jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

improve csrf handling (#2936)

Browse Source
This commit is contained in:
Kevin Papst
2021-11-16 10:17:26 +01:00
committed by GitHub
parent a1992494d3
commit 95796ab256
15 changed files with 122 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/Controller/InvoiceController.php
View File

@@ -260,7 +260,7 @@ final class InvoiceController extends AbstractController
public function deleteInvoiceAction(Invoice $invoice, string $token, CsrfTokenManagerInterface $csrfTokenManager): Response
{
if (!$csrfTokenManager->isTokenValid(new CsrfToken('invoice.delete', $token))) {
$this->flashError('action.delete.error');
$this->flashError('action.csrf.error');
return $this->redirectToRoute('admin_invoice_list');
}
@@ -451,11 +451,19 @@ final class InvoiceController extends AbstractController
}
/**
* @Route(path="/template/{id}/delete", name="admin_invoice_template_delete", methods={"GET", "POST"})
* @Route(path="/template/{id}/delete/{token}", name="admin_invoice_template_delete", methods={"GET", "POST"})
* @Security("is_granted('manage_invoice_template')")
*/
public function deleteTemplate(InvoiceTemplate $template): Response
public function deleteTemplate(InvoiceTemplate $template, string $token, CsrfTokenManagerInterface $csrfTokenManager): Response
{
if (!$csrfTokenManager->isTokenValid(new CsrfToken('invoice.delete_template', $token))) {
$this->flashError('action.csrf.error');
return $this->redirectToRoute('admin_invoice_template');
}
$csrfTokenManager->refreshToken($token);
try {
$this->templateRepository->removeTemplate($template);
$this->flashSuccess('action.delete.success');