TYPO3.Flow

The problem is that the CsrfProtectionAspect is woven into UriBuilder::build() (via "method(TYPO3\FLOW3\MVC\Web\Routing\UriBuilder->build()"), but the arguments to determine the target Controller/Action are not yet merged into $arguments, so the CsrfProtectionAspect has no way to check the action.

Possible solution: Use the following code and weave the CsrfProtectionAspect into UriBuilder::doBuild(), but maybe you guys have a better solution ;)

 

class UriBuilder {
...
    /**
     * Builds the URI
     *
     * @param array $arguments optional URI arguments. Will be merged with $this->arguments with precedence to $arguments
     * @return string The URI
     * @api
     */
    public function build(array $arguments = array()) {
        $arguments = \TYPO3\FLOW3\Utility\Arrays::arrayMergeRecursiveOverrule($this->arguments, $arguments);
        $this->mergeArgumentsWithRequestArguments($arguments);

        $this->doBuild($arguments);
      }

        protected function doBuild(array $arguments = array()) {
        // rest of the build function
        }
...
}