jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

more csrf protection for invoice and search (#2984)

Browse Source
This commit is contained in:
Kevin Papst
2021-12-02 18:01:51 +01:00
committed by GitHub
parent b0045a910c
commit 4e42911f3d
7 changed files with 73 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
templates/invoice/actions.html.twig
View File

@@ -6,7 +6,7 @@
{% macro invoice(invoice, view) %}
{% import "macros/widgets.html.twig" as widgets %}
{% set event = actions(app.user, 'invoice', view, {'invoice': invoice, 'token': csrf_token('invoice.delete')}) %}
{% set event = actions(app.user, 'invoice', view, {'invoice': invoice, 'token': csrf_token('invoice.status')}) %}
{{ widgets.table_actions(event.actions) }}
{% endmacro %}

4
templates/invoice/index.html.twig
View File

@@ -218,7 +218,7 @@
const overwrites = {'customers[]': link.dataset['customer'], 'template': link.dataset['template']};
const uri = formPlugin.convertFormDataToQueryString(document.getElementById('{{ formId }}'), overwrites);
link.href = link.dataset['href'] + '?' + uri;
link.href = link.dataset['href'] + '?token={{ csrf_token('invoice.create') }}&' + uri;
return true;
}
@@ -228,7 +228,7 @@
const formPlugin = kimai.getPlugin('form');
const uri = formPlugin.convertFormDataToQueryString(document.getElementById('{{ formId }}'));
link.href = '{{ path('invoice') }}?createInvoice=true&' + uri;
link.href = '{{ path('invoice') }}?token={{ csrf_token('invoice.create') }}&createInvoice=true&' + uri;
return true;
}