refactored Request::validateCsrfToken().

framework/yii/web/Request.php

@@ -1027,16 +1027,12 @@ class Request extends \yii\base\Request
 	 */
 	public function validateCsrfToken()
 	{
-		if (!$this->enableCsrfValidation) {
+		$method = $this->getMethod();
+		if (!$this->enableCsrfValidation || !in_array($method, array('POST', 'PUT', 'PATCH', 'DELETE'), true)) {
 			return true;
 		}
-		$method = $this->getMethod();
-		if ($method === 'POST' || $method === 'PUT' || $method === 'PATCH' || $method === 'DELETE') {
 		$trueToken = $this->getCookies()->getValue($this->csrfVar);
 		switch ($method) {
-				case 'POST':
-					$token = $this->getPost($this->csrfVar);
-					break;
 			case 'PUT':
 				$token = $this->getPut($this->csrfVar);
 				break;
@@ -1045,11 +1041,11 @@ class Request extends \yii\base\Request
 				break;
 			case 'DELETE':
 				$token = $this->getDelete($this->csrfVar);
+				break;
+			default:
+				$token = $this->getPost($this->csrfVar);
+				break;
 		}
-
+		return $token === $trueToken || $this->getCsrfTokenFromHeader() === $trueToken;
-			return !empty($token) && $token === $trueToken || $this->getCsrfTokenFromHeader() === $trueToken;
-		} else {
-			return true;
-		}
 	}
 }