, {'render_rest': false}) }} diff --git a/src/Sylius/Bundle/AdminBundle/templates/shared/crud/common/content/form.html.twig b/src/Sylius/Bundle/AdminBundle/templates/shared/crud/common/content/form.html.twig index a7043a28b1..65457bed27 100644 --- a/src/Sylius/Bundle/AdminBundle/templates/shared/crud/common/content/form.html.twig +++ b/src/Sylius/Bundle/AdminBundle/templates/shared/crud/common/content/form.html.twig @@ -17,7 +17,6 @@ {% endif %} {{ form_errors(form) }} - {{ form_widget(form._token) }} {% hook 'form' with { form, resource } %} diff --git a/src/Sylius/Bundle/AdminBundle/templates/shared/form_theme.html.twig b/src/Sylius/Bundle/AdminBundle/templates/shared/form_theme.html.twig index 2c30c3b807..a66003052b 100644 --- a/src/Sylius/Bundle/AdminBundle/templates/shared/form_theme.html.twig +++ b/src/Sylius/Bundle/AdminBundle/templates/shared/form_theme.html.twig @@ -87,3 +87,12 @@ {% set attr = attr|merge({'class': (attr.class|default('') ~ ' btn btn-outline-primary')|trim}) %} {{ parent() }} {%- endblock -%} + +{%- block form_end -%} + {% for child in form %} + {% if 'csrf_token' in child.vars.block_prefixes and child.rendered == false %} + {{ form_row(child) }} + {% endif %} + {% endfor %} + +{%- endblock form_end -%} diff --git a/src/Sylius/Bundle/AdminBundle/templates/shipment/component/ship.html.twig b/src/Sylius/Bundle/AdminBundle/templates/shipment/component/ship.html.twig index 1a6d096f69..110ce0f9ae 100644 --- a/src/Sylius/Bundle/AdminBundle/templates/shipment/component/ship.html.twig +++ b/src/Sylius/Bundle/AdminBundle/templates/shipment/component/ship.html.twig @@ -16,7 +16,6 @@ {{ 'sylius.ui.ship'|trans }} - {{ form_row(form._token) }} {{ form_end(form, {'render_rest': false}) }} {% endif %} diff --git a/src/Sylius/Bundle/AdminBundle/templates/shipping_method/form.html.twig b/src/Sylius/Bundle/AdminBundle/templates/shipping_method/form.html.twig index 1d473a5c83..880470a677 100644 --- a/src/Sylius/Bundle/AdminBundle/templates/shipping_method/form.html.twig +++ b/src/Sylius/Bundle/AdminBundle/templates/shipping_method/form.html.twig @@ -9,7 +9,6 @@ {% endif %} {{ form_errors(form) }} - {{ form_widget(form._token) }} {% hook 'form' with { form } %} diff --git a/src/Sylius/Bundle/AdminBundle/templates/taxon/sections/form.html.twig b/src/Sylius/Bundle/AdminBundle/templates/taxon/sections/form.html.twig index d2029f93a1..fd440fc7bd 100644 --- a/src/Sylius/Bundle/AdminBundle/templates/taxon/sections/form.html.twig +++ b/src/Sylius/Bundle/AdminBundle/templates/taxon/sections/form.html.twig @@ -8,7 +8,6 @@ {% endif %} {{ form_errors(form) }} - {{ form_widget(form._token) }} {% hook 'form' with { form } %} diff --git a/src/Sylius/Bundle/AdminBundle/templates/zone/form.html.twig b/src/Sylius/Bundle/AdminBundle/templates/zone/form.html.twig index 0b0f156073..1ede29f8d9 100644 --- a/src/Sylius/Bundle/AdminBundle/templates/zone/form.html.twig +++ b/src/Sylius/Bundle/AdminBundle/templates/zone/form.html.twig @@ -8,7 +8,6 @@ {% endif %} {{ form_errors(form) }} - {{ form_widget(form._token) }} {% hook 'form' with { form } %} diff --git a/src/Sylius/Bundle/ShopBundle/templates/account/address_book/common/main/form.html.twig b/src/Sylius/Bundle/ShopBundle/templates/account/address_book/common/main/form.html.twig index eb8522f271..c2b530a071 100644 --- a/src/Sylius/Bundle/ShopBundle/templates/account/address_book/common/main/form.html.twig +++ b/src/Sylius/Bundle/ShopBundle/templates/account/address_book/common/main/form.html.twig @@ -10,6 +10,5 @@ {% hook 'form' with { form } %} - {{ form_row(form._token) }} {{ form_end(form, {'render_rest': false}) }} diff --git a/src/Sylius/Bundle/ShopBundle/templates/account/address_book/set_as_default.html.twig b/src/Sylius/Bundle/ShopBundle/templates/account/address_book/set_as_default.html.twig index 891cbe8d42..5e2c105ae8 100644 --- a/src/Sylius/Bundle/ShopBundle/templates/account/address_book/set_as_default.html.twig +++ b/src/Sylius/Bundle/ShopBundle/templates/account/address_book/set_as_default.html.twig @@ -1,9 +1,11 @@ {% import '@SyliusShop/shared/buttons.html.twig' as buttons %} + +{% form_theme form '@SyliusShop/form/theme.html.twig' %} +
{{ form_start(form, {'action': path('sylius_shop_account_address_book_set_as_default', {'id': hookable_metadata.context.address.id})}) }} {{ buttons.submit('sylius.ui.set_as_default'|trans, 'set-as-default-button', null, 'btn-sm btn-icon btn-outline-gray w-full') }} - {{ form_row(form._token) }} {{ form_end(form, {'render_rest': false}) }}
diff --git a/src/Sylius/Bundle/ShopBundle/templates/account/change_password/update/content/main/form.html.twig b/src/Sylius/Bundle/ShopBundle/templates/account/change_password/update/content/main/form.html.twig index f038ab6739..fb35e29657 100644 --- a/src/Sylius/Bundle/ShopBundle/templates/account/change_password/update/content/main/form.html.twig +++ b/src/Sylius/Bundle/ShopBundle/templates/account/change_password/update/content/main/form.html.twig @@ -11,6 +11,5 @@ {% hook 'form' with { form } %} - {{ form_row(form._token) }} {{ form_end(form, {'render_rest': false}) }} diff --git a/src/Sylius/Bundle/ShopBundle/templates/account/forgotten_password/content/form_container/form.html.twig b/src/Sylius/Bundle/ShopBundle/templates/account/forgotten_password/content/form_container/form.html.twig index 0534e3611e..318fb5a03f 100644 --- a/src/Sylius/Bundle/ShopBundle/templates/account/forgotten_password/content/form_container/form.html.twig +++ b/src/Sylius/Bundle/ShopBundle/templates/account/forgotten_password/content/form_container/form.html.twig @@ -5,6 +5,5 @@
{{ form_start(form, {'action': path('sylius_shop_request_password_reset_token'), 'attr': {'novalidate': 'novalidate'}}) }} {% hook 'form' %} - {{ form_row(form._token) }} {{ form_end(form, {'render_rest': false}) }}
diff --git a/src/Sylius/Bundle/ShopBundle/templates/account/profile_update/update/content/main/form.html.twig b/src/Sylius/Bundle/ShopBundle/templates/account/profile_update/update/content/main/form.html.twig index 8c94281be3..5897b6eca6 100644 --- a/src/Sylius/Bundle/ShopBundle/templates/account/profile_update/update/content/main/form.html.twig +++ b/src/Sylius/Bundle/ShopBundle/templates/account/profile_update/update/content/main/form.html.twig @@ -3,7 +3,6 @@
{{ form_start(form, {'attr': {'class': 'ui loadable form', 'novalidate': 'novalidate'}}) }} {{ form_errors(form) }} - {{ form_row(form._token) }} {% hook 'form' with { form } %} diff --git a/src/Sylius/Bundle/ShopBundle/templates/account/register/content/form.html.twig b/src/Sylius/Bundle/ShopBundle/templates/account/register/content/form.html.twig index 0294eea50b..8200e58206 100644 --- a/src/Sylius/Bundle/ShopBundle/templates/account/register/content/form.html.twig +++ b/src/Sylius/Bundle/ShopBundle/templates/account/register/content/form.html.twig @@ -2,7 +2,6 @@
{{ form_start(form, {'action': path('sylius_shop_register'), 'attr': {'class': 'ui loadable form', 'novalidate': 'novalidate', 'id': form.vars.id}}) }} - {{ form_row(form._token) }} {% hook 'form' with { form } %} diff --git a/src/Sylius/Bundle/ShopBundle/templates/account/reset_password/content/form.html.twig b/src/Sylius/Bundle/ShopBundle/templates/account/reset_password/content/form.html.twig index 75f12f89a8..a8895f0501 100644 --- a/src/Sylius/Bundle/ShopBundle/templates/account/reset_password/content/form.html.twig +++ b/src/Sylius/Bundle/ShopBundle/templates/account/reset_password/content/form.html.twig @@ -7,5 +7,4 @@ {% hook 'form' %} -{{ form_row(form._token) }} {{ form_end(form, {render_rest: hookable.configuration.render_rest|default(false)}) }} diff --git a/src/Sylius/Bundle/ShopBundle/templates/cart/index/content/form.html.twig b/src/Sylius/Bundle/ShopBundle/templates/cart/index/content/form.html.twig index 0dabcbf52e..31fb247914 100644 --- a/src/Sylius/Bundle/ShopBundle/templates/cart/index/content/form.html.twig +++ b/src/Sylius/Bundle/ShopBundle/templates/cart/index/content/form.html.twig @@ -11,7 +11,6 @@ {{ form_start(form, {'action': path('sylius_shop_cart_checkout'), 'attr': {'novalidate': 'novalidate', 'id': form.vars.id}}) }} {{ form_errors(form) }} - {{ form_widget(form._token) }} {% hook 'form' with { form } %} diff --git a/src/Sylius/Bundle/ShopBundle/templates/checkout/address/content/form.html.twig b/src/Sylius/Bundle/ShopBundle/templates/checkout/address/content/form.html.twig index c39abd4d68..e5a18f5469 100644 --- a/src/Sylius/Bundle/ShopBundle/templates/checkout/address/content/form.html.twig +++ b/src/Sylius/Bundle/ShopBundle/templates/checkout/address/content/form.html.twig @@ -9,6 +9,5 @@ {% hook 'form' with { form, order: resource, email_exists: emailExists } %} - {{ form_row(form._token) }} {{ form_end(form, {render_rest: hookable.configuration.render_rest|default(false)}) }}
diff --git a/src/Sylius/Bundle/ShopBundle/templates/checkout/complete/content/form.html.twig b/src/Sylius/Bundle/ShopBundle/templates/checkout/complete/content/form.html.twig index 9d71bc7373..e0844ae9aa 100644 --- a/src/Sylius/Bundle/ShopBundle/templates/checkout/complete/content/form.html.twig +++ b/src/Sylius/Bundle/ShopBundle/templates/checkout/complete/content/form.html.twig @@ -8,5 +8,4 @@ {% hook 'form' %} -{{ form_row(form._token) }} {{ form_end(form, {'render_rest': false}) }} diff --git a/src/Sylius/Bundle/ShopBundle/templates/checkout/select_payment/content/form.html.twig b/src/Sylius/Bundle/ShopBundle/templates/checkout/select_payment/content/form.html.twig index 55841614e4..fbc3e4449e 100644 --- a/src/Sylius/Bundle/ShopBundle/templates/checkout/select_payment/content/form.html.twig +++ b/src/Sylius/Bundle/ShopBundle/templates/checkout/select_payment/content/form.html.twig @@ -10,6 +10,5 @@ {% hook 'form' with { form, order: resource } %} - {{ form_row(form._token) }} {{ form_end(form, {'render_rest': false}) }}
diff --git a/src/Sylius/Bundle/ShopBundle/templates/checkout/select_shipping/content/form.html.twig b/src/Sylius/Bundle/ShopBundle/templates/checkout/select_shipping/content/form.html.twig index 1a99ab382d..cb34454f9d 100644 --- a/src/Sylius/Bundle/ShopBundle/templates/checkout/select_shipping/content/form.html.twig +++ b/src/Sylius/Bundle/ShopBundle/templates/checkout/select_shipping/content/form.html.twig @@ -10,6 +10,5 @@ {% hook 'form' %} - {{ form_row(form._token) }} {{ form_end(form, {'render_rest': false}) }} diff --git a/src/Sylius/Bundle/ShopBundle/templates/contact/contact_request/content/form.html.twig b/src/Sylius/Bundle/ShopBundle/templates/contact/contact_request/content/form.html.twig index 261bce5ca2..89b64ef858 100644 --- a/src/Sylius/Bundle/ShopBundle/templates/contact/contact_request/content/form.html.twig +++ b/src/Sylius/Bundle/ShopBundle/templates/contact/contact_request/content/form.html.twig @@ -2,5 +2,4 @@ {{ form_start(form, {'action': path('sylius_shop_contact_request'), 'attr': {'novalidate': 'novalidate'}}) }} {% hook 'form' %} -{{ form_row(form._token) }} {{ form_end(form, {'render_rest': false}) }} diff --git a/src/Sylius/Bundle/ShopBundle/templates/form/theme.html.twig b/src/Sylius/Bundle/ShopBundle/templates/form/theme.html.twig index 9be746a70a..a1409280f9 100644 --- a/src/Sylius/Bundle/ShopBundle/templates/form/theme.html.twig +++ b/src/Sylius/Bundle/ShopBundle/templates/form/theme.html.twig @@ -73,3 +73,12 @@ {% endfor %} {% endblock %} + +{%- block form_end -%} + {% for child in form %} + {% if 'csrf_token' in child.vars.block_prefixes and child.rendered == false %} + {{ form_row(child) }} + {% endif %} + {% endfor %} + +{%- endblock form_end -%} diff --git a/src/Sylius/Bundle/ShopBundle/templates/order/show/content/form.html.twig b/src/Sylius/Bundle/ShopBundle/templates/order/show/content/form.html.twig index f723582edc..8d0618b099 100644 --- a/src/Sylius/Bundle/ShopBundle/templates/order/show/content/form.html.twig +++ b/src/Sylius/Bundle/ShopBundle/templates/order/show/content/form.html.twig @@ -12,7 +12,6 @@ {% hook 'form' %} - {{ form_row(form._token) }} {{ form_end(form, {'render_rest': false}) }} {% else %} {{ messages.info('sylius.ui.you_can_no_longer_change_payment_method_of_this_order') }} diff --git a/src/Sylius/Bundle/ShopBundle/templates/product/show/content/info/summary/add_to_cart.html.twig b/src/Sylius/Bundle/ShopBundle/templates/product/show/content/info/summary/add_to_cart.html.twig index 955ae3a256..395aa3eeaa 100644 --- a/src/Sylius/Bundle/ShopBundle/templates/product/show/content/info/summary/add_to_cart.html.twig +++ b/src/Sylius/Bundle/ShopBundle/templates/product/show/content/info/summary/add_to_cart.html.twig @@ -17,7 +17,6 @@ {% hook 'add_to_cart' with { product, form } %} - {{ form_row(form._token) }} {{ form_end(form, {'render_rest': false}) }} {% endif %} diff --git a/src/Sylius/Bundle/ShopBundle/templates/product_review/create/content/main/form.html.twig b/src/Sylius/Bundle/ShopBundle/templates/product_review/create/content/main/form.html.twig index 4ef93053a0..81f6dcce9e 100644 --- a/src/Sylius/Bundle/ShopBundle/templates/product_review/create/content/main/form.html.twig +++ b/src/Sylius/Bundle/ShopBundle/templates/product_review/create/content/main/form.html.twig @@ -13,6 +13,5 @@ {{ form_errors(form) }} - {{ form_row(form._token) }} {{ form_end(form, {'render_rest': false}) }} From 4f839fcb6a762eaa2965d0780935ce1efb0b7eb4 Mon Sep 17 00:00:00 2001 From: Kacper Kubacki Date: Mon, 1 Sep 2025 13:00:13 +0200 Subject: [PATCH 002/111] Prevent errors during application boot when CSRF protection is disabled --- src/Sylius/Bundle/AdminBundle/Action/RemoveAvatarAction.php | 4 ++-- .../Action/ResendOrderConfirmationEmailAction.php | 4 ++-- .../Action/ResendShipmentConfirmationEmailAction.php | 4 ++-- .../AdminBundle/Resources/config/services/controller.xml | 6 +++--- .../Resources/config/services/twig/component/taxon.xml | 2 +- .../AdminBundle/Twig/Component/Taxon/DeleteComponent.php | 4 ++-- .../BackwardsCompatibility/Symfony6PrivateServicesPass.php | 4 ++++ 7 files changed, 16 insertions(+), 12 deletions(-) diff --git a/src/Sylius/Bundle/AdminBundle/Action/RemoveAvatarAction.php b/src/Sylius/Bundle/AdminBundle/Action/RemoveAvatarAction.php index 99a39f710b..ab4e3d3d78 100644 --- a/src/Sylius/Bundle/AdminBundle/Action/RemoveAvatarAction.php +++ b/src/Sylius/Bundle/AdminBundle/Action/RemoveAvatarAction.php @@ -28,7 +28,7 @@ final class RemoveAvatarAction public function __construct( private AvatarImageRepositoryInterface $avatarRepository, private RouterInterface $router, - private CsrfTokenManagerInterface $csrfTokenManager, + private ?CsrfTokenManagerInterface $csrfTokenManager, ) { } @@ -36,7 +36,7 @@ final class RemoveAvatarAction { $userId = $request->attributes->get('id', ''); - if (!$this->csrfTokenManager->isTokenValid( + if ($this->csrfTokenManager && !$this->csrfTokenManager->isTokenValid( new CsrfToken($userId, (string) $request->query->get('_csrf_token', '')), )) { throw new HttpException(Response::HTTP_FORBIDDEN, 'Invalid csrf token.'); diff --git a/src/Sylius/Bundle/AdminBundle/Action/ResendOrderConfirmationEmailAction.php b/src/Sylius/Bundle/AdminBundle/Action/ResendOrderConfirmationEmailAction.php index a1203988f2..cfaf5a2ccb 100644 --- a/src/Sylius/Bundle/AdminBundle/Action/ResendOrderConfirmationEmailAction.php +++ b/src/Sylius/Bundle/AdminBundle/Action/ResendOrderConfirmationEmailAction.php @@ -32,7 +32,7 @@ final readonly class ResendOrderConfirmationEmailAction public function __construct( private OrderRepositoryInterface $orderRepository, private ResendOrderConfirmationEmailDispatcherInterface $resendOrderConfirmationEmailDispatcher, - private CsrfTokenManagerInterface $csrfTokenManager, + private ?CsrfTokenManagerInterface $csrfTokenManager, private RequestStack $requestStack, private RouterInterface $router, ) { @@ -42,7 +42,7 @@ final readonly class ResendOrderConfirmationEmailAction { $orderId = $request->attributes->get('id', ''); - if (!$this->csrfTokenManager->isTokenValid( + if ($this->csrfTokenManager && !$this->csrfTokenManager->isTokenValid( new CsrfToken($orderId, (string) $request->query->get('_csrf_token', '')), )) { throw new HttpException(Response::HTTP_FORBIDDEN, 'Invalid csrf token.'); diff --git a/src/Sylius/Bundle/AdminBundle/Action/ResendShipmentConfirmationEmailAction.php b/src/Sylius/Bundle/AdminBundle/Action/ResendShipmentConfirmationEmailAction.php index 81081a97ab..b55198f882 100644 --- a/src/Sylius/Bundle/AdminBundle/Action/ResendShipmentConfirmationEmailAction.php +++ b/src/Sylius/Bundle/AdminBundle/Action/ResendShipmentConfirmationEmailAction.php @@ -31,7 +31,7 @@ final readonly class ResendShipmentConfirmationEmailAction public function __construct( private ShipmentRepositoryInterface $shipmentRepository, private ResendShipmentConfirmationEmailDispatcherInterface $resendShipmentConfirmationDispatcher, - private CsrfTokenManagerInterface $csrfTokenManager, + private ?CsrfTokenManagerInterface $csrfTokenManager, private RequestStack $requestStack, ) { } @@ -40,7 +40,7 @@ final readonly class ResendShipmentConfirmationEmailAction { $shipmentId = $request->attributes->get('id', ''); - if (!$this->csrfTokenManager->isTokenValid( + if ($this->csrfTokenManager && !$this->csrfTokenManager->isTokenValid( new CsrfToken($shipmentId, (string) $request->query->get('_csrf_token', '')), )) { throw new HttpException(Response::HTTP_FORBIDDEN, 'Invalid csrf token.'); diff --git a/src/Sylius/Bundle/AdminBundle/Resources/config/services/controller.xml b/src/Sylius/Bundle/AdminBundle/Resources/config/services/controller.xml index 9de84582eb..dc9a2aaf26 100644 --- a/src/Sylius/Bundle/AdminBundle/Resources/config/services/controller.xml +++ b/src/Sylius/Bundle/AdminBundle/Resources/config/services/controller.xml @@ -43,13 +43,13 @@ - + - + @@ -57,7 +57,7 @@ - + diff --git a/src/Sylius/Bundle/AdminBundle/Resources/config/services/twig/component/taxon.xml b/src/Sylius/Bundle/AdminBundle/Resources/config/services/twig/component/taxon.xml index f5ab678bcd..6872aeac9d 100644 --- a/src/Sylius/Bundle/AdminBundle/Resources/config/services/twig/component/taxon.xml +++ b/src/Sylius/Bundle/AdminBundle/Resources/config/services/twig/component/taxon.xml @@ -21,7 +21,7 @@ id="sylius_admin.twig.component.taxon.delete" class="Sylius\Bundle\AdminBundle\Twig\Component\Taxon\DeleteComponent" > - + diff --git a/src/Sylius/Bundle/AdminBundle/Twig/Component/Taxon/DeleteComponent.php b/src/Sylius/Bundle/AdminBundle/Twig/Component/Taxon/DeleteComponent.php index 0025f4a9fb..3096a4bdd1 100644 --- a/src/Sylius/Bundle/AdminBundle/Twig/Component/Taxon/DeleteComponent.php +++ b/src/Sylius/Bundle/AdminBundle/Twig/Component/Taxon/DeleteComponent.php @@ -37,7 +37,7 @@ final class DeleteComponent public string $taxonId = ''; public function __construct( - protected readonly CsrfTokenManagerInterface $csrfTokenManager, + protected readonly ?CsrfTokenManagerInterface $csrfTokenManager, ) { } @@ -47,7 +47,7 @@ final class DeleteComponent $this->taxonId = $taxonId; $this->dispatchBrowserEvent( self::OPEN_DELETE_MODAL_EVENT, - ['csrfToken' => $this->csrfTokenManager->getToken($taxonId)->getValue()], + ['csrfToken' => $this->csrfTokenManager?->getToken($taxonId)->getValue()], ); } } diff --git a/src/Sylius/Bundle/CoreBundle/DependencyInjection/Compiler/BackwardsCompatibility/Symfony6PrivateServicesPass.php b/src/Sylius/Bundle/CoreBundle/DependencyInjection/Compiler/BackwardsCompatibility/Symfony6PrivateServicesPass.php index 6b638dd812..7fa0d1bdca 100644 --- a/src/Sylius/Bundle/CoreBundle/DependencyInjection/Compiler/BackwardsCompatibility/Symfony6PrivateServicesPass.php +++ b/src/Sylius/Bundle/CoreBundle/DependencyInjection/Compiler/BackwardsCompatibility/Symfony6PrivateServicesPass.php @@ -33,6 +33,10 @@ final class Symfony6PrivateServicesPass implements CompilerPassInterface private function makeServicePublic(string $serviceId, ContainerBuilder $container): void { + if (!$container->hasDefinition($serviceId)) { + return; + } + $service = $container->getDefinition($serviceId); $service->setPublic(true); $container->setDefinition($serviceId, $service); From 56a801514deeabc991a808f6bc20930bf4907136 Mon Sep 17 00:00:00 2001 From: Kacper Kubacki Date: Mon, 1 Sep 2025 13:01:33 +0200 Subject: [PATCH 003/111] Add extension to globally disable csrf protection when it is turned off --- .../DisabledCsrfProtectionFormExtension.php | 43 +++++++++++++++++++ .../Resources/config/services/form.xml | 5 +++ 2 files changed, 48 insertions(+) create mode 100644 src/Sylius/Bundle/CoreBundle/Form/Extension/DisabledCsrfProtectionFormExtension.php diff --git a/src/Sylius/Bundle/CoreBundle/Form/Extension/DisabledCsrfProtectionFormExtension.php b/src/Sylius/Bundle/CoreBundle/Form/Extension/DisabledCsrfProtectionFormExtension.php new file mode 100644 index 0000000000..af84ebc4c0 --- /dev/null +++ b/src/Sylius/Bundle/CoreBundle/Form/Extension/DisabledCsrfProtectionFormExtension.php @@ -0,0 +1,43 @@ +container->hasParameter('form.type_extension.csrf.enabled') + ? $this->container->getParameter('form.type_extension.csrf.enabled') + : true; + + if (!$csrfEnabled) { + $resolver->setDefault('csrf_protection', false); + } + } +} diff --git a/src/Sylius/Bundle/CoreBundle/Resources/config/services/form.xml b/src/Sylius/Bundle/CoreBundle/Resources/config/services/form.xml index b9589e27dc..01341ce70e 100644 --- a/src/Sylius/Bundle/CoreBundle/Resources/config/services/form.xml +++ b/src/Sylius/Bundle/CoreBundle/Resources/config/services/form.xml @@ -136,6 +136,11 @@ + + + + + %sylius.model.product_review.class% %sylius.form.type.product_review.validation_groups% From d46ef32b728ea562548055a93171184492b6ca60 Mon Sep 17 00:00:00 2001 From: Kacper Kubacki Date: Mon, 1 Sep 2025 13:02:15 +0200 Subject: [PATCH 004/111] Skip generating csrf token when csrf protection is turned off --- .../customizing-menus.md | 4 +- .../personal_information/avatar.html.twig | 2 +- .../title_block/actions/delete.html.twig | 4 +- .../title_block/actions/cancel.html.twig | 4 +- .../title_block/actions/list/cancel.html.twig | 4 +- .../list/resend_confirmation_email.html.twig | 2 +- .../resend_confirmation_email.html.twig | 2 +- .../payments/item/actions/complete.html.twig | 4 +- .../payments/item/actions/refund.html.twig | 4 +- .../actions/resend_confirmation.html.twig | 2 +- .../grid/action/update_positions.html.twig | 2 +- .../grid/action/update_positions.html.twig | 2 +- .../login/page/content/form.html.twig | 4 +- .../shared/components/delete_modal.html.twig | 4 +- .../grid/action/apply_transition.html.twig | 4 +- .../shared/grid/action/archive.html.twig | 4 +- .../Resources/config/services/templating.xml | 5 +++ .../Twig/CsrfProtectionEnabledExtension.php | 38 +++++++++++++++++++ .../login_container/form/csrf_token.html.twig | 4 +- .../address/content/form/user.html.twig | 4 +- .../templates/shared/buttons.html.twig | 4 +- .../shared/components/delete_modal.html.twig | 4 +- 22 files changed, 91 insertions(+), 20 deletions(-) create mode 100644 src/Sylius/Bundle/CoreBundle/Twig/CsrfProtectionEnabledExtension.php diff --git a/docs/the-customization-guide/customizing-menus.md b/docs/the-customization-guide/customizing-menus.md index 6331c76f11..58df4309b7 100644 --- a/docs/the-customization-guide/customizing-menus.md +++ b/docs/the-customization-guide/customizing-menus.md @@ -129,7 +129,9 @@ sylius_twig_hooks: {% if sylius_sm_can(payment, constant('Sylius\\Component\\Payment\\PaymentTransitions::GRAPH'), constant('Sylius\\Component\\Payment\\PaymentTransitions::TRANSITION_COMPLETE')) %}
- + {% if sylius_csrf_protection_enabled() %} + + {% endif %} diff --git a/src/Sylius/Bundle/AdminBundle/templates/order/show/content/sections/payments/item/actions/refund.html.twig b/src/Sylius/Bundle/AdminBundle/templates/order/show/content/sections/payments/item/actions/refund.html.twig index a98e462e69..fd0a1929fa 100644 --- a/src/Sylius/Bundle/AdminBundle/templates/order/show/content/sections/payments/item/actions/refund.html.twig +++ b/src/Sylius/Bundle/AdminBundle/templates/order/show/content/sections/payments/item/actions/refund.html.twig @@ -4,7 +4,9 @@ {% if sylius_sm_can(payment, constant('Sylius\\Component\\Payment\\PaymentTransitions::GRAPH'), constant('Sylius\\Component\\Payment\\PaymentTransitions::TRANSITION_REFUND')) %} - + {% if sylius_csrf_protection_enabled() %} + + {% endif %} diff --git a/src/Sylius/Bundle/AdminBundle/templates/order/show/content/sections/shipments/item/actions/resend_confirmation.html.twig b/src/Sylius/Bundle/AdminBundle/templates/order/show/content/sections/shipments/item/actions/resend_confirmation.html.twig index 901b4defd8..c17c2600f2 100644 --- a/src/Sylius/Bundle/AdminBundle/templates/order/show/content/sections/shipments/item/actions/resend_confirmation.html.twig +++ b/src/Sylius/Bundle/AdminBundle/templates/order/show/content/sections/shipments/item/actions/resend_confirmation.html.twig @@ -1,7 +1,7 @@ {% set shipment = hookable_metadata.context.shipment %} {% if shipment.state == 'shipped' %} - {% set resend_path = path('sylius_admin_shipment_resend_confirmation_email', {'id': shipment.id, '_csrf_token': csrf_token(shipment.id)}) %} + {% set resend_path = path('sylius_admin_shipment_resend_confirmation_email', {'id': shipment.id, '_csrf_token': sylius_csrf_protection_enabled () ? csrf_token(shipment.id) : null}) %} {{ ux_icon('tabler:send') }} diff --git a/src/Sylius/Bundle/AdminBundle/templates/product_taxon/grid/action/update_positions.html.twig b/src/Sylius/Bundle/AdminBundle/templates/product_taxon/grid/action/update_positions.html.twig index 4ee799f439..ff1bffd48a 100644 --- a/src/Sylius/Bundle/AdminBundle/templates/product_taxon/grid/action/update_positions.html.twig +++ b/src/Sylius/Bundle/AdminBundle/templates/product_taxon/grid/action/update_positions.html.twig @@ -1,7 +1,7 @@ - + {% if sylius_csrf_protection_enabled() %} + + {% endif %}
{% endif %} diff --git a/src/Sylius/Bundle/ShopBundle/templates/shared/buttons.html.twig b/src/Sylius/Bundle/ShopBundle/templates/shared/buttons.html.twig index d067085c74..98acab090e 100644 --- a/src/Sylius/Bundle/ShopBundle/templates/shared/buttons.html.twig +++ b/src/Sylius/Bundle/ShopBundle/templates/shared/buttons.html.twig @@ -57,6 +57,8 @@ - + {% if sylius_csrf_protection_enabled() %} + + {% endif %}
{% endmacro %} diff --git a/src/Sylius/Bundle/ShopBundle/templates/shared/components/delete_modal.html.twig b/src/Sylius/Bundle/ShopBundle/templates/shared/components/delete_modal.html.twig index 09ae7c55c3..572d95106b 100644 --- a/src/Sylius/Bundle/ShopBundle/templates/shared/components/delete_modal.html.twig +++ b/src/Sylius/Bundle/ShopBundle/templates/shared/components/delete_modal.html.twig @@ -13,7 +13,9 @@ {% block footer %}
- + {% if sylius_csrf_protection_enabled() %} + + {% endif %}