Yii dropzone extention (The CSRF token could not be verified) - php

Question

I want to post Yii csrftoken with dropzone request here is my code
$this->widget('ext.dropzone.EDropzone', array(
'model' => $model,
'attribute' => 'file',
'url' => $this->createUrl('//media/file'),
'mimeTypes' => array('image/jpeg', 'image/png'),
'options' => array('sending' => 'function(file, xhr, formData) {
formData.append("YII_CSRF_TOKEN", "' . Yii::app()->request->csrfToken . '");
}',),
));
//controller > media (it dose not access the controller )
public function actionFile() {
$save_path = Yii::app()->basePath . '/../media/portfolio/';
$save_url = Yii::app()->createAbsoluteUrl('//media/portfolio/');
if (empty($_FILES) === false) {
$file_name = $_FILES['Company'] ['name']['file'];
$fileType = $_FILES['Company']['type']['file'];
$tmp_name = $_FILES['Company']['tmp_name']['file'];
$file_size = $_FILES['Company']['size']['file'];
$temp_arr = explode(".", $file_name);
$file_ext = array_pop($temp_arr);
$file_ext = trim($file_ext);
$file_ext = strtolower($file_ext);
if (!file_exists($save_path))
mkdir($save_path);
$new_file_name = rand(0,1000) . '.' . $file_ext;
$file_path = $save_path . $new_file_name;
move_uploaded_file($tmp_name, $file_path);
}
}

Answer 1

This is how to stop CsrfValidation for some actions
//main/config
Add the following lines under components
'request' => array(
'class' => 'HttpRequest',
'noCsrfValidationRoutes' => array(
'^site/upload.*$',
),
'enableCookieValidation' => true,
'enableCsrfValidation' => true,
),
Then inside the component folder
class HttpRequest extends CHttpRequest
{
public $prev_url;
public $noCsrfValidationRoutes = array();
protected function normalizeRequest()
{
parent::normalizeRequest();
if(!isset($_SERVER['REQUEST_METHOD']) || $_SERVER['REQUEST_METHOD'] != 'POST')
{
return;
}
$route = Yii::app()->getUrlManager()->parseUrl($this);
if($this->enableCsrfValidation)
{
foreach($this->noCsrfValidationRoutes as $cr)
{
if(preg_match('#'.$cr.'#', $route))
{
Yii::app()->detachEventHandler('onBeginRequest', array($this,'validateCsrfToken'));
Yii::trace('Route "'.$route.' passed without CSRF validation');
break; // found first route and break
}
}
}
}
public function getCurrentUri()
{
// Get HTTP/HTTPS (the possible values for this vary from server to server)
$myUrl = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] && !in_array(strtolower($_SERVER['HTTPS']),array('off','no'))) ? 'https' : 'http';
// Get domain portion
$myUrl .= '://'.$_SERVER['HTTP_HOST'];
// Get path to script
$myUrl .= $_SERVER['REQUEST_URI'];
// Add path info, if any
$get = $_GET; // Create a copy of $_GET
if (count($get)) { // Only add a query string if there's anything left
$myUrl .= '?'.http_build_query($get);
}
return $myUrl;
}
}

Answer 2

This is what I found that worked in my search for getting the CSRF tokens to work with the xupload/blueimp jquery file uploader. Put this in the file "EHttpRequest.php" (or create it) in your components directory.
Source: http://www.yiiframework.com/forum/index.php/topic/14500-re-writing-a-class-method-without-editing-framework-files/
<?php
class EHttpRequest extends CHttpRequest
{
public function validateCsrfToken($event)
{
if($this->getIsPostRequest())
{
$cookies=$this->getCookies();
if($cookies->contains($this->csrfTokenName) && isset($_POST[$this->csrfTokenName]) || isset($_GET[$this->csrfTokenName] ))
{
$tokenFromCookie=$cookies->itemAt($this->csrfTokenName)->value;
$tokenFrom=!empty($_POST[$this->csrfTokenName]) ? $_POST[$this->csrfTokenName] : $_GET[$this->csrfTokenName];
$valid=$tokenFromCookie===$tokenFrom;
}
else
$valid=false;
if(!$valid)
throw new CHttpException(400,Yii::t('yii','Lite: The CSRF token could not be verified.'));
}
}
}
?>
Caution: There could be some security risks in doing this, if anyone sees anything wrong with this security-wise, let me know.