jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Update CSRF Token IDs for Issue kevinpapst/kimai2#2947 (#2948)

Browse Source 
* bump version
* removed not needed token, as it is already contained in the form
Co-authored-by: Kevin Papst <kpapst@gmx.net>
This commit is contained in:
tdozbun-reno
2021-11-18 11:32:00 -06:00
committed by GitHub
parent b28e9c120c
commit 56d02673ed
16 changed files with 35 additions and 113 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/Controller/CustomerController.php
View File

@@ -172,7 +172,7 @@ final class CustomerController extends AbstractController
return $this->redirectToRoute('customer_details', ['id' => $customerId]);
}
$csrfTokenManager->refreshToken($token);
$csrfTokenManager->refreshToken('customer.delete_comment');
try {
$this->repository->deleteComment($comment);
@@ -219,7 +219,7 @@ final class CustomerController extends AbstractController
return $this->redirectToRoute('customer_details', ['id' => $customerId]);
}
$csrfTokenManager->refreshToken($token);
$csrfTokenManager->refreshToken('customer.pin_comment');
$comment->setPinned(!$comment->isPinned());
try {

2
src/Controller/DoctorController.php
View File

@@ -69,7 +69,7 @@ class DoctorController extends AbstractController
return $this->redirectToRoute('doctor');
}
$csrfTokenManager->refreshToken($token);
$csrfTokenManager->refreshToken('doctor.flush_log');
$logfile = $this->getLogFilename();

4
src/Controller/InvoiceController.php
View File

@@ -265,7 +265,7 @@ final class InvoiceController extends AbstractController
return $this->redirectToRoute('admin_invoice_list');
}
$csrfTokenManager->refreshToken($token);
$csrfTokenManager->refreshToken('invoice.delete');
try {
$this->service->deleteInvoice($invoice);
@@ -462,7 +462,7 @@ final class InvoiceController extends AbstractController
return $this->redirectToRoute('admin_invoice_template');
}
$csrfTokenManager->refreshToken($token);
$csrfTokenManager->refreshToken('invoice.delete_template');
try {
$this->templateRepository->removeTemplate($template);

6
src/Controller/ProjectController.php
View File

@@ -194,7 +194,7 @@ final class ProjectController extends AbstractController
return $this->redirectToRoute('project_details', ['id' => $projectId]);
}
$csrfTokenManager->refreshToken($token);
$csrfTokenManager->refreshToken('project.delete_comment');
try {
$this->repository->deleteComment($comment);
@@ -241,7 +241,7 @@ final class ProjectController extends AbstractController
return $this->redirectToRoute('project_details', ['id' => $projectId]);
}
$csrfTokenManager->refreshToken($token);
$csrfTokenManager->refreshToken('project.pin_comment');
$comment->setPinned(!$comment->isPinned());
try {
@@ -432,7 +432,7 @@ final class ProjectController extends AbstractController
return $this->redirectToRoute('project_details', ['id' => $project->getId()]);
}
$csrfTokenManager->refreshToken($token);
$csrfTokenManager->refreshToken('project.duplicate');
$newProject = $projectDuplicationService->duplicate($project, $project->getName() . ' [COPY]');

2
src/Controller/TeamController.php
View File

@@ -94,7 +94,7 @@ final class TeamController extends AbstractController
return $this->redirectToRoute('admin_team_edit', ['id' => $team->getId()]);
}
$csrfTokenManager->refreshToken($token);
$csrfTokenManager->refreshToken('team.duplicate');
$newTeam = clone $team;
$newTeam->setName($team->getName() . ' [COPY]');

6
src/Controller/TimesheetAbstractController.php
View File

@@ -211,14 +211,14 @@ abstract class TimesheetAbstractController extends AbstractController
]);
}
protected function duplicate(Timesheet $timesheet, Request $request, string $renderTemplate, string $token): Response
protected function duplicate(Timesheet $timesheet, Request $request, string $renderTemplate): Response
{
$copyTimesheet = clone $timesheet;
$event = new TimesheetMetaDefinitionEvent($copyTimesheet);
$this->dispatcher->dispatch($event);
$form = $this->getDuplicateForm($copyTimesheet, $timesheet, $token);
$form = $this->getDuplicateForm($copyTimesheet, $timesheet);
$form->handleRequest($request);
if ($form->isSubmitted() && $form->isValid()) {
@@ -612,7 +612,7 @@ abstract class TimesheetAbstractController extends AbstractController
return $query;
}
abstract protected function getDuplicateForm(Timesheet $entry, Timesheet $original, string $token): FormInterface;
abstract protected function getDuplicateForm(Timesheet $entry, Timesheet $original): FormInterface;
abstract protected function getCreateForm(Timesheet $entry): FormInterface;
}

20
src/Controller/TimesheetController.php
View File

@@ -21,8 +21,6 @@ use Symfony\Component\Form\FormInterface;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Annotation\Route;
use Symfony\Component\Security\Csrf\CsrfToken;
use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
/**
* @Route(path="/timesheet")
@@ -62,20 +60,12 @@ class TimesheetController extends TimesheetAbstractController
}
/**
* @Route(path="/{id}/duplicate/{token}", name="timesheet_duplicate", methods={"GET", "POST"})
* @Route(path="/{id}/duplicate", name="timesheet_duplicate", methods={"GET", "POST"})
* @Security("is_granted('duplicate', entry)")
*/
public function duplicateAction(Timesheet $entry, Request $request, string $token, CsrfTokenManagerInterface $csrfTokenManager): Response
public function duplicateAction(Timesheet $entry, Request $request): Response
{
if (!$csrfTokenManager->isTokenValid(new CsrfToken('timesheet.duplicate', $token))) {
$this->flashError('action.csrf.error');
return $this->redirectToRoute('timesheet');
}
$csrfTokenManager->refreshToken($token);
return $this->duplicate($entry, $request, 'timesheet/edit.html.twig', $token);
return $this->duplicate($entry, $request, 'timesheet/edit.html.twig');
}
/**
@@ -110,8 +100,8 @@ class TimesheetController extends TimesheetAbstractController
return $this->generateCreateForm($entry, TimesheetEditForm::class, $this->generateUrl('timesheet_create'));
}
protected function getDuplicateForm(Timesheet $entry, Timesheet $original, string $token): FormInterface
protected function getDuplicateForm(Timesheet $entry, Timesheet $original): FormInterface
{
return $this->generateCreateForm($entry, TimesheetEditForm::class, $this->generateUrl('timesheet_duplicate', ['id' => $original->getId(), 'token' => $token]));
return $this->generateCreateForm($entry, TimesheetEditForm::class, $this->generateUrl('timesheet_duplicate', ['id' => $original->getId()]));
}
}

20
src/Controller/TimesheetTeamController.php
View File

@@ -28,8 +28,6 @@ use Symfony\Component\Form\FormInterface;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Annotation\Route;
use Symfony\Component\Security\Csrf\CsrfToken;
use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
/**
* @Route(path="/team/timesheet")
@@ -73,20 +71,12 @@ class TimesheetTeamController extends TimesheetAbstractController
}
/**
* @Route(path="/{id}/duplicate/{token}", name="admin_timesheet_duplicate", methods={"GET", "POST"})
* @Route(path="/{id}/duplicate", name="admin_timesheet_duplicate", methods={"GET", "POST"})
* @Security("is_granted('duplicate', entry)")
*/
public function duplicateAction(Timesheet $entry, Request $request, string $token, CsrfTokenManagerInterface $csrfTokenManager): Response
public function duplicateAction(Timesheet $entry, Request $request): Response
{
if (!$csrfTokenManager->isTokenValid(new CsrfToken('admin_timesheet.duplicate', $token))) {
$this->flashError('action.csrf.error');
return $this->redirectToRoute('admin_timesheet');
}
$csrfTokenManager->refreshToken($token);
return $this->duplicate($entry, $request, 'timesheet-team/edit.html.twig', $token);
return $this->duplicate($entry, $request, 'timesheet-team/edit.html.twig');
}
/**
@@ -205,9 +195,9 @@ class TimesheetTeamController extends TimesheetAbstractController
return $this->generateCreateForm($entry, TimesheetAdminEditForm::class, $this->generateUrl('admin_timesheet_create'));
}
protected function getDuplicateForm(Timesheet $entry, Timesheet $original, string $token): FormInterface
protected function getDuplicateForm(Timesheet $entry, Timesheet $original): FormInterface
{
return $this->generateCreateForm($entry, TimesheetAdminEditForm::class, $this->generateUrl('admin_timesheet_duplicate', ['id' => $original->getId(), 'token' => $token]));
return $this->generateCreateForm($entry, TimesheetAdminEditForm::class, $this->generateUrl('admin_timesheet_duplicate', ['id' => $original->getId()]));
}
protected function getPermissionEditExport(): string