CsrfProtection: auto-starts session before form is rendered [Closes #239]

Author: dg

src/Forms/Controls/CsrfProtection.php

@@ -20,7 +20,7 @@ class CsrfProtection extends HiddenField
 {
 	public const PROTECTION = 'Nette\Forms\Controls\CsrfProtection::validateCsrf';
 
-	/** @var Nette\Http\Session */
+	/** @var Nette\Http\Session|null */
 	public $session;
 
 
@@ -37,6 +37,14 @@ public function __construct($errorMessage)
 		$this->monitor(Presenter::class, function (Presenter $presenter): void {
 			if (!$this->session) {
 				$this->session = $presenter->getSession();
+				$this->session->start();
+			}
+		});
+
+		$this->monitor(Nette\Forms\Form::class, function (Nette\Forms\Form $form): void {
+			if (!$this->session && !$form instanceof Nette\Application\UI\Form) {
+				$this->session = new Nette\Http\Session($form->httpRequest, new Nette\Http\Response);
+				$this->session->start();
 			}
 		});
 	}
@@ -60,11 +68,14 @@ public function loadHttpData(): void
 
 	public function getToken(): string
 	{
-		$session = $this->getSession()->getSection(__CLASS__);
+		if (!$this->session) {
+			throw new Nette\InvalidStateException('Session initialization error');
+		}
+		$session = $this->session->getSection(__CLASS__);
 		if (!isset($session->token)) {
 			$session->token = Nette\Utils\Random::generate();
 		}
-		return $session->token ^ $this->getSession()->getId();
+		return $session->token ^ $this->session->getId();
 	}
 
 
@@ -89,16 +100,4 @@ public static function validateCsrf(self $control): bool
 		$value = (string) $control->getValue();
 		return $control->generateToken(substr($value, 0, 10)) === $value;
 	}
-
-
-	/********************* backend ****************d*g**/
-
-
-	private function getSession(): Nette\Http\Session
-	{
-		if (!$this->session) {
-			$this->session = new Nette\Http\Session($this->getForm()->httpRequest, new Nette\Http\Response);
-		}
-		return $this->session;
-	}
 }

src/Forms/Form.php

@@ -93,7 +93,7 @@ class Form extends Container implements Nette\Utils\IHtmlString
 	/** @var callable[]&(callable(Form): void)[]; Occurs before the form is rendered */
 	public $onRender;
 
-	/** @var Nette\Http\IRequest  used only by standalone form */
+	/** @internal @var Nette\Http\IRequest  used only by standalone form */
 	public $httpRequest;
 
 	/** @var mixed or null meaning: not detected yet */