<% using (Html.BeginForm()) { %>
<%=Html.ValidationSummary() %>
<%=Html.EditorForItem(m => m.BlogPost) %>
- <% } %>
+ <%=Html.OrchardAntiForgeryToken() %><%
+ } %>
<% Html.Include("AdminFoot"); %>
\ No newline at end of file
diff --git a/src/Orchard/Mvc/Filters/AntiForgeryAuthorizationFilter.cs b/src/Orchard/Mvc/Filters/AntiForgeryAuthorizationFilter.cs
new file mode 100644
index 000000000..78d04a23c
--- /dev/null
+++ b/src/Orchard/Mvc/Filters/AntiForgeryAuthorizationFilter.cs
@@ -0,0 +1,19 @@
+using System.Web.Mvc;
+
+namespace Orchard.Mvc.Filters {
+ public class AntiForgeryAuthorizationFilter : FilterProvider, IAuthorizationFilter {
+ public void OnAuthorization(AuthorizationContext filterContext) {
+ //TODO: (erikpo) Once all modules are moved over to use the AntiForgeryToken, get rid of this if statement
+ if (!(filterContext.RouteData.Values["area"] is string
+ && (string)filterContext.RouteData.Values["area"] == "Orchard.Blogs"))
+ return;
+
+ if (!(filterContext.HttpContext.Request.HttpMethod == "POST" && filterContext.RequestContext.HttpContext.Request.IsAuthenticated))
+ return;
+
+ ValidateAntiForgeryTokenAttribute validator = new ValidateAntiForgeryTokenAttribute { Salt = "Orchard" };
+
+ validator.OnAuthorization(filterContext);
+ }
+ }
+}
\ No newline at end of file
diff --git a/src/Orchard/Mvc/Html/HtmlHelperExtensions.cs b/src/Orchard/Mvc/Html/HtmlHelperExtensions.cs
index 3ae4d392c..b411f3b71 100644
--- a/src/Orchard/Mvc/Html/HtmlHelperExtensions.cs
+++ b/src/Orchard/Mvc/Html/HtmlHelperExtensions.cs
@@ -175,5 +175,16 @@ namespace Orchard.Mvc.Html {
}
#endregion
+
+ #region OrchardAntiForgeryToken
+
+ public static MvcHtmlString OrchardAntiForgeryToken(this HtmlHelper htmlHelper)
+ {
+ //TODO: (erikpo) Change the salt to be something unique per application like a site setting with a Guid.NewGuid().ToString("N") value
+
+ return htmlHelper.AntiForgeryToken("Orchard");
+ }
+
+ #endregion
}
}
diff --git a/src/Orchard/Orchard.csproj b/src/Orchard/Orchard.csproj
index a96e86f1e..222d8ce99 100644
--- a/src/Orchard/Orchard.csproj
+++ b/src/Orchard/Orchard.csproj
@@ -196,6 +196,7 @@
+