use token in invoice delete route (#2889)

src/Constants.php

@@ -17,15 +17,15 @@ class Constants
     /**
      * The current release version
      */
-    public const VERSION = '1.15.6';
+    public const VERSION = '1.16.0';
     /**
      * The current release: major * 10000 + minor * 100 + patch
      */
-    public const VERSION_ID = 11506;
+    public const VERSION_ID = 11600;
     /**
      * The current release status, either "stable" or "dev"
      */
-    public const STATUS = 'stable';
+    public const STATUS = 'dev';
     /**
      * The software name
      */

src/Controller/InvoiceController.php

@@ -36,6 +36,8 @@ use Symfony\Component\HttpFoundation\File\UploadedFile;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\Routing\Annotation\Route;
+use Symfony\Component\Security\Csrf\CsrfToken;
+use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
 use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
 
 /**
@@ -253,10 +255,18 @@ final class InvoiceController extends AbstractController
     }
 
     /**
-     * @Route(path="/delete/{id}", name="admin_invoice_delete", methods={"GET"})
+     * @Route(path="/delete/{id}/{token}", name="admin_invoice_delete", methods={"GET"})
      */
-    public function deleteInvoiceAction(Invoice $invoice): Response
+    public function deleteInvoiceAction(Invoice $invoice, string $token, CsrfTokenManagerInterface $csrfTokenManager): Response
     {
+        if (!$csrfTokenManager->isTokenValid(new CsrfToken('invoice.delete', $token))) {
+            $this->flashError('action.delete.error');
+
+            return $this->redirectToRoute('admin_invoice_list');
+        }
+
+        $csrfTokenManager->refreshToken($token);
+
         try {
             $this->service->deleteInvoice($invoice);
             $this->flashSuccess('action.delete.success');

src/EventSubscriber/Actions/InvoiceSubscriber.php

@@ -37,6 +37,6 @@ class InvoiceSubscriber extends AbstractActionsSubscriber
         }
 
         $event->addAction('download', ['url' => $this->path('admin_invoice_download', ['id' => $invoice->getId()]), 'target' => '_blank']);
-        $event->addDelete($this->path('admin_invoice_delete', ['id' => $invoice->getId()]), false);
+        $event->addDelete($this->path('admin_invoice_delete', ['id' => $invoice->getId(), 'token' => $payload['token']]), false);
     }
 }