HomePhabricator

Detect developer error when constructing forms with absolute URIs

Description

Detect developer error when constructing forms with absolute URIs

Summary: Ref T1921. Ref T4339. If you phabricator_form() with an absolute URI, we silently drop the CSRF tokens. This can be confusing if you meant to specify "/some/path" but ended up specifying "http://this.install.com/some/path". In all current cases that I can think of / am aware of, this indicates an error in the code. Make it more obvious what's happening and how to fix it. The error only fires in developer mode.

Test Plan: Hit this case, also rendered normal forms.

Reviewers: btrahan

Reviewed By: btrahan

CC: aran

Maniphest Tasks: T4339, T1921

Differential Revision: https://secure.phabricator.com/D8044

Details

Provenance
epriestleyAuthored on
epriestleyPushed on Jan 23 2014, 10:03 PM
Reviewer
btrahan
Differential Revision
D8044: Detect developer error when constructing forms with absolute URIs
Parents
rP69ddb0ced631: Issue "anonymous" sessions for logged-out users
Branches
Unknown
Tags
Unknown
Tasks
Restricted Maniphest Task
T4339: Support CSRF for logged-out users

Event Timeline