jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fix invoice preview (#3002)

Browse Source
This commit is contained in:
Kevin Papst
2021-12-08 14:21:15 +01:00
committed by GitHub
parent ec9dd08970
commit 82525f382d
4 changed files with 30 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
src/Controller/InvoiceController.php
View File

@@ -144,9 +144,26 @@ final class InvoiceController extends AbstractController
return $this->redirectToRoute('invoice');
}
$token = null;
if ($request->query->has('token')) {
$token = $request->query->get('token');
$request->query->remove('token');
}
if (!$this->isCsrfTokenValid('invoice.preview', $token)) {
$this->flashError('action.csrf.error');
return $this->redirectToRoute('invoice');
}
// do not refresh token, preview is opening in new tabs and the listing page does not reload
// so the new token would not be loaded
$query = $this->getDefaultQuery();
$form = $this->getToolbarForm($query, $configuration->find('invoice.simple_form'));
$form->submit($request->query->all(), false);
if ($this->handleSearch($form, $request)) {
return $this->redirectToRoute('invoice');
}
if ($form->isValid()) {
try {

2
templates/invoice/index.html.twig
View File

@@ -218,7 +218,7 @@
const overwrites = {'customers[]': link.dataset['customer'], 'template': link.dataset['template']};
const uri = formPlugin.convertFormDataToQueryString(document.getElementById('{{ formId }}'), overwrites);
link.href = link.dataset['href'] + '?token={{ csrf_token('invoice.create') }}&' + uri;
link.href = link.dataset['href'] + '?token={{ csrf_token('invoice.preview') }}&' + uri;
return true;
}

10
templates/timesheet/layout-edit.html.twig
View File

@@ -114,15 +114,15 @@
{% if form.begin is defined and form.end is defined and form.duration is defined %}
{% set blockPrefix = form.vars.id %}
<script type="text/javascript">
$('body').on('change', '#{{ blockPrefix }}_begin', function(ev) {
changedBegin($(this).val());
jQuery('body').on('change', '#{{ blockPrefix }}_begin', function(ev) {
changedBegin(jQuery(this).val());
});
$('body').on('change', '#{{ blockPrefix }}_end', function(ev) {
changedEnd($(this).val());
jQuery('body').on('change', '#{{ blockPrefix }}_end', function(ev) {
changedEnd(jQuery(this).val());
});
$('body').on('change', '#{{ blockPrefix }}_duration', function(ev) {
jQuery('body').on('change', '#{{ blockPrefix }}_duration', function(ev) {
changedDuration();
});

6
tests/Controller/InvoiceControllerTest.php
View File

@@ -17,6 +17,7 @@ use App\Form\Type\DateRangeType;
use App\Tests\DataFixtures\InvoiceTemplateFixtures;
use App\Tests\DataFixtures\TimesheetFixtures;
use Symfony\Component\HttpFoundation\BinaryFileResponse;
use Symfony\Component\Security\Csrf\CsrfToken;
/**
* @group integration
@@ -190,6 +191,7 @@ class InvoiceControllerTest extends ControllerBaseTest
'markAsExported' => 1,
];
/** @var CsrfToken $token */
$token = self::$container->get('security.csrf.token_manager')->getToken('invoice.create');
$action = '/invoice/save-invoice/1/' . $template->getId() . '?token=' . $token->getValue() . '&' . http_build_query($urlParams);
@@ -232,7 +234,11 @@ class InvoiceControllerTest extends ControllerBaseTest
$dateRange = $begin->format('Y-m-d') . DateRangeType::DATE_SPACER . $end->format('Y-m-d');
/** @var CsrfToken $token */
$token = self::$container->get('security.csrf.token_manager')->getToken('invoice.preview');
$params = [
'token' => $token->getValue(),
'daterange' => $dateRange,
'projects' => [1],
'template' => $id,