Document {csrfToken} (#98)

Resolves #93

Co-authored-by: Matthias Schmidt <gravatronics@live.com>

diff --git a/_data/sidebars/sidebar.yml b/_data/sidebars/sidebar.yml
index 51f6d5ab1374c42736d6e804b89655ce792260ba..f4822d63bc8f253c1370031a0548e45084b58cd5 100644 (file)
--- a/_data/sidebars/sidebar.yml
+++ b/_data/sidebars/sidebar.yml
@@ -122,6 +122,8 @@ entries:
         - title: Migrating from WSC 5.3
           subfolderitems:
 
+          - title: Templates
+            url: /migration_wsc-53_templates.html
           - title: Third Party Libraries
             url: /migration_wsc-53_libraries.html
 

diff --git a/_includes/tutorial/tutorial-series/part-1/acptemplates/personAdd.tpl b/_includes/tutorial/tutorial-series/part-1/acptemplates/personAdd.tpl
index aa0db17c56aa63c53246a500877a980ebf909a3b..a19603abf461a10f0926d09f80e69d1e0aab60f1 100644 (file)
--- a/_includes/tutorial/tutorial-series/part-1/acptemplates/personAdd.tpl
+++ b/_includes/tutorial/tutorial-series/part-1/acptemplates/personAdd.tpl
@@ -57,7 +57,7 @@
        
        <div class="formSubmit">
                <input type="submit" value="{lang}wcf.global.button.submit{/lang}" accesskey="s">
-               {@SECURITY_TOKEN_INPUT_TAG}
+               {csrfToken}
        </div>
 </form>
 

diff --git a/_includes/tutorial/tutorial-series/part-3/acptemplates/personAdd.tpl b/_includes/tutorial/tutorial-series/part-3/acptemplates/personAdd.tpl
index 89319575d61cf466ebbb27b2c15f8b463edee0f4..0e3690717aa08822e57db6b9f6df5f716a4e9d87 100644 (file)
--- a/_includes/tutorial/tutorial-series/part-3/acptemplates/personAdd.tpl
+++ b/_includes/tutorial/tutorial-series/part-3/acptemplates/personAdd.tpl
@@ -65,7 +65,7 @@
        
        <div class="formSubmit">
                <input type="submit" value="{lang}wcf.global.button.submit{/lang}" accesskey="s">
-               {@SECURITY_TOKEN_INPUT_TAG}
+               {csrfToken}
        </div>
 </form>
 

diff --git a/pages/migration/wsc-53/migration_wsc-53_templates.md b/pages/migration/wsc-53/migration_wsc-53_templates.md
new file mode 100644 (file)
index 0000000..531a7ba
--- /dev/null
+++ b/pages/migration/wsc-53/migration_wsc-53_templates.md
@@ -0,0 +1,29 @@
+---
+title: Migrating from WSC 5.3- Templates and Languages
+sidebar: sidebar
+permalink: migration_wsc-53_templates.html
+folder: migration/wsc-523
+---
+
+## `{csrfToken}`
+
+Going forward, any uses of the `SECURITY_TOKEN_*` constants should be avoided.
+To reference the CSRF token (“Security Token”) within templates, the `{csrfToken}` template plugin was added.
+
+Before:
+
+```smarty
+{@SECURITY_TOKEN_INPUT_TAG}
+{link controller="Foo"}t={@SECURITY_TOKEN}{/link}
+```
+
+After:
+
+```smarty
+{csrfToken}
+{link controller="Foo"}t={csrfToken type=url}{/link} {* The use of the CSRF token in URLs is discouraged.
+                                                        Modifications should happen by means of a POST request. *}
+```
+
+The `{csrfToken}` plugin was backported to WoltLab Suite 5.2 and higher, allowing compatibility with a large range of WoltLab Suite branches.
+See [WoltLab/WCF #3612](https://github.com/WoltLab/WCF/pull/3612) for details.

diff --git a/pages/tutorial/tutorial-series/tutorial_tutorial-series_part-1-base-structure.md b/pages/tutorial/tutorial-series/tutorial_tutorial-series_part-1-base-structure.md
index 46648c0e14192b2be4c6c5a903fc21532772397f..f86530539bd6fa3e61756f4d22bfaa59cff88a6a 100644 (file)
--- a/pages/tutorial/tutorial-series/tutorial_tutorial-series_part-1-base-structure.md
+++ b/pages/tutorial/tutorial-series/tutorial_tutorial-series_part-1-base-structure.md
@@ -264,7 +264,7 @@ We will now only concentrate on the new parts compared to `personList.tpl`:
      The first part of the event name should reflect the type of fields in the particular `.section` element.
      Here, the input fields are just general “data” fields so that the event is called `dataFields`.
    - After the last `.section` element, fire a `section` event so that plugins can add further sections.
-   - Lastly, the `.formSubmit` shows the submit button and `{@SECURITY_TOKEN_INPUT_TAG}` contains a CSRF token that is automatically validated after the form is submitted.
+   - Lastly, the `.formSubmit` shows the submit button and `{csrfToken}` contains a CSRF token that is automatically validated after the form is submitted.
 
 ### Person Edit Form
 

diff --git a/pages/view/view_template-plugins.md b/pages/view/view_template-plugins.md
index 70924a2245bacdd9911949856adfbd95912f633a..a1a8dc08d217e4fc3d331f69b0519a7426d2de82 100644 (file)
--- a/pages/view/view_template-plugins.md
+++ b/pages/view/view_template-plugins.md
@@ -149,6 +149,22 @@ Counter supports the following attributes:
 | `start` | start counter value; `1` by default |
 
 
+## <span class="label label-info">5.4+</span> `csrfToken`
+
+`{csrfToken}` prints out the session's CSRF token (“Security Token”).
+
+```smarty
+<form action="{link controller="Foo"}{/link}" method="post">
+       {* snip *}
+
+       {csrfToken}
+</form>
+```
+
+The `{csrfToken}` template plugin supports a `type` parameter.
+Specifying this parameter might be required in rare situations.
+Please [check the implementation](https://github.com/WoltLab/WCF/blob/master/wcfsetup/install/files/lib/system/template/plugin/CsrfTokenFunctionTemplatePlugin.class.php) for details.
+
 ## `currency`
 
 `currency` is a modifier used to format currency values with two decimals using language dependent thousands separators and decimal point:

diff --git a/pages/view/view_templates.md b/pages/view/view_templates.md
index 41e496e033cce15afc5c0b614fb69f8c2bc8c754..0601dacf7f85beb31caf8febcaeb8761b05f04dd 100644 (file)
--- a/pages/view/view_templates.md
+++ b/pages/view/view_templates.md
@@ -121,7 +121,7 @@ More information about installing templates can be found on those pages.
        
        <div class="formSubmit">
                <input type="submit" value="{lang}wcf.global.button.submit{/lang}" accesskey="s">
-               {@SECURITY_TOKEN_INPUT_TAG}
+               {csrfToken}
        </div>
 </form>
 ```