core/lib/Drupal/Core/Form/FormBuilder.php | 4 ++-- core/modules/system/src/Tests/Form/FormTest.php | 4 ++-- .../system/tests/modules/form_test/src/Form/FormTestGetForm.php | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/core/lib/Drupal/Core/Form/FormBuilder.php b/core/lib/Drupal/Core/Form/FormBuilder.php index 6b20bf1..fb6ecc0 100644 --- a/core/lib/Drupal/Core/Form/FormBuilder.php +++ b/core/lib/Drupal/Core/Form/FormBuilder.php @@ -679,9 +679,9 @@ public function prepareForm($form_id, &$form, FormStateInterface &$form_state) { $form['#method'] = 'get'; } - // GET forms should not use a CSRF token.. + // GET forms should not use a CSRF token. if (isset($form['#method']) && $form['#method'] === 'get') { - // Merges in a default, this means if you've explicitly have set #token to + // Merges in a default, this means if you've explicitly set #token to the // the $form_id on a GET form, which we don't recommend, it will work. $form += [ '#token' => FALSE, diff --git a/core/modules/system/src/Tests/Form/FormTest.php b/core/modules/system/src/Tests/Form/FormTest.php index 4da70a9..3ce775d 100644 --- a/core/modules/system/src/Tests/Form/FormTest.php +++ b/core/modules/system/src/Tests/Form/FormTest.php @@ -295,9 +295,9 @@ public function testInputWithInvalidToken() { } /** - * CSRF Tokens for GET forms should not be added. + * CSRF tokens for GET forms should not be added by default. */ - public function testGetFormsPreventCsrfToken() { + public function testGetFormsCsrfToken() { // We need to be logged in to have CSRF tokens. $account = $this->createUser(); $this->drupalLogin($account); diff --git a/core/modules/system/tests/modules/form_test/src/Form/FormTestGetForm.php b/core/modules/system/tests/modules/form_test/src/Form/FormTestGetForm.php index e01dabc..9bcb55e 100644 --- a/core/modules/system/tests/modules/form_test/src/Form/FormTestGetForm.php +++ b/core/modules/system/tests/modules/form_test/src/Form/FormTestGetForm.php @@ -11,7 +11,7 @@ use Drupal\Core\Form\FormStateInterface; /** - * Form to test the validation of forms with a disabled CSRF token. + * Form to test whether GET forms have a CSRF token. */ class FormTestGetForm extends FormBase {