From c6f37e64352b734fd06c6a438c0787052ec7181e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andre=CC=81=20R?= <ar@ez.no>
Date: Fri, 3 May 2019 16:48:07 +0200
Subject: [PATCH 1/2] [PHP7] Add eZContentObjectTreeNode::__construct() now
 that BC construct method is added

---
 kernel/classes/ezcontentobjecttreenode.php | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/kernel/classes/ezcontentobjecttreenode.php b/kernel/classes/ezcontentobjecttreenode.php
index 1315837309c..39c1bf888b5 100644
--- a/kernel/classes/ezcontentobjecttreenode.php
+++ b/kernel/classes/ezcontentobjecttreenode.php
@@ -32,13 +32,18 @@ class eZContentObjectTreeNode extends eZPersistentObject
     const SORT_ORDER_DESC = 0;
     const SORT_ORDER_ASC = 1;
 
+    public function __construct( $row = array() )
+    {
+        parent::__construct( $row );
+    }
+
     /**
      * @deprecated Use eZContentObjectTreeNode::__construct() instead
      * @param int|array $row
      */
     function eZContentObjectTreeNode( $row = array() )
     {
-        parent::__construct( $row );
+        self::__construct( $row );
     }
 
     /**

From fd3b34c7e672b1fd906b1b4089f242cab4aa7df5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20R?= <andre.romcke@gmail.com>
Date: Tue, 14 May 2019 14:18:23 +0200
Subject: [PATCH 2/2] EZP-30161: Handle form token in both custom and also for
 historical reasons default value (#1431)

* EZP-30161: Handle form token in both custom and also for historical reasons default value

Since 5.0 FormToken code has been operating in two modes:
- Default pure legacy mode using `ezxform_token` as form name
- Symfony mode using `_token` as form name

Hoewever quite some legacy code hard codes the default name.
In 5.x this inconsistancy was solved by setting Symfony to use `field_name: ezxform_token`

For Platform + legacy bridge that is no longer a good default, so this changes the logic
so that ezxFormToken is cable of handling both at the same time.

* Apply suggestions from code review

Co-Authored-By: Gunnstein Lye <gunnstein.lye@ez.no>
---
 extension/ezformtoken/event/ezxformtoken.php | 26 +++++++++++++++-----
 1 file changed, 20 insertions(+), 6 deletions(-)

diff --git a/extension/ezformtoken/event/ezxformtoken.php b/extension/ezformtoken/event/ezxformtoken.php
index e429bdfce79..e13416292fc 100755
--- a/extension/ezformtoken/event/ezxformtoken.php
+++ b/extension/ezformtoken/event/ezxformtoken.php
@@ -38,7 +38,7 @@ class ezxFormToken
     static protected $intention = 'legacy';
 
     /**
-     * @var string
+     * @var string Custom Form field, by default set to system default form field (self::FORM_FIELD).
      */
     static protected $formField = self::FORM_FIELD;
 
@@ -90,6 +90,8 @@ static public function setIntention( $intention )
     }
 
     /**
+     * Get the custom form field.
+     *
      * @return string
      */
     static protected function getFormField()
@@ -98,6 +100,8 @@ static protected function getFormField()
     }
 
     /**
+     * Set the custom form field.
+     *
      * @param string $formField
      */
     static public function setFormField( $formField )
@@ -137,6 +141,11 @@ static public function input( eZURI $uri )
         {
             $token = $_POST[self::getFormField()];
         }
+        // For historical reasons also check the system default form field
+        else if ( !empty( $_POST[self::FORM_FIELD] ) )
+        {
+            $token = $_POST[self::FORM_FIELD];
+        }
         // allow ajax calls using POST with other formats than forms (such as
         // json or xml) to still validate using a custom http header
         else if ( !empty( $_SERVER['HTTP_X_CSRF_TOKEN'] ) )
@@ -188,19 +197,22 @@ static public function output( $templateResult, $filterForms = true )
         }
 
         $token = self::getToken();
-        $field = self::getFormField();
+        $customfield = self::getFormField();
+        $defaultField = self::FORM_FIELD;
         $replaceKey = self::REPLACE_KEY;
 
         eZDebugSetting::writeDebug( 'ezformtoken', 'Output protected (all forms will be modified)', __METHOD__ );
 
+        // Inject token for programmatical use (also system default for historical reasons)
         // If document has head tag, insert in a html5 valid and semi standard way
         if ( strpos( $templateResult, '<head>' ) !== false )
         {
             $templateResult = str_replace(
                 '<head>',
                 "<head>\n"
-                . "<meta name=\"csrf-param\" content=\"{$field}\" />\n"
-                . "<meta name=\"csrf-token\" id=\"{$field}_js\" title=\"{$token}\" content=\"{$token}\" />\n",
+                . "<meta name=\"csrf-param\" content=\"{$customfield}\" />\n"
+                . "<meta name=\"csrf-token\" id=\"{$customfield}_js\" title=\"{$token}\" content=\"{$token}\" />\n"
+                . ($defaultField !== $customfield ? "<meta name=\"csrf-token-x\" id=\"{$defaultField}_js\" title=\"{$token}\" content=\"{$token}\" />\n" : ''),
                 $templateResult
             );
         }
@@ -209,16 +221,18 @@ static public function output( $templateResult, $filterForms = true )
         {
             $templateResult = preg_replace(
                 '/(<body[^>]*>)/i',
-                '\\1' . "\n<span style='display:none;' id=\"{$field}_js\" title=\"{$token}\"></span>\n",
+                '\\1' . "\n<span style='display:none;' id=\"{$customfield}_js\" title=\"{$token}\"></span>\n"
+                . ($defaultField !== $customfield ? "\n<span style='display:none;' id=\"{$defaultField}_js\" title=\"{$token}\"></span>\n" : ''),
                 $templateResult
             );
         }
 
+        // For forms we set the custom field which will be sent back to this class and evaluated
         if ( $filterForms )
         {
             $templateResult = preg_replace(
                 '/(<form\W[^>]*\bmethod=(\'|"|)POST(\'|"|)\b[^>]*>)/i',
-                '\\1' . "\n<input type=\"hidden\" name=\"{$field}\" value=\"{$token}\" />\n",
+                '\\1' . "\n<input type=\"hidden\" name=\"{$customfield}\" value=\"{$token}\" />\n",
                 $templateResult
             );
         }