Fix _validatePost returns true when empty form is submitted

src/Controller/Component/SecurityComponent.php

@@ -102,7 +102,7 @@ class SecurityComponent extends Component
         $controller = $event->getSubject();
         $this->session = $controller->request->getSession();
         $this->_action = $controller->request->getParam('action');
-        $hasData = (bool)$controller->request->getData();
+        $hasData = ($controller->request->getData() || $controller->request->is(['put', 'post', 'delete', 'patch']));
         try {
             $this->_secureRequired($controller);
             $this->_authRequired($controller);
@@ -312,9 +312,6 @@ class SecurityComponent extends Component
      */
     protected function _validatePost(Controller $controller)
     {
-        if (!$controller->request->getData()) {
-            return true;
-        }
         $token = $this->_validToken($controller);
         $hashParts = $this->_hashParts($controller);
         $check = Security::hash(implode('', $hashParts), 'sha1');

tests/TestCase/Controller/Component/SecurityComponentTest.php

@@ -555,6 +555,25 @@ class SecurityComponentTest extends TestCase
     }
 
     /**
+     * testValidatePostEmptyForm method
+     *
+     * Test that validatePost fails if empty form is submitted.
+     *
+     * @return void
+     * @triggers Controller.startup $this->Controller
+     */
+    public function testValidatePostEmptyForm()
+    {
+        $this->Controller->request = $this->Controller->request
+            ->withEnv('REQUEST_METHOD', 'POST')
+            ->withParsedBody([]);
+        $event = new Event('Controller.startup', $this->Controller);
+        $this->Security->startup($event);
+        $result = $this->validatePost('AuthSecurityException', '\'_Token\' was not found in request data.');
+        $this->assertFalse($result, 'validatePost passed when empty form is submitted');
+    }
+
+    /**
      * testValidatePostObjectDeserialize
      *
      * Test that objects can't be passed into the serialized string. This was a vector for RFI and LFI