Inserts hidden field with CSRF-prevention-token into POST forms
333642
protected function alter_form_tag($matches)
    {
        $out    = $matches[0];
        $attrib = html::parse_attrib_string($matches[1]);

        if (strtolower($attrib['method']) == 'post') {
            $hidden = new html_hiddenfield(array('name' => '_token', 'value' => $this->app->get_request_token()));
            $out .= "\n" . $hidden->show();
        }

        return $out;
    }
266032
private function _csrf_validate()
    {

        // if CSRF protection is enabled (is not boolean FALSE)
        if ($this->form_properties['csrf_storage_method'] !== false) {

            // reference to the form submission method
            global ${'_' . $this->form_properties['method']};

            $method = & ${'_' . $this->form_properties['method']};

            // if
            if (

                // the hidden field with the CSRF token was submitted
                isset($method[$this->form_properties['csrf_token_name']]) && (

                    // CSRF token is stored in a session variable
                    ($this->form_properties['csrf_storage_method'] == 'session' &&
                    // the session variable exists
                    isset($_SESSION[$this->form_properties['csrf_cookie_name']]) &&
                    // the session variable holds an array
                    is_array($_SESSION[$this->form_properties['csrf_cookie_name']]) &&
                    // the array has 2 entries
                    count($_SESSION[$this->form_properties['csrf_cookie_name']]) == 2 &&
                    // the value of the hidden field and the value in the session match
                    $method[$this->form_properties['csrf_token_name']] == $_SESSION[$this->form_properties['csrf_cookie_name']][0] &&
                    // if CSRF token doesn't expire or it does but it didn't yet
                    ($_SESSION[$this->form_properties['csrf_cookie_name']][1] == 0 || $_SESSION[$this->form_properties['csrf_cookie_name']][1] > time()))

                    ||

                    // CSRF token is stored in a cookie
                    ($this->form_properties['csrf_storage_method'] == 'cookie' &&
                    // the cookie exists
                    isset($_COOKIE[$this->form_properties['csrf_cookie_name']]) &&
                    // the value of the hidden field and the value in the cookie match
                    $method[$this->form_properties['csrf_token_name']] == $_COOKIE[$this->form_properties['csrf_cookie_name']])

                )

            // everything seems in order, then
            ) return true;

            // if we get here something was fishy...
            return false;

        }

        // if protection against CSRF attacks is not enabled, pretend nothing happened
        return true;

    }
1270164
public static function getHtmlInputHidden(): string
    {
        static::init();

        if (($parameterName = static::getParameterName()) !== null) {
            $csrfValue = static::getStoredToken()->getToken();
            return sprintf('<input type="hidden" name="%s" value="%s"/>', $parameterName, $csrfValue);
        } else {
            return '';
        }
    }
1259213
def payu_hidden_fields(transaction)
      html = ""

      %w(pos_id pos_auth_key pay_type session_id amount amount_netto desc
      order_id desc2 trsDesc first_name last_name street street_hn
      street_an city post_code country email phone language client_ip
      js payback_login sig ts
      ).each do |field|
        value = transaction.send(field)
        html << hidden_field_tag(field, value) unless value.blank?
      end

      html.html_safe
    end
667432
def csrf_protect(f):
    """"""

    @wraps(f)
    def wrapper(*args, **kwargs):
        token = session.get("csrf_token", None)
        if token is None or token != request.environ.get("HTTP_X_CSRFTOKEN"):
            logger.warning("Received invalid csrf token. Aborting")
            abort(403)
        # call original request handler
        return f(*args, **kwargs)

    return wrapper
584281
private void encodeHiddenInputs(final ResponseWriter responseWriter, final Sheet sheet, final String clientId)
                throws IOException {
        responseWriter.startElement("input", null);
        responseWriter.writeAttribute("id", clientId + "_input", "id");
        responseWriter.writeAttribute("name", clientId + "_input", "name");
        responseWriter.writeAttribute("type", "hidden", null);
        responseWriter.writeAttribute("value", "", null);
        responseWriter.endElement("input");

        responseWriter.startElement("input", null);
        responseWriter.writeAttribute("id", clientId + "_focus", "id");
        responseWriter.writeAttribute("name", clientId + "_focus", "name");
        responseWriter.writeAttribute("type", "hidden", null);
        if (sheet.getFocusId() == null) {
            responseWriter.writeAttribute("value", "", null);
        }
        else {
            responseWriter.writeAttribute("value", sheet.getFocusId(), null);
        }
        responseWriter.endElement("input");

        responseWriter.startElement("input", null);
        responseWriter.writeAttribute("id", clientId + "_selection", "id");
        responseWriter.writeAttribute("name", clientId + "_selection", "name");
        responseWriter.writeAttribute("type", "hidden", null);
        if (sheet.getSelection() == null) {
            responseWriter.writeAttribute("value", "", null);
        }
        else {
            responseWriter.writeAttribute("value", sheet.getSelection(), null);
        }
        responseWriter.endElement("input");

        // sort col and order if specified and supported
        final int sortCol = sheet.getSortColRenderIndex();
        responseWriter.startElement("input", null);
        responseWriter.writeAttribute("id", clientId + "_sortby", "id");
        responseWriter.writeAttribute("name", clientId + "_sortby", "name");
        responseWriter.writeAttribute("type", "hidden", null);
        responseWriter.writeAttribute("value", sortCol, null);
        responseWriter.endElement("input");

        responseWriter.startElement("input", null);
        responseWriter.writeAttribute("id", clientId + "_sortorder", "id");
        responseWriter.writeAttribute("name", clientId + "_sortorder", "name");
        responseWriter.writeAttribute("type", "hidden", null);
        responseWriter.writeAttribute("value", sheet.getSortOrder().toLowerCase(), null);
        responseWriter.endElement("input");
    }
1185863
function noncifyTag({ name, block: { nodes } }) {
      if (name === 'form' && csrfInputValueExpression) {
        nodes.unshift({
          type: 'Conditional',
          test: csrfInputValueExpression,
          consequent: {
            type: 'Block',
            nodes: [
              {
                type: 'Tag',
                name: 'input',
                selfClosing: false,
                block: {
                  type: 'Block',
                  nodes: [],
                },
                attrs: [
                  {
                    name: 'name',
                    val: stringify(csrfInputName),
                    mustEscape: true,
                  },
                  {
                    name: 'type',
                    val: '\'hidden\'',
                    mustEscape: true,
                  },
                  {
                    name: 'value',
                    val: csrfInputValueExpression,
                    mustEscape: true,
                  },
                ],
                attributeBlocks: [],
                isInline: false,
              },
            ],
          },
          alternate: null,
        });
      }
    }
900575
function() {
      this.type = inputEx.HiddenField;
	   this.divEl = inputEx.cn('div', null, {display: 'none'});
	   
	   this.el = inputEx.cn('input', {type: 'hidden'});
	   this.rawValue = ''; // initialize the rawValue with '' (default value of a hidden field)
	
	   if(this.options.name) this.el.name = this.options.name;
	   this.divEl.appendChild(this.el);
   }
248249
private void addHiddenField(Panel form, String fieldName, String fieldValue) {

        Hidden inputField = new Hidden();
        inputField.setName(fieldName);
        inputField.setValue(fieldValue);
        form.add(inputField);
    }
874247
function action_putpost(si,args,done) {
    var ent_type = parse_ent(args)

    var ent = si.make(ent_type.zone,ent_type.base,ent_type.name)

    var data = args.data || {}

    var good = _.filter(_.keys(data),function(k){return !~k.indexOf('$')})

    var fields = _.pick(data,good)
    ent.data$(fields)

    if( null != ent_type.entid ) {
      ent.id = ent_type.entid
    }
    else if( null != data.id$ && options.allow_id ) {
      ent.id$ = data.id$
    }

    save_aspect(si,{args:args,ent:ent},done,function(ctxt,done){
      ctxt.ent.save$(function(err,ent){
        var data = ent ? ent.data$(true,'string') : null
        done(err, data)
      })
    })
  }
576984
def protect(view):
    

    @wraps(view)
    def csrf_check(*args, **kwargs):
        # an empty form is used to validate current csrf token and only that!
        if not FlaskForm().validate():
            raise Forbidden("CSRF validation failed.")

        return view(*args, **kwargs)

    return csrf_check
357901
def validate_csrf_token(self, field):
        """"""
        if current_app.testing:
            return
        super(InvenioBaseForm, self).validate_csrf_token(field)
163614
def form(self, obj=None, form=None, name=None, template=None, var_name=None, validate_on_submit=True,\
        exit_on_failure=True, csrf_enabled=None):
        
        if not form or isinstance(form, str):
            if not name and isinstance(form, str):
                name = form
            if not name:
                name = request.endpoint.rsplit('.', 1)[1] if '.' in request.endpoint else request.endpoint
            if name not in self.forms:
                raise NoFormError("Cannot find form '%s'" % name)
            form = self.forms[name]
        if inspect.isclass(form):
            if isinstance(obj, dict):
                obj = DictObject(obj)
            if csrf_enabled is None:
                csrf_enabled = self.options["csrf_enabled"]
            form = form(obj=obj, meta={'csrf': csrf_enabled})

        current_context.data.form = form
        yield form

        if validate_on_submit and request.method == "POST":
            self.validate(form, exit_on_failure=exit_on_failure)
388263
def get_hidden_fields_errors(self, form):
        ''''''
        if not self.include_hidden_fields or form.is_valid():
            return {}

        response = {self.hidden_field_error_key:{}}

        for field in form.hidden_fields():
            if field.errors:
                response[self.hidden_field_error_key][field.html_name] = self._get_field_error_dict(field)
        return response
1129774
function select_token (token) {
          if (!$(input).data("settings").disabled) {
              token.addClass($(input).data("settings").classes.selectedToken);
              selected_token = token.get(0);

              // Hide input box
              input_box.val("");

              // Hide dropdown if it is visible (eg if we clicked to select token)
              hide_dropdown();
          }
      }
726416
protected function submitAddFieldValue()
    {
        $this->setSubmitted(null, $this->getParam());
        $this->validateComponent('field_value');
        $this->addFieldValue();
    }
222223
protected function _csrfField()
    {
        $request = $this->_View->getRequest();

        if ($request->getParam('_Token.unlockedFields')) {
            foreach ((array)$request->getParam('_Token.unlockedFields') as $unlocked) {
                $this->_unlockedFields[] = $unlocked;
            }
        }
        if (!$request->getParam('_csrfToken')) {
            return '';
        }

        return $this->hidden('_csrfToken', [
            'value' => $request->getParam('_csrfToken'),
            'secure' => static::SECURE_SKIP,
            'autocomplete' => 'off',
        ]);
    }