Prevent conflict between CsrfComponent and CsrfProtectionMiddleware

[jtraulle]

I am currently playing with next version of Cake (3.5.x). 🎉

Since CsrfComponent is deprecated starting from 3.5, I have switched my app to Cake\Http\Middleware\CsrfProtectionMiddleware.

CakeDC/Users makes use of CsrfComponent, so, when CsrfProtectionMiddleware is enabled application wide, CsrfComponent enabled in CakeDC/Users overrides CsrfProtectionMiddleware injected _csrfToken causing CsrfProtectionMiddleware to throw a InvalidCsrfTokenException .

Currently, i am using this code in my AppController to disable CsrfComponent for CakeDC/Users plugin

if ($event->getSubject()->request->getParam('plugin') === 'CakeDC/Users') {
    $this->getEventManager()->off($this->Csrf);
}

However, it would be better to check if _csrfToken is already defined in request param before loading CsrfComponent to prevent overriding CsrfProtectionMiddleware injected _csrfToken. 😉

if ($this->request->getParam('_csrfToken') === false) {
    $this->loadComponent('Csrf');
}

[coveralls]

Coverage increased (+0.03%) to 79.584% when pulling c687459 on jtraulle:patch-2 into 2b65802 on CakeDC:develop.