PEAR QuickForm2 CSRF Protection -

i looking way ensure csrf-protection in quickform2.

i found link it's quickform1.

any ideas how can adapt qf2?

thanks,

ron

after fiddling around came solution.

maybe helps else well:

<?php  /**  * @uses html_quickform  * @desc add automatic csrf mitigation forms incorporating token must matched in session , forcing use of post method  * based on: http://www.zapoyok.info/2010/07/17/csrf-et-quickform-de-pear/  */ require_once "quickform2.php";  class html_quickform2s extends html_quickform2 {     /**      * @property string $_sessiontokenkey name of session variable containing token      */     private $_sessiontokenkey;      /**      * @method __construct      * @desc override method use post , pass on parent constructor. create session key token based on form name.      * @param $id      * @param string $method      * @param mixed $attributes      * @param boolean $tracksubmit      */     public function __construct($id, $method = 'post', $attributes = null, $tracksubmit = true)     {         $this->_sessiontokenkey = "quickform2s_" . md5($id);          parent::__construct($id, $method, $attributes, $tracksubmit);          //a token hasn't been created so         if (!isset($_session[$this->_sessiontokenkey])) {             $_session[$this->_sessiontokenkey] = md5(uniqid(rand(), true) . session_id()); //requires session id known in order add difficulty compromising         }          //hide token @ end of form         $this->addelement("hidden", "qfs_csrf");          $qfscsrf= $this->getelementsbyname('qfs_csrf');         $qfscsrf[0]->setvalue($_session[$this->_sessiontokenkey]);     }      /**      * @method validate      * @desc check if passed token matches session before allowing validation      * @return boolean      */     public function validate()     {         $submitvalues = $this->getvalue();          //the token not passed or not match         if (!isset($submitvalues['qfs_csrf']) || $submitvalues['qfs_csrf'] != $_session[$this->_sessiontokenkey]) {             $this->seterror("anti-csrf token not match");         }          return parent::validate();     }  }