fix: ensure csrf token is string

codeigniter4 · Jan 3, 2025 · f427948 · f427948
1 parent 3c851f1
commit f427948
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/system/Security/Security.php b/system/Security/Security.php
@@ -307,6 +307,10 @@ private function getPostedToken(RequestInterface $request): ?string
         // Does the token exist in POST, HEADER or optionally php:://input - json data or PUT, DELETE, PATCH - raw data.
 
         if ($tokenValue = $request->getPost($this->config->tokenName)) {
+            if (! is_string($tokenValue)) {
+                return null;
+            }
+
             return $tokenValue;
         }