Skip to content
This repository was archived by the owner on Oct 20, 2025. It is now read-only.

Commit ef5ca67

Browse files
committed
Added test + fix for form method spoofing
1 parent 7794707 commit ef5ca67

File tree

4 files changed

+35
-1
lines changed

4 files changed

+35
-1
lines changed
Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
@extends('layout')
2+
3+
@section('content')
4+
5+
FormPut
6+
7+
<x-splade-form method="PUT">
8+
<input v-model="form.name" dusk="name" />
9+
<p v-text="form.errors.name" />
10+
<button type="submit">Submit</button>
11+
</x-splade-form>
12+
13+
@endsection

app/routes/web.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,8 @@
7171

7272
Route::view('form/simple', 'form.simple')->name('form.simple');
7373
Route::post('form/simple', SimpleFormController::class)->name('form.simple.submit');
74+
Route::view('form/put', 'form.put')->name('form.put');
75+
Route::put('form/put', SimpleFormController::class)->name('form.put.submit');
7476
Route::post('form/slow', SlowFormController::class)->name('form.slow.submit');
7577
Route::post('form/back', BackFormController::class)->name('form.back.submit');
7678

app/tests/Browser/FormTest.php

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,18 @@ public function it_can_show_the_errors()
1919
});
2020
}
2121

22+
/** @test */
23+
public function it_can_submit_to_a_non_post_endpoint()
24+
{
25+
$this->browse(function (Browser $browser) {
26+
$browser->visit('/form/put')
27+
->waitForText('FormPut')
28+
->press('Submit')
29+
->waitForText('The name field is required.')
30+
->assertSee('The name field is required.');
31+
});
32+
}
33+
2234
/** @test */
2335
public function it_can_upload_a_file()
2436
{

lib/Components/Form.vue

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -263,7 +263,14 @@ export default {
263263
headers["X-Splade-Prevent-Refresh"] = true;
264264
}
265265
266-
Splade.request(this.action, this.method.toUpperCase(), data, headers)
266+
let method = this.method.toUpperCase();
267+
268+
if(method !== "GET" && method !== "POST") {
269+
data.append("_method", method);
270+
method = "POST";
271+
}
272+
273+
Splade.request(this.action, method, data, headers)
267274
.then((response) => {
268275
this.$emit("success", response);
269276

0 commit comments

Comments
 (0)