I'm trying to get CSRF in the craft login form. I've added the config setting ('enableCsrfProtection' => true,) and added 'name="{{ craft.config.csrfTokenName }}" value="{{ craft.request.csrfToken }}"' to the login form:
<script type="text/javascript">
var cookieTest = 'CraftCookieTest='+Math.floor(Math.random() * 1000000);
document.cookie = cookieTest;
var cookiesEnabled = document.cookie.search(cookieTest) != -1;
if (cookiesEnabled)
{
document.cookie = cookieTest + '=; expires=Thu, 01 Jan 1970 00:00:01 GMT;';
document.write(
'{%- set hasLogo = (CraftEdition >= CraftClient and craft.rebrand.isLogoUploaded ? true : false) -%}'+
'<form id="login-form" method="post" accept-charset="UTF-8" name="{{ craft.config.csrfTokenName }}" value="{{ craft.request.csrfToken }}" {% if hasLogo -%}
{%- set logo = craft.rebrand.logo -%}
{%- set padding = logo.height + 30 -%}
class="has-logo" style="background-image: url(\'{{ logo.url }}\'); background-size: {{ logo.width }}px {{ logo.height }}px; padding-top: {{ padding }}px; margin-top: -{{ round((353+padding)/2) }}px"
{%- endif %}>' +
'{% if not hasLogo -%}<h1>{{ siteName }}</h1>{%- endif %}'+
'{% set placeHolderText = (craft.config.useEmailAsUsername ? "Email"|t : "Username or Email"|t) %}' +
'{{ forms.textField({ id: "loginName", name: "username", placeholder: placeHolderText, value: username })|e("js") }}' +
'<div id="login-fields" class="nested-fields">' +
'{{ forms.passwordField({ id: "password", name: "password", placeholder: "Password"|t })|e("js") }}' +
'<a id="forgot-password">{{ "Forget your password?"|t }}</a>' +
{% if craft.config.rememberedUserSessionDuration %}
'{{ forms.checkboxField({ id: "rememberMe", label: "Keep me logged in"|t })|e("js") }}' +
{% endif %}
'</div>' +
'<div class="buttons">' +
'{# <div id="ssl-icon" class="disabled"><div class="{{ craft.request.isSecure ? "secure" : "insecure" }} icon"></div></div>#}' +
'<input id="submit" class="btn submit disabled" type="submit" value="{{ "Login"|t }}">' +
'<div id="spinner" class="spinner hidden"></div>' +
'</div>' +
'<a id="poweredby" href="http://craftcms.com/" title="{{ "Powered by Craft CMS"|t }}"><img src="{{ resourceUrl("images/craftcms.svg") }}" /></a>'+
'</form>'
);
{% if not craft.request.isMobileBrowser(true) %}
document.getElementById("{{ (username ? 'password' : 'loginName') }}").focus();
{% endif %}
}
else
{
document.write(
'<div class="no-access">' +
'<div class="pane">' +
'<div class="pane-body">' +
'<div class="notice">' +
'<div class="icon"></div>' +
'<p>{{ "Cookies must be enabled to access the Craft CMS control panel."|t }}<br>' +
'<a class="go nowrap" href="">{{ "See how"|t }}</a>' +
'</p>' +
'</div>' +
'</div>' +
'</div>' +
'</div>'
);
}
</script>
I believe this is all correct, but not sure how this could be tested?
Thanks