bytic / form

src/Elements/Hash.php

<?php

class Nip_Form_Element_Hash extends Nip_Form_Element_Hidden
{
    protected $_ID;

    public function init()
    {
        parent::init();
        $this->initSession();
    }

    public function initSession()
    {
        $name = $this->getSessionName();
        if (!$_SESSION[$name]) {
            $this->reset();
        }

        $this->setValue($this->getSessionValue());
    }

    public function reset()
    {
        $name = $this->getSessionName();
        $hash = $this->_generateHash();
        $_SESSION[$name] = $hash;
        $this->setValue($hash);
    }

    public function validate()
    {
        if (!$this->getValue()) {
            $this->addError('Request received without security hash');
        } elseif ($this->getValue() != $this->getSessionValue()) {
            $this->addError('Form security hash different from server');
        }
    }

    public function getSessionName()
    {
        return $this->getForm()->getName() . '_' . $this->getSalt();
    }

    public function getSessionValue()
    {
        $name = $this->getSessionName();

        return $_SESSION[$name];
    }

    public function getSalt()
    {
        return sha1(__CLASS__);
    }

    protected function _generateHash()
    {
        return md5(
            mt_rand(1, 1000000)
            . $this->getSalt()
            . $this->getName()

Are you sure the usage of $this->getName() targeting Nip\Form\Elements\AbstractElement::getName() seems to always return null.

            . session_id()
            . mt_rand(1, 1000000)
        );
    }
}