From b13f0fb68c51c7c4b84432e56b90fcad8a8042bf Mon Sep 17 00:00:00 2001
From: Nicolas Grekas <nicolas.grekas@gmail.com>
Date: Mon, 6 Jan 2025 15:35:32 +0100
Subject: [PATCH] Generate data-controller="csrf-protection" on CSRF fields

---
 templates/authenticator/login_form.tpl.php                   | 5 +----
 templates/security/formLogin/login_form.tpl.php              | 5 +----
 .../security/make-form-login/expected/login.html.twig        | 5 +----
 .../make-form-login/expected/login_no_logout.html.twig       | 5 +----
 4 files changed, 4 insertions(+), 16 deletions(-)

diff --git a/templates/authenticator/login_form.tpl.php b/templates/authenticator/login_form.tpl.php
index 2fdef9745..2c3a6a932 100644
--- a/templates/authenticator/login_form.tpl.php
+++ b/templates/authenticator/login_form.tpl.php
@@ -21,10 +21,7 @@
     <input type="<?= $username_is_email ? 'email' : 'text'; ?>" value="{{ last_username }}" name="<?= $username_field; ?>" id="input<?= ucfirst($username_field); ?>" class="form-control" autocomplete="<?= $username_is_email ? 'email' : 'username'; ?>" required autofocus>
     <label for="inputPassword">Password</label>
     <input type="password" name="password" id="inputPassword" class="form-control" autocomplete="current-password" required>
-
-    <input type="hidden" name="_csrf_token"
-           value="{{ csrf_token('authenticate') }}"
-    >
+    <input type="hidden" name="_csrf_token" data-controller="csrf-protection" value="{{ csrf_token('authenticate') }}">
 <?php if($support_remember_me && !$always_remember_me): ?>
 
     <div class="checkbox mb-3">
diff --git a/templates/security/formLogin/login_form.tpl.php b/templates/security/formLogin/login_form.tpl.php
index ca64abdd9..940038829 100644
--- a/templates/security/formLogin/login_form.tpl.php
+++ b/templates/security/formLogin/login_form.tpl.php
@@ -21,10 +21,7 @@
         <input type="<?= $username_is_email ? 'email' : 'text'; ?>" value="{{ last_username }}" name="_username" id="username" class="form-control" autocomplete="<?= $username_is_email ? 'email' : 'username'; ?>" required autofocus>
         <label for="password">Password</label>
         <input type="password" name="_password" id="password" class="form-control" autocomplete="current-password" required>
-
-        <input type="hidden" name="_csrf_token"
-               value="{{ csrf_token('authenticate') }}"
-        >
+        <input type="hidden" name="_csrf_token" data-controller="csrf-protection" value="{{ csrf_token('authenticate') }}">
 
         {#
             Uncomment this section and add a remember_me option below your firewall to activate remember me functionality.
diff --git a/tests/fixtures/security/make-form-login/expected/login.html.twig b/tests/fixtures/security/make-form-login/expected/login.html.twig
index 07b5cd416..c7dbe2c6f 100644
--- a/tests/fixtures/security/make-form-login/expected/login.html.twig
+++ b/tests/fixtures/security/make-form-login/expected/login.html.twig
@@ -19,10 +19,7 @@
         <input type="email" value="{{ last_username }}" name="_username" id="username" class="form-control" autocomplete="email" required autofocus>
         <label for="password">Password</label>
         <input type="password" name="_password" id="password" class="form-control" autocomplete="current-password" required>
-
-        <input type="hidden" name="_csrf_token"
-               value="{{ csrf_token('authenticate') }}"
-        >
+        <input type="hidden" name="_csrf_token" data-controller="csrf-protection" value="{{ csrf_token('authenticate') }}">
 
         {#
             Uncomment this section and add a remember_me option below your firewall to activate remember me functionality.
diff --git a/tests/fixtures/security/make-form-login/expected/login_no_logout.html.twig b/tests/fixtures/security/make-form-login/expected/login_no_logout.html.twig
index febede20a..3c8646d8b 100644
--- a/tests/fixtures/security/make-form-login/expected/login_no_logout.html.twig
+++ b/tests/fixtures/security/make-form-login/expected/login_no_logout.html.twig
@@ -13,10 +13,7 @@
         <input type="email" value="{{ last_username }}" name="_username" id="username" class="form-control" autocomplete="email" required autofocus>
         <label for="password">Password</label>
         <input type="password" name="_password" id="password" class="form-control" autocomplete="current-password" required>
-
-        <input type="hidden" name="_csrf_token"
-               value="{{ csrf_token('authenticate') }}"
-        >
+        <input type="hidden" name="_csrf_token" data-controller="csrf-protection" value="{{ csrf_token('authenticate') }}">
 
         {#
             Uncomment this section and add a remember_me option below your firewall to activate remember me functionality.