jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

more csrf protection for invoice and search (#2984)

Browse Source
This commit is contained in:
Kevin Papst
2021-12-02 18:01:51 +01:00
committed by GitHub
parent b0045a910c
commit 4e42911f3d
7 changed files with 73 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
templates/macros/search.html.twig
View File

@@ -40,6 +40,7 @@
{% endmacro %}
{% macro searchButton(form) %}
<input type="hidden" name="_token" value="{{ csrf_token('search') }}">
<div class="btn-group">
<button type="submit" name="performSearch" value="performSearch" class="btn btn-primary pull-left" data-type="submit">{{ 'search'|trans }}</button>
</div>
@@ -56,7 +57,7 @@
</button>
<ul class="dropdown-menu">
<li>
<a href="?removeDefaultQuery={{ form.vars.data.bookmark.name }}" id="removeDefaultQuery">{{ 'label.remove_default'|trans }}</a>
<a href="?_token={{ csrf_token('search') }}&removeDefaultQuery={{ form.vars.data.bookmark.name }}" id="removeDefaultQuery">{{ 'label.remove_default'|trans }}</a>
</li>
</ul>
{% else %}