CSRF 验证不适用于 Zend Framework

Question

我有一个忘记密码表单，它包含 3 个元素， 电子邮件、验证码和提交按钮，在我添加的表单中

My Form



function init()
    {
        $this->setAttrib('id', 'forgot_password_form');
        $this->setMethod(Zend_Form::METHOD_POST);
        $this->setAction('/member/forgotpassword');
        $this->setAttrib('enctype', 'multipart/form-data');


 $email = new Zend_Form_Element_Text('email');
        $email->setRequired(true)
                ->addDecorators($this->_standardElementDecorator)
                ->addFilter('StringTrim')
                ->addValidator('NotEmpty')
                ->addValidator('EmailAddress')
                ->setAttrib('class', 'required email form-control');
        $this->addElement($email);

 $captcha = new Zend_Form_Element_Captcha('captcha', // This is the name of the input field
                        array('placeholder' => 'الرجاء كتابة الأحرف التي بالصورة '
                            ,'class' => 'required form-control',
                            'captcha' => array(// Here comes the magic...
                                // First the type...
                                'captcha' => 'Image',
                                // Length of the word...
                                'wordLen' => 3,
                                // Captcha timeout, 5 mins
                                'timeout' => 300,
                                // What font to use...
                                'font' => APPLICATION_PATH . '/../fonts/arial.ttf',
                                // Where to put the image
                                'imgDir' => APPLICATION_PATH . '/../public/assets/img/captcha/',
                                // URL to the images
                                // This was bogus, here's how it should be... Sorry again :S
                                'imgUrl' => '/assets/img/captcha/',
                        )));

        $captcha->addDecorators($this->_captchaElementDecorator);
        $captcha->addErrorMessage('Error Image');
        $this->addElement($captcha);

 $submit = new Zend_Form_Element_Submit('submit');
      $submit ->setAttrib('id', 'fogotpassword-button')
            ->setAttrib('type', 'submit')
            ->setAttrib('style', 'border:none;clear: both;')
            ->setAttrib('class', 'btn_wide signup_spacing login-submit col-md-12 col-sm-10 col-xs-10 col-xs-offset-1 col-sm-offset-1 col-md-offset-0')
            ->setLabel('submit button')
            ->setDecorators($this->_submitButtonDecorator);
      $this->addElement($submit);

  $this->addElement(
            'hash', 'csrf', array(
            'ignore' => true,
            )
        );

        // Load the messages
        $translate = $this->getDefaultTranslator();
        $this->initValidationMessages($translate->getMessages());
    }

我的行动

public function forgotpasswordAction()
    {
        $forgotPasswordForm = new Application_Form_ForgotPassword();
        $request = $this->getRequest();
        if ($this->getRequest()->isPost()) {

            if ($forgotPasswordForm->isValid($request->getPost())) {
 echo '123';die;
}

已编辑 我以前是这样称呼整体的

它工作得很好，但现在它工作了吗？我怎样才能跟踪我或修复它？

<div style="">
            <?php echo $this->forgotPasswordform;?>
       </div>

但我现在像这样逐个元素地调用它们

<div class="reg-phone-country-container">
                                    <?php echo $this->forgotPasswordform->email; ?>
</div>

这就是让 from 无效

Answer 1

您可以通过以下方式添加验证码

$this->addElement('captcha', 'captcha', array(
            'label'      => 'Please enter the 5 letters displayed below:',
            'required'   => true,
            'captcha'    => array(
                'captcha' => 'figlet',
                'wordLen' => 5,                
                'timeout' => 300,                
            )
        ));

CSRF 保护如下，

  $this->addElement('hash', 'csrf', array(
        'ignore' => true,
    ));