Merge pull request #61 from irineujunior/patch-1

Avoid to pass "_token" value through query string
adamwathan · Oct 10, 2015 · c71f293 · c71f293
2 parents ca96009 + 3ec14ee
commit c71f293
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 1 deletion.
diff --git a/src/AdamWathan/Form/Elements/FormOpen.php b/src/AdamWathan/Form/Elements/FormOpen.php
@@ -16,7 +16,7 @@ public function render()
         $result .= $this->renderAttributes();
         $result .= '>';
 
-        if ($this->hasToken()) {
+        if ($this->hasToken() && ($this->attributes['method'] !== 'GET')) {
             $result .= $this->token->render();
         }
 

diff --git a/tests/FormBuilderTest.php b/tests/FormBuilderTest.php
@@ -381,6 +381,14 @@ public function testTokenIsRenderedAutomaticallyOnOpenIfSet()
 		$this->assertEquals($expected, $result);
 	}
 
+	public function testTokenIsNotRenderedAutomaticallyOnOpenFormWithGetMethodIfSet()
+	{
+		$this->form->setToken('12345');
+		$expected = '<form method="GET" action="">';
+		$result = (string)$this->form->open()->get();
+		$this->assertEquals($expected, $result);
+	}
+
 	public function testSelectMonth()
 	{
 		$expected = '<select name="month"><option value="1">January</option><option value="2">February</option><option value="3">March</option><option value="4">April</option><option value="5">May</option><option value="6">June</option><option value="7">July</option><option value="8">August</option><option value="9">September</option><option value="10">October</option><option value="11">November</option><option value="12">December</option></select>';