How do I add an XID hash to an old addon?

Question

I'm using an older EE2 addon that doesn't appear to have support for secure forms. Does anyone know how to add the hidden XID hash field to the form via the addon code?

I guess I'm really looking to see if there's a code snippet that would just create the hash itself that I can add within the addon file.

UPDATE: After looking more closely at the addon code, it's using the form helper so what I need is something like:

form_hidden('XID', 'xid outputted value')

which would generate the following:

<input type="hidden" name="XID" value="the xid hash">

Cheers

Jim

Answer 1

EE Docs. Also details Ajax handling of XID.

As Bhashkar stated:

$this->EE->functions->form_declaration($data);

Or the new method:

ee()->functions->form_declaration($data);

"so the XID (secure hash ID) is added automatically as a hidden input field."

As part fo the $data array sent you can force secure by adding it:

$data['secure'] = TRUE;

Example of complete code:

$formDetails = array('action'     => '',
              'name'           => 'filtered_listing',
              'id'             => $this->EE->TMPL->form_id,
              'class'          => $this->EE->TMPL->form_class,
              'hidden_fields'  => array('ACT' => $actionID,
                                        'RET' => $_SERVER["REQUEST_URI"]),
              'secure'         => TRUE
);
$header = $this->EE->functions->form_declaration($formDetails);

If you're checking the receipt of the form and need to validate the XID...

//###   Check Security Hash   ###
if ($this->EE->security->secure_forms_check($this->EE->input->post('XID')) == FALSE) {
    //###   Deny Form submission if a hash isn't found or is too old
    $this->EE->functions->redirect(stripslashes($this->EE->input->get_post('RET', false)));
}

Update based on Form Helper example code

Try Outputting {XID_SECURE_HASH} Reference

form_hidden('XID', '{XID_SECURE_HASH}')

Failing that:

form_hidden('XID', $this->EE->functions->add_form_security_hash('{XID_HASH}'));

Ref: Rob Sanchez

Form Helper Documentation

Answer 2

I think, the addon may be generating the form with the following code:

$hidden_fields = array(
    'ACT'       => 'ACTION ID',
    'RET'       => 'RETURN URL'
);

$data = array(
    'action'        => 'FORM ACTION',
    'hidden_fields' => $hidden_fields,
    'id'            => 'FORM ID',
);

$tagdata = $this->EE->TMPL->tagdata;
$form  = $this->EE->functions->form_declaration($data);
$form .= stripslashes($tagdata);
$form .= "</form>";

which automatically generates XID as form's hidden field.

If above doesn't help, can you share the addon's code which is creating form.

Answer 3

If you just create a hidden input field name XID and use the EE Tag {XID_HASH} I think it'll generate the value for you.

<input type="hidden" name="XID" value="{XID_HASH}" />