jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

use token in invoice delete route (#2889)

Browse Source
This commit is contained in:
Kevin Papst
2021-10-30 15:17:06 +02:00
committed by GitHub
parent 40061e43bb
commit 1d32e4ecee
5 changed files with 19 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/Controller/InvoiceController.php
View File

@@ -36,6 +36,8 @@ use Symfony\Component\HttpFoundation\File\UploadedFile;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Annotation\Route;
use Symfony\Component\Security\Csrf\CsrfToken;
use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
/**
@@ -253,10 +255,18 @@ final class InvoiceController extends AbstractController
}
/**
* @Route(path="/delete/{id}", name="admin_invoice_delete", methods={"GET"})
* @Route(path="/delete/{id}/{token}", name="admin_invoice_delete", methods={"GET"})
*/
public function deleteInvoiceAction(Invoice $invoice): Response
public function deleteInvoiceAction(Invoice $invoice, string $token, CsrfTokenManagerInterface $csrfTokenManager): Response
{
if (!$csrfTokenManager->isTokenValid(new CsrfToken('invoice.delete', $token))) {
$this->flashError('action.delete.error');
return $this->redirectToRoute('admin_invoice_list');
}
$csrfTokenManager->refreshToken($token);
try {
$this->service->deleteInvoice($invoice);
$this->flashSuccess('action.delete.success');