Implement simple csrf token into ajax driven forms

public/typo3conf/ext/ep_events/Classes/Controller/AjaxFormController.php

@@ -73,7 +73,7 @@ class AjaxFormController extends ActionController implements LoggerAwareInterfac
      */
     public function processInquiryFormAction(Inquiry $inquiry)
     {
-        if (true === $this->spamProtectService->isSpamEmail($inquiry->getEmail())) {
+        if (false === $this->hasValidToken($inquiry) || true === $this->spamProtectService->isSpamEmail($inquiry->getEmail())) {
             $this->logger->warning('Dropped potential SPAM', $inquiry->toArray());
         } else {
             $this->emailService->send([
@@ -95,7 +95,7 @@ class AjaxFormController extends ActionController implements LoggerAwareInterfac
      */
     public function processConfiguratorFormAction(Inquiry $inquiry)
     {
-        if (true === $this->spamProtectService->isSpamEmail($inquiry->getEmail())) {
+        if (false === $this->hasValidToken($inquiry) || true === $this->spamProtectService->isSpamEmail($inquiry->getEmail())) {
             $this->logger->warning('Dropped potential SPAM', $inquiry->toArray());
         } else {
             $this->emailService->send([
@@ -113,6 +113,19 @@ class AjaxFormController extends ActionController implements LoggerAwareInterfac
         return json_encode(['status' => 'ok']);
     }
 
+    protected function hasValidToken(Inquiry $inquiry)
+    {
+        $token = $GLOBALS['TSFE']->fe_user->getKey('ses', Inquiry::TOKEN_KEY);
+
+        return $token === $inquiry->getToken();
+    }
+
+    protected function invalidateToken()
+    {
+        $GLOBALS['TSFE']->fe_user->setKey('ses', Inquiry::TOKEN_KEY, null);
+        $GLOBALS['TSFE']->fe_user->storeSessionData();
+    }
+
     /**
      * @return string
      */

public/typo3conf/ext/ep_events/Classes/Controller/FormController.php

@@ -50,6 +50,8 @@ class FormController extends ActionController
     public function inquiryFormAction()
     {
         $inquiry = $this->getInquiryFromContext();
+        $this->setToken($inquiry);
+
         $this->view->assign('inquiry', $inquiry);
     }
 
@@ -62,6 +64,8 @@ class FormController extends ActionController
         $inquiry = Inquiry::fromArguments($travelType, $locationType);
         $pageUrl = $this->getCurrentPageUrl();
         $inquiry->setPageUrl($pageUrl);
+        $this->setToken($inquiry);
+
         $this->view->assign('inquiry', $inquiry);
     }
 
@@ -76,10 +80,21 @@ class FormController extends ActionController
         } else {
             $inquiry = $this->getInquiryFromContext();
         }
+
+        $this->setToken($inquiry);
+
         $this->view->assign('configuratorConfig', $this->configurationService->getConfiguratorConfig());
         $this->view->assign('inquiry', $inquiry);
     }
 
+    protected function setToken(Inquiry $inquiry)
+    {
+        $token = bin2hex(openssl_random_pseudo_bytes(32));
+        $GLOBALS['TSFE']->fe_user->setKey('ses', Inquiry::TOKEN_KEY, $token);
+        $GLOBALS['TSFE']->fe_user->storeSessionData();
+        $inquiry->setToken($token);
+    }
+
     /**
      * @return Inquiry
      */

public/typo3conf/ext/ep_events/Classes/Domain/Model/Inquiry.php

@@ -31,6 +31,13 @@ use TYPO3\CMS\Extbase\DomainObject\AbstractValueObject;
 
 class Inquiry extends AbstractValueObject
 {
+    public const TOKEN_KEY = 'inquiry_form';
+
+    /**
+     * @var string
+     */
+    protected $token;
+
     /**
      * @var string
      */
@@ -203,6 +210,22 @@ class Inquiry extends AbstractValueObject
         return $inquiry;
     }
 
+    /**
+     * @return string
+     */
+    public function getToken()
+    {
+        return $this->token;
+    }
+
+    /**
+     * @param string $token
+     */
+    public function setToken(string $token)
+    {
+        $this->token = $token;
+    }
+
     /**
      * @return string
      */

public/typo3conf/ext/ep_events/Resources/Private/Templates/Form/Configurator.html

@@ -71,6 +71,7 @@
             <f:form id="configuratorform" object="{inquiry}" name="inquiry" action="processConfiguratorForm"
                     controller="AjaxForm" pluginName="Ajax" pageType="1703" pageUid="{settings.ajaxPageUid}"
                     additionalAttributes="{'@submit.prevent': 'submitForm()'}">
+                    <f:form.hidden property="token"/>
                     <f:form.hidden property="travelType" additionalAttributes="{v-model: 'formData.type'}"/>
                     <f:form.hidden property="hotelType" additionalAttributes="{v-model: 'formData.accommodation'}"/>
                     <f:form.hidden property="locationType" additionalAttributes="{v-model: 'formData.destination'}"/>

public/typo3conf/ext/ep_events/Resources/Private/Templates/Form/ContactForm.html

@@ -14,6 +14,7 @@
                                 controller="AjaxForm" pluginName="Ajax" pageType="1703"
                                 pageUid="{settings.ajaxPageUid}" noCacheHash="1"
                                 additionalAttributes="{'@submit.prevent': 'submitForm()'}">
+                            <f:form.hidden property="token"/>
                             <f:form.hidden property="pageUrl"/>
                             <div class="form__item form__item--radios">
                                 <div class="form__field form__field--radio">