php - Codiginter prevent direct access to method used by form action -
i new codeigniter framework, , have encountered issue unsure how solve properly.
most of application requires authentication, have 1 public non authenticated controller form. uri form encoded single use token. form can accessed once.
the code form action...
<?php echo form_open('my_form/submit_form' . $id , 'id=”theform”'); …
i want prevent accessing/visiting http://my-site.com/my_form/submit_form/someid , instead throw message. below way have working now, not sure if secure. using codeigniter's csrf protection, each $_post submitted csrf_token.
class my_form extends mx_controller { … public function submit_form($id){ // attempt prevent direct access if (!isset($_post["input_id"])) { exit('sorry page inaccessible.'); }
}
so if value of hidden input field on form not set script exits. secure way handle this?
try this,
public function submit_form($id){ // attempt prevent direct access if (!$this->input->post(null, false)) { exit('sorry page inaccessible.'); } else { //your code } }
Comments
Post a Comment