KnpLabs/KnpRadBundle — pull request #83 by docteurklein (2013-08-19 20:09:19+00:00)
Title: [CSRF links] it should always check for csrf token, not just when _link_token is present in request.

Otherwise, it's too easy to generate CSRF attacks:

Just remove the `_link_token` parameter from the request and you're done!

We should find a way to verify routes that **need** to be checked.

I see a possibility:

- mark the request to be **always** checked by adding request attribute `_check_csrf` (via routing for example)

fail here: https://github.com/KnpLabs/KnpRadBundle/blob/develop/EventListener/CsrfListener.php#L23