From bb778205bc8b016dac2faf706f5505abab14148f Mon Sep 17 00:00:00 2001
From: Mark Story <mark@mark-story.com>
Date: Mon, 11 Nov 2024 00:02:11 -0500
Subject: [PATCH] Add documentation for cakephp/cakephp#18015

---
 en/appendices/5-2-migration-guide.rst         | 3 +++
 en/controllers/components/form-protection.rst | 5 ++++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/en/appendices/5-2-migration-guide.rst b/en/appendices/5-2-migration-guide.rst
index 92ce571d86..e5591004a2 100644
--- a/en/appendices/5-2-migration-guide.rst
+++ b/en/appendices/5-2-migration-guide.rst
@@ -13,6 +13,9 @@ Behavior Changes
   overwritten by accident.
 - ``Http\Session`` will now raise an exception when an invalid session preset is
   used.
+- ``FormProtectionComponent`` now raises ``Cake\Controller\Exception\FormProtectionException``. This
+  class is a subclass of ``BadRequestException``, and offers the benefit of
+  being filterable from logging.
 
 New Features
 ============
diff --git a/en/controllers/components/form-protection.rst b/en/controllers/components/form-protection.rst
index 9ff4acc8ee..6f06a4fe20 100644
--- a/en/controllers/components/form-protection.rst
+++ b/en/controllers/components/form-protection.rst
@@ -146,13 +146,16 @@ configuration option to a callback function in the controller.
 By configuring a callback method you can customize how the failure handling process
 works::
 
+    use Cake\Controller\Exception\FormProtectionException;
+
     public function beforeFilter(EventInterface $event)
     {
         parent::beforeFilter($event);
 
         $this->FormProtection->setConfig(
             'validationFailureCallback',
-            function (BadRequestException $exception) {
+            // Prior to 5.2 use Cake\Http\Exception\BadRequestException.
+            function (FormProtectionException $exception) {
                 // You can either return a response instance or throw the exception
                 // received as argument.
             }