From 82525f382d397aaa9d6e31dd1fead4a65e170fc2 Mon Sep 17 00:00:00 2001
From: Kevin Papst <kevinpapst@users.noreply.github.com>
Date: Wed, 8 Dec 2021 14:21:15 +0100
Subject: [PATCH] fix invoice preview (#3002)

---
 src/Controller/InvoiceController.php       | 19 ++++++++++++++++++-
 templates/invoice/index.html.twig          |  2 +-
 templates/timesheet/layout-edit.html.twig  | 10 +++++-----
 tests/Controller/InvoiceControllerTest.php |  6 ++++++
 4 files changed, 30 insertions(+), 7 deletions(-)

diff --git a/src/Controller/InvoiceController.php b/src/Controller/InvoiceController.php
index d1a209d4..8e1f351c 100644
--- a/src/Controller/InvoiceController.php
+++ b/src/Controller/InvoiceController.php
@@ -144,9 +144,26 @@ final class InvoiceController extends AbstractController
             return $this->redirectToRoute('invoice');
         }
 
+        $token = null;
+        if ($request->query->has('token')) {
+            $token = $request->query->get('token');
+            $request->query->remove('token');
+        }
+
+        if (!$this->isCsrfTokenValid('invoice.preview', $token)) {
+            $this->flashError('action.csrf.error');
+
+            return $this->redirectToRoute('invoice');
+        }
+
+        // do not refresh token, preview is opening in new tabs and the listing page does not reload
+        // so the new token would not be loaded
+
         $query = $this->getDefaultQuery();
         $form = $this->getToolbarForm($query, $configuration->find('invoice.simple_form'));
-        $form->submit($request->query->all(), false);
+        if ($this->handleSearch($form, $request)) {
+            return $this->redirectToRoute('invoice');
+        }
 
         if ($form->isValid()) {
             try {
diff --git a/templates/invoice/index.html.twig b/templates/invoice/index.html.twig
index 816bb93b..f712cbd4 100644
--- a/templates/invoice/index.html.twig
+++ b/templates/invoice/index.html.twig
@@ -218,7 +218,7 @@
             const overwrites = {'customers[]': link.dataset['customer'], 'template': link.dataset['template']};
             const uri = formPlugin.convertFormDataToQueryString(document.getElementById('{{ formId }}'), overwrites);
 
-            link.href = link.dataset['href'] + '?token={{ csrf_token('invoice.create') }}&' + uri;
+            link.href = link.dataset['href'] + '?token={{ csrf_token('invoice.preview') }}&' + uri;
 
             return true;
         }
diff --git a/templates/timesheet/layout-edit.html.twig b/templates/timesheet/layout-edit.html.twig
index 4ca2a9c2..7c6ddaa3 100644
--- a/templates/timesheet/layout-edit.html.twig
+++ b/templates/timesheet/layout-edit.html.twig
@@ -114,15 +114,15 @@
             {% if form.begin is defined and form.end is defined and form.duration is defined %}
                 {% set blockPrefix = form.vars.id %}
                 <script type="text/javascript">
-                    $('body').on('change', '#{{ blockPrefix }}_begin', function(ev) {
-                        changedBegin($(this).val());
+                    jQuery('body').on('change', '#{{ blockPrefix }}_begin', function(ev) {
+                        changedBegin(jQuery(this).val());
                     });
 
-                    $('body').on('change', '#{{ blockPrefix }}_end', function(ev) {
-                        changedEnd($(this).val());
+                    jQuery('body').on('change', '#{{ blockPrefix }}_end', function(ev) {
+                        changedEnd(jQuery(this).val());
                     });
 
-                    $('body').on('change', '#{{ blockPrefix }}_duration', function(ev) {
+                    jQuery('body').on('change', '#{{ blockPrefix }}_duration', function(ev) {
                         changedDuration();
                     });
 
diff --git a/tests/Controller/InvoiceControllerTest.php b/tests/Controller/InvoiceControllerTest.php
index 80f8d156..7f8403f3 100644
--- a/tests/Controller/InvoiceControllerTest.php
+++ b/tests/Controller/InvoiceControllerTest.php
@@ -17,6 +17,7 @@ use App\Form\Type\DateRangeType;
 use App\Tests\DataFixtures\InvoiceTemplateFixtures;
 use App\Tests\DataFixtures\TimesheetFixtures;
 use Symfony\Component\HttpFoundation\BinaryFileResponse;
+use Symfony\Component\Security\Csrf\CsrfToken;
 
 /**
  * @group integration
@@ -190,6 +191,7 @@ class InvoiceControllerTest extends ControllerBaseTest
             'markAsExported' => 1,
         ];
 
+        /** @var CsrfToken $token */
         $token = self::$container->get('security.csrf.token_manager')->getToken('invoice.create');
 
         $action = '/invoice/save-invoice/1/' . $template->getId() . '?token=' . $token->getValue() . '&' . http_build_query($urlParams);
@@ -232,7 +234,11 @@ class InvoiceControllerTest extends ControllerBaseTest
 
         $dateRange = $begin->format('Y-m-d') . DateRangeType::DATE_SPACER . $end->format('Y-m-d');
 
+        /** @var CsrfToken $token */
+        $token = self::$container->get('security.csrf.token_manager')->getToken('invoice.preview');
+
         $params = [
+            'token' => $token->getValue(),
             'daterange' => $dateRange,
             'projects' => [1],
             'template' => $id,