$input =
$form_state->
getUserInput();
if ($form_state->
isProgrammed() || (!
empty($input) && (isset($input['form_id'
]) && ($input['form_id'
] ==
$form_id)))) { $form_state->
setProcessInput();
if (isset($element['#token'
])) { $input =
$form_state->
getUserInput();
if (empty($input['form_token'
]) || !
$this->csrfToken->
validate($input['form_token'
],
$element['#token'
])) { // Set an early form error to block certain input processing since
// that opens the door for CSRF vulnerabilities.
$this->
setInvalidTokenError($form_state);
// This value is checked in self::handleInputElement().
$form_state->
setInvalidToken(TRUE
);
// Ignore all submitted values.
$form_state->
setUserInput([]);
$request =
$this->requestStack->
getCurrentRequest();
// Do not trust any POST data.
$request->request =
new ParameterBag();
// Make sure file uploads do not get processed.
$request->files =
new FileBag();
// Ensure PHP globals reflect these changes.
$request->
overrideGlobals();
}