3

I'm using an older EE2 addon that doesn't appear to have support for secure forms. Does anyone know how to add the hidden XID hash field to the form via the addon code?

I guess I'm really looking to see if there's a code snippet that would just create the hash itself that I can add within the addon file.

UPDATE: After looking more closely at the addon code, it's using the form helper so what I need is something like:

form_hidden('XID', 'xid outputted value')

which would generate the following:

<input type="hidden" name="XID" value="the xid hash">

Cheers

Jim

1

EE Docs. Also details Ajax handling of XID.

As Bhashkar stated:

$this->EE->functions->form_declaration($data);

Or the new method:

ee()->functions->form_declaration($data);

"so the XID (secure hash ID) is added automatically as a hidden input field."

As part fo the $data array sent you can force secure by adding it:

$data['secure'] = TRUE;

Example of complete code:

$formDetails = array('action'     => '',
              'name'           => 'filtered_listing',
              'id'             => $this->EE->TMPL->form_id,
              'class'          => $this->EE->TMPL->form_class,
              'hidden_fields'  => array('ACT' => $actionID,
                                        'RET' => $_SERVER["REQUEST_URI"]),
              'secure'         => TRUE
);
$header = $this->EE->functions->form_declaration($formDetails);

If you're checking the receipt of the form and need to validate the XID...

//###   Check Security Hash   ###
if ($this->EE->security->secure_forms_check($this->EE->input->post('XID')) == FALSE) {
    //###   Deny Form submission if a hash isn't found or is too old
    $this->EE->functions->redirect(stripslashes($this->EE->input->get_post('RET', false)));
}

Update based on Form Helper example code

Try Outputting {XID_SECURE_HASH} Reference

form_hidden('XID', '{XID_SECURE_HASH}')

Failing that:

form_hidden('XID', $this->EE->functions->add_form_security_hash('{XID_HASH}'));

Ref: Rob Sanchez

Form Helper Documentation

| improve this answer | |
  • Thanks Peter - this is a great answer but unfortunately the addon I'm editing doesn't use this method (see my updated question for details). – Jim Pannell Oct 7 '13 at 11:51
  • Answer updated with add_form_security_hash method – Peter Lewis Oct 7 '13 at 15:40
  • Hi Peter, I can confirm that form_hidden('XID', $this->EE->functions->add_form_security_hash('{XID_HASH}')); worked for me! Thanks so much. – Jim Pannell Oct 7 '13 at 19:27
2

I think, the addon may be generating the form with the following code:

$hidden_fields = array(
    'ACT'       => 'ACTION ID',
    'RET'       => 'RETURN URL'
);

$data = array(
    'action'        => 'FORM ACTION',
    'hidden_fields' => $hidden_fields,
    'id'            => 'FORM ID',
);

$tagdata = $this->EE->TMPL->tagdata;
$form  = $this->EE->functions->form_declaration($data);
$form .= stripslashes($tagdata);
$form .= "</form>";

which automatically generates XID as form's hidden field.

If above doesn't help, can you share the addon's code which is creating form.

| improve this answer | |
  • Thanks Bhashkar. The addon I'm editing is using the form helper rather than the method you've outlined here. It seems I just need some code that will generate a valid xid hash within the addon file. – Jim Pannell Oct 7 '13 at 11:50
1

If you just create a hidden input field name XID and use the EE Tag {XID_HASH} I think it'll generate the value for you.

<input type="hidden" name="XID" value="{XID_HASH}" />
| improve this answer | |
  • That's true, but the code is within an old addon that doesn't use functions->form_declaration($data) (which would create the xid hash automatically). – Jim Pannell Oct 7 '13 at 11:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.