From 868f7fc4f4fe02a61f567bc7259b92e0a0fc971c Mon Sep 17 00:00:00 2001
From: Kacper Kubacki <kacper.kubacki@bitbag.pl>
Date: Mon, 1 Sep 2025 13:01:33 +0200
Subject: [PATCH] Add extension to globally disable csrf protection when it is
 turned off

---
 .../DisabledCsrfProtectionFormExtension.php   | 43 +++++++++++++++++++
 .../Resources/config/services/form.php        |  7 +++
 2 files changed, 50 insertions(+)
 create mode 100644 src/Sylius/Bundle/CoreBundle/Form/Extension/DisabledCsrfProtectionFormExtension.php

diff --git a/src/Sylius/Bundle/CoreBundle/Form/Extension/DisabledCsrfProtectionFormExtension.php b/src/Sylius/Bundle/CoreBundle/Form/Extension/DisabledCsrfProtectionFormExtension.php
new file mode 100644
index 0000000000..af84ebc4c0
--- /dev/null
+++ b/src/Sylius/Bundle/CoreBundle/Form/Extension/DisabledCsrfProtectionFormExtension.php
@@ -0,0 +1,43 @@
+<?php
+
+/*
+ * This file is part of the Sylius package.
+ *
+ * (c) Sylius Sp. z o.o.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Sylius\Bundle\CoreBundle\Form\Extension;
+
+use Symfony\Component\DependencyInjection\ContainerInterface;
+use Symfony\Component\Form\AbstractTypeExtension;
+use Symfony\Component\Form\Extension\Core\Type\FormType;
+use Symfony\Component\OptionsResolver\OptionsResolver;
+
+final class DisabledCsrfProtectionFormExtension extends AbstractTypeExtension
+{
+    public function __construct(
+        private readonly ContainerInterface $container,
+    ) {
+    }
+
+    public static function getExtendedTypes(): iterable
+    {
+        return [FormType::class];
+    }
+
+    public function configureOptions(OptionsResolver $resolver): void
+    {
+        $csrfEnabled = $this->container->hasParameter('form.type_extension.csrf.enabled')
+            ? $this->container->getParameter('form.type_extension.csrf.enabled')
+            : true;
+
+        if (!$csrfEnabled) {
+            $resolver->setDefault('csrf_protection', false);
+        }
+    }
+}
diff --git a/src/Sylius/Bundle/CoreBundle/Resources/config/services/form.php b/src/Sylius/Bundle/CoreBundle/Resources/config/services/form.php
index 71aac23b42..7bb960bc53 100644
--- a/src/Sylius/Bundle/CoreBundle/Resources/config/services/form.php
+++ b/src/Sylius/Bundle/CoreBundle/Resources/config/services/form.php
@@ -26,6 +26,7 @@ use Sylius\Bundle\CoreBundle\Form\Extension\CartItemTypeExtension;
 use Sylius\Bundle\CoreBundle\Form\Extension\CartTypeExtension;
 use Sylius\Bundle\CoreBundle\Form\Extension\CatalogPromotionTypeExtension;
 use Sylius\Bundle\CoreBundle\Form\Extension\ChannelTypeExtension;
+use Sylius\Bundle\CoreBundle\Form\Extension\DisabledCsrfProtectionFormExtension;
 use Sylius\Bundle\CoreBundle\Form\Extension\OrderTypeExtension;
 use Sylius\Bundle\CoreBundle\Form\Extension\PaymentMethodTypeExtension;
 use Sylius\Bundle\CoreBundle\Form\Extension\ProductTranslationTypeExtension;
@@ -181,6 +182,12 @@ return static function (ContainerConfigurator $container) {
         ->tag('form.type_extension', ['priority' => 100])
     ;
 
+    $services
+        ->set('sylius.form.extension.type.disabled_csrf_protection', DisabledCsrfProtectionFormExtension::class)
+        ->args([service('service_container')])
+        ->tag('form.type_extension', ['priority' => 100])
+    ;
+
     $services
         ->set('sylius.form.type.product_review', ProductReviewType::class)
         ->args([