EllisLab/CodeIgniter — Issue #702: CSRF token is not set in form_open()
Author: johnnicely
Created: 2011-11-24 06:37:28+00:00
State: open

form_open() will not add the hidden CSRF token field if the following is false:

```php
if ($CI->config->item('csrf_protection') === TRUE AND
! (strpos($action, $CI->config->site_url()) === FALSE OR
strpos($form, 'method="get"')))
{
$hidden[$CI->security->get_csrf_token_name()] = $CI->security->get_csrf_hash();
}
```

`$CI->config->site_url()` returns the `base_url()` value concatenated with the value of `$CI->config->item('index_page')` when `site_url()`'s first parameter ($uri) is an empty string. This causes the second condition in the code above to fail because the URI routing in CodeIgniter does not require 'index.php' to be used in the URL.

The fixed code in `form_open()` should be changed to this:

```php
if ($CI->config->item('csrf_protection') === TRUE AND
! (strpos($action, $CI->config->base_url()) === FALSE OR
strpos($form, 'method="get"')))
{
$hidden[$CI->security->get_csrf_token_name()] = $CI->security->get_csrf_hash();
}
```