diff --git a/Documentation/Global/Form/Index.rst b/Documentation/Global/Form/Index.rst index de86877..c84c0d2 100644 --- a/Documentation/Global/Form/Index.rst +++ b/Documentation/Global/Form/Index.rst @@ -70,13 +70,47 @@ of seeing an empty form. Security in Fluid forms ======================= -Fluid automatically adds a hidden field to forms, including an `__hmac` -value. This value lists all allowed fields. If fields are added or -removed via attacks, Extbase detects the mismatch and blocks submission. - -Form fields can be grouped in an array for efficient processing. The -receiving action maps the data to a model, where validation occurs if -rules are defined. Only valid data is passed to the action and stored in +Fluid automatically adds several hidden field to forms: + +* `__referrer[]` with an array of items `@extension`, `@controller`, + `@action`, `arguments` and `@request`. This holds information about + where the form has been created, so that in case of errors, + redirection to the originating Extbase controller and action + (and extension) is possible. +* `__trustedProperties` (string) holds information about all used properties + of all Extbase domain models that have been utilized within the + related `` context. This is used to ensure only properties + will be evaluated for persistence that have an editable form field + associated with them. + +To prevent tampering with this vital data, the important fields +(`__referrer[arguments]`, `__referrer[@request]`, `__trustedProperties`) +are signed with the private TYPO3 encryption key using an HMAC +hash. + +An example would look like this: + +.. code-block:: html + :caption: Example HTML rendered after Fluid processing + +
+
+ + + + + + +
+
+ +If form fields are added or removed via attacks, Extbase detects the +mismatch and blocks further processing. + +Form fields can be grouped in an array for efficient processing. An +internal Extbase processing action maps the received data to a model, +where (optional and configurable) validation occurs. +Only valid data is passed on to the action and stored in the database. .. _typo3-fluid-form-arguments: