jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

more csrf protection for invoice and search (#2984)

Browse Source
This commit is contained in:
Kevin Papst
2021-12-02 18:01:51 +01:00
committed by GitHub
parent b0045a910c
commit 4e42911f3d
7 changed files with 73 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
templates/invoice/index.html.twig
View File

@@ -218,7 +218,7 @@
const overwrites = {'customers[]': link.dataset['customer'], 'template': link.dataset['template']};
const uri = formPlugin.convertFormDataToQueryString(document.getElementById('{{ formId }}'), overwrites);
link.href = link.dataset['href'] + '?' + uri;
link.href = link.dataset['href'] + '?token={{ csrf_token('invoice.create') }}&' + uri;
return true;
}
@@ -228,7 +228,7 @@
const formPlugin = kimai.getPlugin('form');
const uri = formPlugin.convertFormDataToQueryString(document.getElementById('{{ formId }}'));
link.href = '{{ path('invoice') }}?createInvoice=true&' + uri;
link.href = '{{ path('invoice') }}?token={{ csrf_token('invoice.create') }}&createInvoice=true&' + uri;
return true;
}