I wrote another simple one:
1. Override addCSRFProtection in BaseForm.class.php:
public function addCSRFProtection($secret = null)
{
parent::addCSRFProtection($secret);
$validatorSchema=$this->getValidatorSchema();
if (isset($validatorSchema[self::$CSRFFieldName]))
{
$validatorSchema[self::$CSRFFieldName]=new myValidatorCSRFToken($validatorSchema[self::$CSRFFieldName]->getOptions());
}
}
2. Add new myValidatorCSRFToken.class.php with contents:
class myValidatorCSRFToken extends sfValidatorBase
{
protected function configure($options = array(), $messages = array())
{
$this->addRequiredOption('token');
$this->setOption('required', true);
$this->addMessage('csrf_attack', 'Время сессии истекло.');
}
protected function doClean($value)
{
if ($value != $this->getOption('token'))
{
$exception=new sfValidatorError($this, 'csrf_attack');
throw new sfValidatorErrorSchema($this, array($exception));
}
return $value;
}
}
3. That's all :)