jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

prevent csrf to flush logs (#2930)

Browse Source
This commit is contained in:
Kevin Papst
2021-11-14 20:39:22 +01:00
committed by GitHub
parent 8b0962e192
commit 6b49535b52
2 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/Controller/DoctorController.php
View File

@@ -15,6 +15,8 @@ use PackageVersions\Versions;
use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Annotation\Route;
use Symfony\Component\Security\Csrf\CsrfToken;
use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
/**
* @Route(path="/doctor")
@@ -56,11 +58,19 @@ class DoctorController extends AbstractController
}
/**
* @Route(path="/flush-log", name="doctor_flush_log", methods={"GET"})
* @Route(path="/flush-log/{token}", name="doctor_flush_log", methods={"GET"})
* @Security("is_granted('system_configuration')")
*/
public function deleteLogfileAction(): Response
public function deleteLogfileAction(string $token, CsrfTokenManagerInterface $csrfTokenManager): Response
{
if (!$csrfTokenManager->isTokenValid(new CsrfToken('doctor.flush_log', $token))) {
$this->flashError('action.delete.error');
return $this->redirectToRoute('doctor');
}
$csrfTokenManager->refreshToken($token);
$logfile = $this->getLogFilename();
if (file_exists($logfile)) {