diff --git a/core/lib/Drupal/Core/Form/FormBuilder.php b/core/lib/Drupal/Core/Form/FormBuilder.php index 435437c..2c5bd56 100644 --- a/core/lib/Drupal/Core/Form/FormBuilder.php +++ b/core/lib/Drupal/Core/Form/FormBuilder.php @@ -19,7 +19,6 @@ use Drupal\Core\Form\Exception\BrokenPostRequestException; use Drupal\Core\Render\Element; use Drupal\Core\Render\ElementInfoManagerInterface; -use Drupal\Core\StringTranslation\StringTranslationTrait; use Drupal\Core\Theme\ThemeManagerInterface; use Symfony\Component\EventDispatcher\EventDispatcherInterface; use Symfony\Component\HttpFoundation\RequestStack; @@ -32,8 +31,6 @@ */ class FormBuilder implements FormBuilderInterface, FormValidatorInterface, FormSubmitterInterface, FormCacheInterface { - use StringTranslationTrait; - /** * The module handler. * @@ -767,6 +764,13 @@ protected function buildFormAction() { /** * {@inheritdoc} */ + public function setInvalidTokenError(FormStateInterface $form_state) { + $this->formValidator->setInvalidTokenError($form_state); + } + + /** + * {@inheritdoc} + */ public function validateForm($form_id, &$form, FormStateInterface &$form_state) { $this->formValidator->validateForm($form_id, $form, $form_state); } @@ -846,10 +850,7 @@ public function doBuildForm($form_id, &$element, FormStateInterface &$form_state if (empty($input['form_token']) || !$this->csrfToken->validate($input['form_token'], $element['#token'])) { // Set an early form error to block certain input processing since // that opens the door for CSRF vulnerabilities. - $url = $this->requestStack->getCurrentRequest()->getRequestUri(); - - // Setting this error will cause the form to fail validation. - $form_state->setErrorByName('form_token', $this->t('The form has become outdated. Copy any unsaved work in the form below and then reload this page.', array('@link' => $url))); + $this->setInvalidTokenError($form_state); // This value is checked in self::handleInputElement(). $form_state->setInvalidToken(TRUE); diff --git a/core/lib/Drupal/Core/Form/FormValidator.php b/core/lib/Drupal/Core/Form/FormValidator.php index f3e36aa..10678e3 100644 --- a/core/lib/Drupal/Core/Form/FormValidator.php +++ b/core/lib/Drupal/Core/Form/FormValidator.php @@ -110,10 +110,7 @@ public function validateForm($form_id, &$form, FormStateInterface &$form_state) // code. if (isset($form['#token'])) { if (!$this->csrfToken->validate($form_state->getValue('form_token'), $form['#token']) || $form_state->hasInvalidToken()) { - $url = $this->requestStack->getCurrentRequest()->getRequestUri(); - - // Setting this error will cause the form to fail validation. - $form_state->setErrorByName('form_token', $this->t('The form has become outdated. Copy any unsaved work in the form below and then reload this page.', array('@link' => $url))); + $this->setInvalidTokenError($form_state); // Stop here and don't run any further validation handlers, because they // could invoke non-safe operations which opens the door for CSRF @@ -130,6 +127,16 @@ public function validateForm($form_id, &$form, FormStateInterface &$form_state) } /** + * {@inheritdoc} + */ + public function setInvalidTokenError(FormStateInterface $form_state) { + $url = $this->requestStack->getCurrentRequest()->getRequestUri(); + + // Setting this error will cause the form to fail validation. + $form_state->setErrorByName('form_token', $this->t('The form has become outdated. Copy any unsaved work in the form below and then reload this page.', array('@link' => $url))); + } + + /** * Handles validation errors for forms with limited validation. * * If validation errors are limited then remove any non validated form values, diff --git a/core/lib/Drupal/Core/Form/FormValidatorInterface.php b/core/lib/Drupal/Core/Form/FormValidatorInterface.php index 6f1cc52..d2c8945 100644 --- a/core/lib/Drupal/Core/Form/FormValidatorInterface.php +++ b/core/lib/Drupal/Core/Form/FormValidatorInterface.php @@ -54,4 +54,14 @@ public function executeValidateHandlers(&$form, FormStateInterface &$form_state) */ public function validateForm($form_id, &$form, FormStateInterface &$form_state); + /** + * Sets a form_token error on the given form state. + * + * @param \Drupal\Core\Form\FormStateInterface $form_state + * The current state of the form. + * + * @return $this + */ + public function setInvalidTokenError(FormStateInterface $form_state); + }