Improve the csrf_field helper

The helper can now be called multiple times during a single request
and always output the valid CSRF token. Before, every call
generated a new token, making all previous tokens invalid.

Author: mzur

src/helpers.php

@@ -8,14 +8,20 @@
     /**
      * Generate a CSRF token form field.
      *
-     * @param string $token The CSRF token. If empty a new one will be generated.
+     * This function can be called multiple times and will reuse the same token during a
+     * single request.
+     *
+     * @param string $t The CSRF token to use. If empty a new one will be generated and reused for the duration of a request.
      *
      * @return string
      */
-    function csrf_field($token = null)
+    function csrf_field($t = null)
     {
+        // remember the token for multipme function calls
+        static $token = null;
         $token = $token ?: csrf();
-        return '<input type="hidden" name="'.Form::CSRF_FIELD.'" value="'.$token.'">';
+        // the token parameter overrides the generated token
+        return '<input type="hidden" name="'.Form::CSRF_FIELD.'" value="'.($t ?: $token).'">';
     }
 }
 

tests/HelperTest.php

@@ -4,11 +4,18 @@
 
 class HelperTest extends TestCase
 {
-    public function testFunction ()
+    public function testFunction()
     {
         $this->assertTrue(function_exists('csrf_field'));
         $this->assertTrue(function_exists('honeypot_field'));
         $this->assertTrue(function_exists('uniform_captcha'));
         $this->assertTrue(function_exists('captcha_field'));
     }
+
+    public function testCsrfField()
+    {
+        // the token should not be regenerated during a single request
+        $this->assertEquals(csrf_field(), csrf_field());
+        $this->assertContains('value="abc"', csrf_field('abc'));
+    }
 }