jForms: issue with refcount and CSRF token

[michelma]

jForms::create($selector[, $id])

When creating form using an $id as a string, we should not get refCount >= 1. Line 63, jForms.class.php :

self::DEFAULT_ID = 0;
...
...
if ($formId == self::DEFAULT_ID) {
    $dc->refcount = 1;
}

This condition is always true when using a string because of type comparison and conversion in PHP ​https://bugs.php.net/bug.php?id=54625&edit=1

Don't know if this was intentionnal for jForms. If not we should use "===" operator.

[foxmask]

Hi,

If you could submit a pull request on github of your patch it will be very usefull and welcome :)

Thanks.

[laurentj]

Comment from Michel on the pull request:

In fact refcount is not the problem, it is just a part of. When creating a form with a string as an Id, we always got refCount == 1, and the behavior makes that the CSRF token stay unchanged. When using an integer, refCount == 0 then the token changes every time the form is get. But i just discovered that the new token must be generated in jFormsBuilder. I wanted to not generate a new one to allow user to have multiple tab and keep the form working.

[laurentj]

I fixed the issue with the token generated every time.

​https://github.com/jelix/jelix/commit/4ea644db179e94eb7cf677282b4b3f55887d12cf

[laurentj]

Fixed also the difference in behavior, between numerical id and non numerical ids.

​https://github.com/jelix/jelix/commit/eb8df7b9f82e3e21b69e344fc5d7ff84ffd8b7b0