fix: ensure csrf token is string by datlechin · Pull Request #9365 · codeigniter4/CodeIgniter4

datlechin · 2025-01-03T03:44:26Z

Description
Make sure the CSRF token must be a string, because hackers can fake the request and pass csrf_main as an array, the system will break 500.

Checklist:

Securely signed commits
Component(s) with PHPDoc blocks, only if necessary or adds value
Unit testing, with >80% coverage
User guide updated
Conforms to style guide

michalsn · 2025-01-03T14:53:01Z

The same check should be made for php:://input data.

neznaika0 · 2025-01-03T16:54:00Z

Look at this:

privatefunctiongetPostedToken(RequestInterface$request): ?string
{
assert($requestinstanceof IncomingRequest);
// Does the token exist in POST, HEADER or optionally php:://input - json data or PUT, DELETE, PATCH - raw data.if ($tokenValue = $request->getPost($this->config->tokenName)) {
returnis_string($tokenValue) ? $tokenValue : null;
}
if ($request->hasHeader($this->config->headerName)
&& $request->header($this->config->headerName)->getValue() !== ''
&& $request->header($this->config->headerName)->getValue() !== []) {
return$request->header($this->config->headerName)->getValue();
}
$body = (string) $request->getBody();
if ($body !== '') {
$json = json_decode($body);
if ($json !== null && json_last_error() === JSON_ERROR_NONE) {
return (isset($json->{$this->config->tokenName}) && is_string($json->{$this->config->tokenName}))
? $json->{$this->config->tokenName}
: null;
}
parse_str($body, $parsed);
return (isset($parsed[$this->config->tokenName]) && is_string($parsed[$this->config->tokenName]))
? $parsed[$this->config->tokenName]
: null;
}
returnnull;
}

michalsn

Thanks! Please also handle the case where the CSRF token comes from the php://input.

Your commits have to be signed:

You can fix the code style with the command:

composer cs-fix

michalsn

Almost there - we also have to check the result of parse_str() function.

And we also need tests for these two scenarios: php://input and parse_str().

michalsn · 2025-01-14T08:08:06Z

@datlechin Please run composer cs-fix.

michalsn

Please add a chengelog entry here: https://github.com/codeigniter4/CodeIgniter4/blob/develop/user_guide_src/source/changelogs/v4.5.8.rst under "Bugs Fixed".

You can see the previous changelogs as a reference.

neznaika0 · 2025-01-14T08:41:42Z

You need to check here too, the array is unnecessary:

if ($request->hasHeader($this->config->headerName)
&& $request->header($this->config->headerName)->getValue() !== ''
&& $request->header($this->config->headerName)->getValue() !== []) {

if ($request->hasHeader($this->config->headerName)
&& is_string($request->header($this->config->headerName)->getValue())
&& $request->header($this->config->headerName)->getValue() !== '') {

['malicious' => 'data'] No offense. You can use common words instead of nicknames?

michalsn · 2025-01-17T10:16:11Z

@datlechin Please run composer cs-fix

Co-authored-by: Michal Sniatala <michal@sniatala.pl>

paulbalandan · 2025-01-18T14:33:54Z

Thank you, @datlechin

datlechin · 2025-01-03T03:44:26Z

Description
Make sure the CSRF token must be a string, because hackers can fake the request and pass csrf_main as an array, the system will break 500.

Checklist:

Securely signed commits
Component(s) with PHPDoc blocks, only if necessary or adds value
Unit testing, with >80% coverage
User guide updated
Conforms to style guide

michalsn · 2025-01-03T14:53:01Z

The same check should be made for php:://input data.

neznaika0 · 2025-01-03T16:54:00Z

Look at this:

privatefunctiongetPostedToken(RequestInterface$request): ?string
{
assert($requestinstanceof IncomingRequest);
// Does the token exist in POST, HEADER or optionally php:://input - json data or PUT, DELETE, PATCH - raw data.if ($tokenValue = $request->getPost($this->config->tokenName)) {
returnis_string($tokenValue) ? $tokenValue : null;
}
if ($request->hasHeader($this->config->headerName)
&& $request->header($this->config->headerName)->getValue() !== ''
&& $request->header($this->config->headerName)->getValue() !== []) {
return$request->header($this->config->headerName)->getValue();
}
$body = (string) $request->getBody();
if ($body !== '') {
$json = json_decode($body);
if ($json !== null && json_last_error() === JSON_ERROR_NONE) {
return (isset($json->{$this->config->tokenName}) && is_string($json->{$this->config->tokenName}))
? $json->{$this->config->tokenName}
: null;
}
parse_str($body, $parsed);
return (isset($parsed[$this->config->tokenName]) && is_string($parsed[$this->config->tokenName]))
? $parsed[$this->config->tokenName]
: null;
}
returnnull;
}

michalsn

Thanks! Please also handle the case where the CSRF token comes from the php://input.

Your commits have to be signed:

You can fix the code style with the command:

composer cs-fix

michalsn

Almost there - we also have to check the result of parse_str() function.

And we also need tests for these two scenarios: php://input and parse_str().

michalsn · 2025-01-14T08:08:06Z

@datlechin Please run composer cs-fix.

michalsn

Please add a chengelog entry here: https://github.com/codeigniter4/CodeIgniter4/blob/develop/user_guide_src/source/changelogs/v4.5.8.rst under "Bugs Fixed".

You can see the previous changelogs as a reference.

neznaika0 · 2025-01-14T08:41:42Z

You need to check here too, the array is unnecessary:

if ($request->hasHeader($this->config->headerName)
&& $request->header($this->config->headerName)->getValue() !== ''
&& $request->header($this->config->headerName)->getValue() !== []) {

if ($request->hasHeader($this->config->headerName)
&& is_string($request->header($this->config->headerName)->getValue())
&& $request->header($this->config->headerName)->getValue() !== '') {

['malicious' => 'data'] No offense. You can use common words instead of nicknames?

michalsn · 2025-01-17T10:16:11Z

@datlechin Please run composer cs-fix

Co-authored-by: Michal Sniatala <michal@sniatala.pl>

paulbalandan · 2025-01-18T14:33:54Z

Thank you, @datlechin

datlechin · 2025-01-03T03:44:26Z

Description
Make sure the CSRF token must be a string, because hackers can fake the request and pass csrf_main as an array, the system will break 500.

Checklist:

Securely signed commits
Component(s) with PHPDoc blocks, only if necessary or adds value
Unit testing, with >80% coverage
User guide updated
Conforms to style guide

michalsn · 2025-01-03T14:53:01Z

The same check should be made for php:://input data.

neznaika0 · 2025-01-03T16:54:00Z

Look at this:

privatefunctiongetPostedToken(RequestInterface$request): ?string
{
assert($requestinstanceof IncomingRequest);
// Does the token exist in POST, HEADER or optionally php:://input - json data or PUT, DELETE, PATCH - raw data.if ($tokenValue = $request->getPost($this->config->tokenName)) {
returnis_string($tokenValue) ? $tokenValue : null;
}
if ($request->hasHeader($this->config->headerName)
&& $request->header($this->config->headerName)->getValue() !== ''
&& $request->header($this->config->headerName)->getValue() !== []) {
return$request->header($this->config->headerName)->getValue();
}
$body = (string) $request->getBody();
if ($body !== '') {
$json = json_decode($body);
if ($json !== null && json_last_error() === JSON_ERROR_NONE) {
return (isset($json->{$this->config->tokenName}) && is_string($json->{$this->config->tokenName}))
? $json->{$this->config->tokenName}
: null;
}
parse_str($body, $parsed);
return (isset($parsed[$this->config->tokenName]) && is_string($parsed[$this->config->tokenName]))
? $parsed[$this->config->tokenName]
: null;
}
returnnull;
}

michalsn

Thanks! Please also handle the case where the CSRF token comes from the php://input.

Your commits have to be signed:

You can fix the code style with the command:

composer cs-fix

michalsn

Almost there - we also have to check the result of parse_str() function.

And we also need tests for these two scenarios: php://input and parse_str().

michalsn · 2025-01-14T08:08:06Z

@datlechin Please run composer cs-fix.

michalsn

Please add a chengelog entry here: https://github.com/codeigniter4/CodeIgniter4/blob/develop/user_guide_src/source/changelogs/v4.5.8.rst under "Bugs Fixed".

You can see the previous changelogs as a reference.

neznaika0 · 2025-01-14T08:41:42Z

You need to check here too, the array is unnecessary:

if ($request->hasHeader($this->config->headerName)
&& $request->header($this->config->headerName)->getValue() !== ''
&& $request->header($this->config->headerName)->getValue() !== []) {

if ($request->hasHeader($this->config->headerName)
&& is_string($request->header($this->config->headerName)->getValue())
&& $request->header($this->config->headerName)->getValue() !== '') {

['malicious' => 'data'] No offense. You can use common words instead of nicknames?

michalsn · 2025-01-17T10:16:11Z

@datlechin Please run composer cs-fix

Co-authored-by: Michal Sniatala <michal@sniatala.pl>

paulbalandan · 2025-01-18T14:33:54Z

Thank you, @datlechin

datlechin · 2025-01-03T03:44:26Z

Description
Make sure the CSRF token must be a string, because hackers can fake the request and pass csrf_main as an array, the system will break 500.

Checklist:

Securely signed commits
Component(s) with PHPDoc blocks, only if necessary or adds value
Unit testing, with >80% coverage
User guide updated
Conforms to style guide

michalsn · 2025-01-03T14:53:01Z

The same check should be made for php:://input data.

neznaika0 · 2025-01-03T16:54:00Z

Look at this:

privatefunctiongetPostedToken(RequestInterface$request): ?string
{
assert($requestinstanceof IncomingRequest);
// Does the token exist in POST, HEADER or optionally php:://input - json data or PUT, DELETE, PATCH - raw data.if ($tokenValue = $request->getPost($this->config->tokenName)) {
returnis_string($tokenValue) ? $tokenValue : null;
}
if ($request->hasHeader($this->config->headerName)
&& $request->header($this->config->headerName)->getValue() !== ''
&& $request->header($this->config->headerName)->getValue() !== []) {
return$request->header($this->config->headerName)->getValue();
}
$body = (string) $request->getBody();
if ($body !== '') {
$json = json_decode($body);
if ($json !== null && json_last_error() === JSON_ERROR_NONE) {
return (isset($json->{$this->config->tokenName}) && is_string($json->{$this->config->tokenName}))
? $json->{$this->config->tokenName}
: null;
}
parse_str($body, $parsed);
return (isset($parsed[$this->config->tokenName]) && is_string($parsed[$this->config->tokenName]))
? $parsed[$this->config->tokenName]
: null;
}
returnnull;
}

michalsn

Thanks! Please also handle the case where the CSRF token comes from the php://input.

Your commits have to be signed:

You can fix the code style with the command:

composer cs-fix

michalsn

Almost there - we also have to check the result of parse_str() function.

And we also need tests for these two scenarios: php://input and parse_str().

michalsn · 2025-01-14T08:08:06Z

@datlechin Please run composer cs-fix.

michalsn

Please add a chengelog entry here: https://github.com/codeigniter4/CodeIgniter4/blob/develop/user_guide_src/source/changelogs/v4.5.8.rst under "Bugs Fixed".

You can see the previous changelogs as a reference.

neznaika0 · 2025-01-14T08:41:42Z

You need to check here too, the array is unnecessary:

if ($request->hasHeader($this->config->headerName)
&& $request->header($this->config->headerName)->getValue() !== ''
&& $request->header($this->config->headerName)->getValue() !== []) {

if ($request->hasHeader($this->config->headerName)
&& is_string($request->header($this->config->headerName)->getValue())
&& $request->header($this->config->headerName)->getValue() !== '') {

['malicious' => 'data'] No offense. You can use common words instead of nicknames?

michalsn · 2025-01-17T10:16:11Z

@datlechin Please run composer cs-fix

Co-authored-by: Michal Sniatala <michal@sniatala.pl>

paulbalandan · 2025-01-18T14:33:54Z

Thank you, @datlechin

datlechin · 2025-01-03T03:44:26Z

Description
Make sure the CSRF token must be a string, because hackers can fake the request and pass csrf_main as an array, the system will break 500.

Checklist:

Securely signed commits
Component(s) with PHPDoc blocks, only if necessary or adds value
Unit testing, with >80% coverage
User guide updated
Conforms to style guide

michalsn · 2025-01-03T14:53:01Z

The same check should be made for php:://input data.

neznaika0 · 2025-01-03T16:54:00Z

Look at this:

privatefunctiongetPostedToken(RequestInterface$request): ?string
{
assert($requestinstanceof IncomingRequest);
// Does the token exist in POST, HEADER or optionally php:://input - json data or PUT, DELETE, PATCH - raw data.if ($tokenValue = $request->getPost($this->config->tokenName)) {
returnis_string($tokenValue) ? $tokenValue : null;
}
if ($request->hasHeader($this->config->headerName)
&& $request->header($this->config->headerName)->getValue() !== ''
&& $request->header($this->config->headerName)->getValue() !== []) {
return$request->header($this->config->headerName)->getValue();
}
$body = (string) $request->getBody();
if ($body !== '') {
$json = json_decode($body);
if ($json !== null && json_last_error() === JSON_ERROR_NONE) {
return (isset($json->{$this->config->tokenName}) && is_string($json->{$this->config->tokenName}))
? $json->{$this->config->tokenName}
: null;
}
parse_str($body, $parsed);
return (isset($parsed[$this->config->tokenName]) && is_string($parsed[$this->config->tokenName]))
? $parsed[$this->config->tokenName]
: null;
}
returnnull;
}

michalsn

Thanks! Please also handle the case where the CSRF token comes from the php://input.

Your commits have to be signed:

You can fix the code style with the command:

composer cs-fix

michalsn

Almost there - we also have to check the result of parse_str() function.

And we also need tests for these two scenarios: php://input and parse_str().

michalsn · 2025-01-14T08:08:06Z

@datlechin Please run composer cs-fix.

michalsn

Please add a chengelog entry here: https://github.com/codeigniter4/CodeIgniter4/blob/develop/user_guide_src/source/changelogs/v4.5.8.rst under "Bugs Fixed".

You can see the previous changelogs as a reference.

neznaika0 · 2025-01-14T08:41:42Z

You need to check here too, the array is unnecessary:

if ($request->hasHeader($this->config->headerName)
&& $request->header($this->config->headerName)->getValue() !== ''
&& $request->header($this->config->headerName)->getValue() !== []) {

if ($request->hasHeader($this->config->headerName)
&& is_string($request->header($this->config->headerName)->getValue())
&& $request->header($this->config->headerName)->getValue() !== '') {

['malicious' => 'data'] No offense. You can use common words instead of nicknames?

michalsn · 2025-01-17T10:16:11Z

@datlechin Please run composer cs-fix

Co-authored-by: Michal Sniatala <michal@sniatala.pl>

paulbalandan · 2025-01-18T14:33:54Z

Thank you, @datlechin

datlechin · 2025-01-03T03:44:26Z

Description
Make sure the CSRF token must be a string, because hackers can fake the request and pass csrf_main as an array, the system will break 500.

Checklist:

Securely signed commits
Component(s) with PHPDoc blocks, only if necessary or adds value
Unit testing, with >80% coverage
User guide updated
Conforms to style guide

michalsn · 2025-01-03T14:53:01Z

The same check should be made for php:://input data.

neznaika0 · 2025-01-03T16:54:00Z

Look at this:

privatefunctiongetPostedToken(RequestInterface$request): ?string
{
assert($requestinstanceof IncomingRequest);
// Does the token exist in POST, HEADER or optionally php:://input - json data or PUT, DELETE, PATCH - raw data.if ($tokenValue = $request->getPost($this->config->tokenName)) {
returnis_string($tokenValue) ? $tokenValue : null;
}
if ($request->hasHeader($this->config->headerName)
&& $request->header($this->config->headerName)->getValue() !== ''
&& $request->header($this->config->headerName)->getValue() !== []) {
return$request->header($this->config->headerName)->getValue();
}
$body = (string) $request->getBody();
if ($body !== '') {
$json = json_decode($body);
if ($json !== null && json_last_error() === JSON_ERROR_NONE) {
return (isset($json->{$this->config->tokenName}) && is_string($json->{$this->config->tokenName}))
? $json->{$this->config->tokenName}
: null;
}
parse_str($body, $parsed);
return (isset($parsed[$this->config->tokenName]) && is_string($parsed[$this->config->tokenName]))
? $parsed[$this->config->tokenName]
: null;
}
returnnull;
}

michalsn

Thanks! Please also handle the case where the CSRF token comes from the php://input.

Your commits have to be signed:

You can fix the code style with the command:

composer cs-fix

michalsn

Almost there - we also have to check the result of parse_str() function.

And we also need tests for these two scenarios: php://input and parse_str().

michalsn · 2025-01-14T08:08:06Z

@datlechin Please run composer cs-fix.

michalsn

Please add a chengelog entry here: https://github.com/codeigniter4/CodeIgniter4/blob/develop/user_guide_src/source/changelogs/v4.5.8.rst under "Bugs Fixed".

You can see the previous changelogs as a reference.

neznaika0 · 2025-01-14T08:41:42Z

You need to check here too, the array is unnecessary:

if ($request->hasHeader($this->config->headerName)
&& $request->header($this->config->headerName)->getValue() !== ''
&& $request->header($this->config->headerName)->getValue() !== []) {

if ($request->hasHeader($this->config->headerName)
&& is_string($request->header($this->config->headerName)->getValue())
&& $request->header($this->config->headerName)->getValue() !== '') {

['malicious' => 'data'] No offense. You can use common words instead of nicknames?

michalsn · 2025-01-17T10:16:11Z

@datlechin Please run composer cs-fix

Co-authored-by: Michal Sniatala <michal@sniatala.pl>

paulbalandan · 2025-01-18T14:33:54Z

Thank you, @datlechin

datlechin · 2025-01-03T03:44:26Z

Description
Make sure the CSRF token must be a string, because hackers can fake the request and pass csrf_main as an array, the system will break 500.

Checklist:

Securely signed commits
Component(s) with PHPDoc blocks, only if necessary or adds value
Unit testing, with >80% coverage
User guide updated
Conforms to style guide

michalsn · 2025-01-03T14:53:01Z

The same check should be made for php:://input data.

neznaika0 · 2025-01-03T16:54:00Z

Look at this:

privatefunctiongetPostedToken(RequestInterface$request): ?string
{
assert($requestinstanceof IncomingRequest);
// Does the token exist in POST, HEADER or optionally php:://input - json data or PUT, DELETE, PATCH - raw data.if ($tokenValue = $request->getPost($this->config->tokenName)) {
returnis_string($tokenValue) ? $tokenValue : null;
}
if ($request->hasHeader($this->config->headerName)
&& $request->header($this->config->headerName)->getValue() !== ''
&& $request->header($this->config->headerName)->getValue() !== []) {
return$request->header($this->config->headerName)->getValue();
}
$body = (string) $request->getBody();
if ($body !== '') {
$json = json_decode($body);
if ($json !== null && json_last_error() === JSON_ERROR_NONE) {
return (isset($json->{$this->config->tokenName}) && is_string($json->{$this->config->tokenName}))
? $json->{$this->config->tokenName}
: null;
}
parse_str($body, $parsed);
return (isset($parsed[$this->config->tokenName]) && is_string($parsed[$this->config->tokenName]))
? $parsed[$this->config->tokenName]
: null;
}
returnnull;
}

michalsn

Thanks! Please also handle the case where the CSRF token comes from the php://input.

Your commits have to be signed:

You can fix the code style with the command:

composer cs-fix

michalsn

Almost there - we also have to check the result of parse_str() function.

And we also need tests for these two scenarios: php://input and parse_str().

michalsn · 2025-01-14T08:08:06Z

@datlechin Please run composer cs-fix.

michalsn

Please add a chengelog entry here: https://github.com/codeigniter4/CodeIgniter4/blob/develop/user_guide_src/source/changelogs/v4.5.8.rst under "Bugs Fixed".

You can see the previous changelogs as a reference.

neznaika0 · 2025-01-14T08:41:42Z

You need to check here too, the array is unnecessary:

if ($request->hasHeader($this->config->headerName)
&& $request->header($this->config->headerName)->getValue() !== ''
&& $request->header($this->config->headerName)->getValue() !== []) {

if ($request->hasHeader($this->config->headerName)
&& is_string($request->header($this->config->headerName)->getValue())
&& $request->header($this->config->headerName)->getValue() !== '') {

['malicious' => 'data'] No offense. You can use common words instead of nicknames?

michalsn · 2025-01-17T10:16:11Z

@datlechin Please run composer cs-fix

Co-authored-by: Michal Sniatala <michal@sniatala.pl>

paulbalandan · 2025-01-18T14:33:54Z

Thank you, @datlechin

datlechin · 2025-01-03T03:44:26Z

Description
Make sure the CSRF token must be a string, because hackers can fake the request and pass csrf_main as an array, the system will break 500.

Checklist:

Securely signed commits
Component(s) with PHPDoc blocks, only if necessary or adds value
Unit testing, with >80% coverage
User guide updated
Conforms to style guide

michalsn · 2025-01-03T14:53:01Z

The same check should be made for php:://input data.

neznaika0 · 2025-01-03T16:54:00Z

Look at this:

privatefunctiongetPostedToken(RequestInterface$request): ?string
{
assert($requestinstanceof IncomingRequest);
// Does the token exist in POST, HEADER or optionally php:://input - json data or PUT, DELETE, PATCH - raw data.if ($tokenValue = $request->getPost($this->config->tokenName)) {
returnis_string($tokenValue) ? $tokenValue : null;
}
if ($request->hasHeader($this->config->headerName)
&& $request->header($this->config->headerName)->getValue() !== ''
&& $request->header($this->config->headerName)->getValue() !== []) {
return$request->header($this->config->headerName)->getValue();
}
$body = (string) $request->getBody();
if ($body !== '') {
$json = json_decode($body);
if ($json !== null && json_last_error() === JSON_ERROR_NONE) {
return (isset($json->{$this->config->tokenName}) && is_string($json->{$this->config->tokenName}))
? $json->{$this->config->tokenName}
: null;
}
parse_str($body, $parsed);
return (isset($parsed[$this->config->tokenName]) && is_string($parsed[$this->config->tokenName]))
? $parsed[$this->config->tokenName]
: null;
}
returnnull;
}

michalsn

Thanks! Please also handle the case where the CSRF token comes from the php://input.

Your commits have to be signed:

You can fix the code style with the command:

composer cs-fix

michalsn

Almost there - we also have to check the result of parse_str() function.

And we also need tests for these two scenarios: php://input and parse_str().

michalsn · 2025-01-14T08:08:06Z

@datlechin Please run composer cs-fix.

michalsn

Please add a chengelog entry here: https://github.com/codeigniter4/CodeIgniter4/blob/develop/user_guide_src/source/changelogs/v4.5.8.rst under "Bugs Fixed".

You can see the previous changelogs as a reference.

neznaika0 · 2025-01-14T08:41:42Z

You need to check here too, the array is unnecessary:

if ($request->hasHeader($this->config->headerName)
&& $request->header($this->config->headerName)->getValue() !== ''
&& $request->header($this->config->headerName)->getValue() !== []) {

if ($request->hasHeader($this->config->headerName)
&& is_string($request->header($this->config->headerName)->getValue())
&& $request->header($this->config->headerName)->getValue() !== '') {

['malicious' => 'data'] No offense. You can use common words instead of nicknames?

michalsn · 2025-01-17T10:16:11Z

@datlechin Please run composer cs-fix

Co-authored-by: Michal Sniatala <michal@sniatala.pl>

paulbalandan · 2025-01-18T14:33:54Z

Thank you, @datlechin

kenjis added the tests needed Pull requests that need tests label Jan 3, 2025

michalsn added bug Verified issues on the current code behavior or pull requests that will fix them GPG-Signing needed Pull requests that need GPG-Signing and removed tests needed Pull requests that need tests labels Jan 4, 2025

michalsn requested changes Jan 4, 2025
View reviewed changes

paulbalandan reviewed Jan 8, 2025
View reviewed changes

Comment threadtests/system/Security/SecurityTest.php Outdated

datlechin requested review from michalsn and paulbalandan January 14, 2025 07:33

michalsn reviewed Jan 14, 2025
View reviewed changes

michalsn removed the GPG-Signing needed Pull requests that need GPG-Signing label Jan 14, 2025

datlechin requested a review from michalsn January 14, 2025 07:59

michalsn requested changes Jan 14, 2025
View reviewed changes

datlechin requested a review from michalsn January 15, 2025 04:16

michalsn requested changes Jan 17, 2025
View reviewed changes

Comment threadsystem/Security/Security.php Outdated
Comment threaduser_guide_src/source/changelogs/v4.5.8.rst Outdated

datlechin requested a review from michalsn January 17, 2025 09:46

paulbalandan reviewed Jan 18, 2025
View reviewed changes

Comment threadtests/system/Security/SecurityTest.php Outdated
Comment threaduser_guide_src/source/changelogs/v4.5.8.rst Outdated

datlechinand others added 9 commits January 18, 2025 22:03

fix: ensure csrf token is string
91ba332

fix: ensure csrf token is string
9694783

handle request php://input
c3afea6

handle request php://input
4b4c8bc

wip
e62db7a

wip
d9d94e5

wip
8617878

wip
333c734
Co-authored-by: Michal Sniatala <michal@sniatala.pl>

wip
dc4c641
Co-authored-by: Michal Sniatala <michal@sniatala.pl>

paulbalandan added 2 commits January 18, 2025 22:03

Update user_guide_src/source/changelogs/v4.5.8.rst
9d24d4b

Use data providers
d11d76a

paulbalandan approved these changes Jan 18, 2025
View reviewed changes

paulbalandan requested review from michalsn and removed request for michalsn January 18, 2025 14:23

michalsn approved these changes Jan 18, 2025
View reviewed changes

paulbalandan merged commit 97a6d66 into codeigniter4:developJan 18, 2025

datlechin deleted the fix-csrf-token branch January 18, 2025 17:54