aboutsummaryrefslogtreecommitdiff
path: root/views/default/input/form.php
blob: c9f9aa97d7d8fcc153701dc77ff1087df1cf48ce (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
<?php
/**
 * Create a form for data submission.
 * Use this view for forms rather than creating a form tag in the wild as it provides
 * extra security which help prevent CSRF attacks.
 *
 * @package Elgg
 * @subpackage Core
 *
 * @uses $vars['body'] The body of the form (made up of other input/xxx views and html
 * @uses $vars['disable_security'] turn off CSRF security by setting to true
 */

$defaults = array(
	'method' => "post",
	'disable_security' => FALSE,
);

$vars = array_merge($defaults, $vars);

$vars['action'] = elgg_normalize_url($vars['action']);
$vars['method'] = strtolower($vars['method']);

$body = $vars['body'];
unset($vars['body']);

// Generate a security header
if (!$vars['disable_security']) {
	$body .= elgg_view('input/securitytoken');
}
unset($vars['disable_security']);

$attributes = elgg_format_attributes($vars);

echo "<form $attributes><fieldset>$body</fieldset></form>";