jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

unify CSRF token usage in comment sections (#4986)

Browse Source
This commit is contained in:
Kevin Papst
2024-07-23 08:33:02 +02:00
committed by GitHub
parent 7e1025d61d
commit 8b06ca9d10
5 changed files with 13 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/Controller/CustomerController.php
View File

@@ -185,13 +185,13 @@ final class CustomerController extends AbstractController
{
$customerId = $comment->getCustomer()->getId();
if (!$csrfTokenManager->isTokenValid(new CsrfToken('customer.delete_comment', $token))) {
if (!$csrfTokenManager->isTokenValid(new CsrfToken('comment.delete', $token))) {
$this->flashError('action.csrf.error');
return $this->redirectToRoute('customer_details', ['id' => $customerId]);
}
$csrfTokenManager->refreshToken('customer.delete_comment');
$csrfTokenManager->refreshToken('comment.delete');
try {
$this->repository->deleteComment($comment);
@@ -228,13 +228,13 @@ final class CustomerController extends AbstractController
{
$customerId = $comment->getCustomer()->getId();
if (!$csrfTokenManager->isTokenValid(new CsrfToken('customer.pin_comment', $token))) {
if (!$csrfTokenManager->isTokenValid(new CsrfToken('comment.pin', $token))) {
$this->flashError('action.csrf.error');
return $this->redirectToRoute('customer_details', ['id' => $customerId]);
}
$csrfTokenManager->refreshToken('customer.pin_comment');
$csrfTokenManager->refreshToken('comment.pin');
$comment->setPinned(!$comment->isPinned());
try {

8
src/Controller/ProjectController.php
View File

@@ -218,13 +218,13 @@ final class ProjectController extends AbstractController
{
$projectId = $comment->getProject()->getId();
if (!$csrfTokenManager->isTokenValid(new CsrfToken('project.delete_comment', $token))) {
if (!$csrfTokenManager->isTokenValid(new CsrfToken('comment.delete', $token))) {
$this->flashError('action.csrf.error');
return $this->redirectToRoute('project_details', ['id' => $projectId]);
}
$csrfTokenManager->refreshToken('project.delete_comment');
$csrfTokenManager->refreshToken('comment.delete');
try {
$this->repository->deleteComment($comment);
@@ -261,13 +261,13 @@ final class ProjectController extends AbstractController
{
$projectId = $comment->getProject()->getId();
if (!$csrfTokenManager->isTokenValid(new CsrfToken('project.pin_comment', $token))) {
if (!$csrfTokenManager->isTokenValid(new CsrfToken('comment.pin', $token))) {
$this->flashError('action.csrf.error');
return $this->redirectToRoute('project_details', ['id' => $projectId]);
}
$csrfTokenManager->refreshToken('project.pin_comment');
$csrfTokenManager->refreshToken('comment.pin');
$comment->setPinned(!$comment->isPinned());
try {