It is used when forms are generated and submitted:
After a form has been generated, the method "generateRequestHash" is called with the names of all form fields.
It cleans up the array of form fields and creates another representation of it, which is then serialized and hashed.
Both serialized form field list and the added hash form the request hash, which will be sent over the wire (as an argument __hmac).
On the validation side, the validation happens in two steps:
1) Check if the request hash is consistent (the hash value fits to the serialized string)
2) Check that _all_ GET/POST parameters submitted occur inside the form field list of the request hash.
Note: It is crucially important that a private key is computed into the hash value! This is done inside the HashService.
/**
* @test
*/
public function initializePropertyMappingConfigurationDoesNothingIfTrustedPropertiesAreNotSet()
{
$request = $this->getMockBuilder(Mvc\ActionRequest::class)->setMethods(['getInternalArgument'])->disableOriginalConstructor()->getMock();
$request->expects($this->any())->method('getInternalArgument')->with('__trustedProperties')->will($this->returnValue(null));
$arguments = new Mvc\Controller\Arguments();
$requestHashService = new Mvc\Controller\MvcPropertyMappingConfigurationService();
$requestHashService->initializePropertyMappingConfigurationFromRequest($request, $arguments);
// dummy assertion to avoid PHPUnit warning
$this->assertTrue(true);
}
/**
* Handles a request. The result output is returned by altering the given response.
*
* @param RequestInterface $request The request object
* @param ResponseInterface $response The response, modified by this handler
* @return void
* @throws UnsupportedRequestTypeException
* @api
*/
public function processRequest(RequestInterface $request, ResponseInterface $response)
{
$this->initializeController($request, $response);
$this->actionMethodName = $this->resolveActionMethodName();
$this->initializeActionMethodArguments();
$this->initializeActionMethodValidators();
$this->initializeAction();
$actionInitializationMethodName = 'initialize' . ucfirst($this->actionMethodName);
if (method_exists($this, $actionInitializationMethodName)) {
call_user_func([$this, $actionInitializationMethodName]);
}
$this->mvcPropertyMappingConfigurationService->initializePropertyMappingConfigurationFromRequest($this->request, $this->arguments);
$this->mapRequestArgumentsToControllerArguments();
if ($this->view === null) {
$this->view = $this->resolveView();
}
if ($this->view !== null) {
$this->view->assign('settings', $this->settings);
$this->view->setControllerContext($this->controllerContext);
$this->initializeView($this->view);
}
$this->callActionMethod();
}
/**
* @test
*/
public function trustedPropertiesConfigurationDoesNotIgnoreWildcardConfigurationInController()
{
$entity = new TestEntity();
$entity->setName('Foo');
$this->persistenceManager->add($entity);
$identifier = $this->persistenceManager->getIdentifierByObject($entity);
$trustedPropertiesService = new MvcPropertyMappingConfigurationService();
$trustedProperties = $trustedPropertiesService->generateTrustedPropertiesToken(['entity[__identity]', 'entity[subEntities][0][content]', 'entity[subEntities][0][date]', 'entity[subEntities][1][content]', 'entity[subEntities][1][date]']);
$form = ['entity' => ['__identity' => $identifier, 'subEntities' => [['content' => 'Bar', 'date' => '1.1.2016'], ['content' => 'Baz', 'date' => '30.12.2016']]], '__trustedProperties' => $trustedProperties];
$request = Request::create(new Uri('http://localhost/test/mvc/actioncontrollertestc/' . $identifier . '/update'), 'POST', $form);
$response = $this->browser->sendRequest($request);
$this->assertSame('Entity "Foo" updated', $response->getContent());
}
/**
* Render the request hash field
*
* @return string the hmac field
*/
protected function renderTrustedPropertiesField()
{
$formFieldNames = $this->viewHelperVariableContainer->get(\Neos\FluidAdaptor\ViewHelpers\FormViewHelper::class, 'formFieldNames');
$requestHash = $this->mvcPropertyMappingConfigurationService->generateTrustedPropertiesToken($formFieldNames, $this->getFieldNamePrefix());
return '<input type="hidden" name="' . $this->prefixFieldName('__trustedProperties') . '" value="' . htmlspecialchars($requestHash) . '" />' . chr(10);
}