Allow for anonymous users to remove csrf token, remove members_only wiget? [#2750043]

I wanted to remove some token from add to cart forms even for anonymous users and I realised that eventhough anonymous (for now) is the only role configured for authcache, I wasn't able to configure that role to remove form token.

Looking in the code I realised this was somehow by designed, but I wonder if that should be like that or maybe some decision along the way carried away? I want to have the flexibility of doing such a thing, I am not sure why a module like this one should simply not allow it.

Comment	File	Size	Author
#2	authcache-remove_members_only_widget-2750043-2.patch	7.22 KB	hanoii
#2	7.x-2.x: PHP 5.3 & MySQL 5.5, D7 235 pass, 4 fail PHP 5.4 & MySQL 5.5, D7 235 pass, 4 fail PHP 5.5 & MySQL 5.5, D7 235 pass, 4 fail PHP 5.6 & MySQL 5.5, D7 235 pass, 4 fail

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

16 June 2016 at 12:54

hanoii created an issue. See original summary.

Comment #2

hanoii

Spanish

🇦🇷UTC-3

CreditAttribution: hanoii commented 16 June 2016 at 12:56

Status:

Active

» Needs review

File	Size
authcache-remove_members_only_widget-2750043-2.patch	7.22 KB
7.x-2.x: PHP 5.3 & MySQL 5.5, D7 235 pass, 4 fail PHP 5.4 & MySQL 5.5, D7 235 pass, 4 fail PHP 5.5 & MySQL 5.5, D7 235 pass, 4 fail PHP 5.6 & MySQL 5.5, D7 235 pass, 4 fail

After looking at code it seems that the most sensible way is to simply remove the #members_only feature all along. It's only really used within authcache_form and I rather allow for flexibility that something else.

Attached is a patch that removes all of this.

I project-wise searched and it's only used on those places.

Comment #3

16 June 2016 at 13:00

Status:

Needs review

» Needs work

The last submitted patch, 2: authcache-remove_members_only_widget-2750043-2.patch, failed testing.

Comment #4

16 June 2016 at 13:00

The last submitted patch, 2: authcache-remove_members_only_widget-2750043-2.patch, failed testing.

Comment #5

16 June 2016 at 13:00

The last submitted patch, 2: authcache-remove_members_only_widget-2750043-2.patch, failed testing.

Comment #6

16 June 2016 at 13:00

The last submitted patch, 2: authcache-remove_members_only_widget-2750043-2.patch, failed testing.

Comment #7

znerol CreditAttribution: znerol commented 16 June 2016 at 13:06

There should not be any tokens on any forms built for anonymous users. See drupal_prepare_form().

Do you really see form_token added to a form for anonymous users on your site? Hint, do not confuse CSRF tokens with the form_build_id which is required for Ajax forms. The latter is also added for anonymous users.

Comment #8

hanoii

Spanish

🇦🇷UTC-3

CreditAttribution: hanoii commented 16 June 2016 at 13:44

Ah, will investigate further, I assumed as I remember doing something like this while implementing a custom cache solution with nginx. Thanks a lot for the quick reply, will follow up with a few other patches probably. Thanks!