jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

improve csrf handling (#2936)

Browse Source
This commit is contained in:
Kevin Papst
2021-11-16 10:17:26 +01:00
committed by GitHub
parent a1992494d3
commit 95796ab256
15 changed files with 122 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
src/Controller/CustomerController.php
View File

@@ -41,6 +41,8 @@ use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Annotation\Route;
use Symfony\Component\Security\Csrf\CsrfToken;
use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
/**
* Controller used to manage customer in the admin part of the site.
@@ -157,13 +159,21 @@ final class CustomerController extends AbstractController
}
/**
* @Route(path="/{id}/comment_delete", name="customer_comment_delete", methods={"GET"})
* @Route(path="/{id}/comment_delete/{token}", name="customer_comment_delete", methods={"GET"})
* @Security("is_granted('edit', comment.getCustomer()) and is_granted('comments', comment.getCustomer())")
*/
public function deleteCommentAction(CustomerComment $comment)
public function deleteCommentAction(CustomerComment $comment, string $token, CsrfTokenManagerInterface $csrfTokenManager)
{
$customerId = $comment->getCustomer()->getId();
if (!$csrfTokenManager->isTokenValid(new CsrfToken('customer.delete_comment', $token))) {
$this->flashError('action.csrf.error');
return $this->redirectToRoute('customer_details', ['id' => $customerId]);
}
$csrfTokenManager->refreshToken($token);
try {
$this->repository->deleteComment($comment);
} catch (\Exception $ex) {
@@ -196,11 +206,21 @@ final class CustomerController extends AbstractController
}
/**
* @Route(path="/{id}/comment_pin", name="customer_comment_pin", methods={"GET"})
* @Route(path="/{id}/comment_pin/{token}", name="customer_comment_pin", methods={"GET"})
* @Security("is_granted('edit', comment.getCustomer()) and is_granted('comments', comment.getCustomer())")
*/
public function pinCommentAction(CustomerComment $comment)
public function pinCommentAction(CustomerComment $comment, string $token, CsrfTokenManagerInterface $csrfTokenManager)
{
$customerId = $comment->getCustomer()->getId();
if (!$csrfTokenManager->isTokenValid(new CsrfToken('customer.pin_comment', $token))) {
$this->flashError('action.csrf.error');
return $this->redirectToRoute('customer_details', ['id' => $customerId]);
}
$csrfTokenManager->refreshToken($token);
$comment->setPinned(!$comment->isPinned());
try {
$this->repository->saveComment($comment);
@@ -208,7 +228,7 @@ final class CustomerController extends AbstractController
$this->flashUpdateException($ex);
}
return $this->redirectToRoute('customer_details', ['id' => $comment->getCustomer()->getId()]);
return $this->redirectToRoute('customer_details', ['id' => $customerId]);
}
/**

2
src/Controller/DoctorController.php
View File

@@ -64,7 +64,7 @@ class DoctorController extends AbstractController
public function deleteLogfileAction(string $token, CsrfTokenManagerInterface $csrfTokenManager): Response
{
if (!$csrfTokenManager->isTokenValid(new CsrfToken('doctor.flush_log', $token))) {
$this->flashError('action.delete.error');
$this->flashError('action.csrf.error');
return $this->redirectToRoute('doctor');
}

14
src/Controller/InvoiceController.php
View File

@@ -260,7 +260,7 @@ final class InvoiceController extends AbstractController
public function deleteInvoiceAction(Invoice $invoice, string $token, CsrfTokenManagerInterface $csrfTokenManager): Response
{
if (!$csrfTokenManager->isTokenValid(new CsrfToken('invoice.delete', $token))) {
$this->flashError('action.delete.error');
$this->flashError('action.csrf.error');
return $this->redirectToRoute('admin_invoice_list');
}
@@ -451,11 +451,19 @@ final class InvoiceController extends AbstractController
}
/**
* @Route(path="/template/{id}/delete", name="admin_invoice_template_delete", methods={"GET", "POST"})
* @Route(path="/template/{id}/delete/{token}", name="admin_invoice_template_delete", methods={"GET", "POST"})
* @Security("is_granted('manage_invoice_template')")
*/
public function deleteTemplate(InvoiceTemplate $template): Response
public function deleteTemplate(InvoiceTemplate $template, string $token, CsrfTokenManagerInterface $csrfTokenManager): Response
{
if (!$csrfTokenManager->isTokenValid(new CsrfToken('invoice.delete_template', $token))) {
$this->flashError('action.csrf.error');
return $this->redirectToRoute('admin_invoice_template');
}
$csrfTokenManager->refreshToken($token);
try {
$this->templateRepository->removeTemplate($template);
$this->flashSuccess('action.delete.success');

2
src/Controller/PermissionController.php
View File

@@ -209,7 +209,7 @@ final class PermissionController extends AbstractController
public function deleteRole(Role $role, string $csrfToken, UserRepository $userRepository, CsrfTokenManagerInterface $csrfTokenManager): Response
{
if (!$this->isCsrfTokenValid(self::TOKEN_NAME, $csrfToken)) {
$this->flashUpdateException(new \Exception('Invalid CSRF token'));
$this->flashError('action.csrf.error');
return $this->redirectToRoute('admin_user_permissions');
}

30
src/Controller/ProjectController.php
View File

@@ -43,6 +43,8 @@ use Symfony\Component\EventDispatcher\EventDispatcherInterface;
use Symfony\Component\Form\FormInterface;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\Routing\Annotation\Route;
use Symfony\Component\Security\Csrf\CsrfToken;
use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
/**
* Controller used to manage projects.
@@ -179,13 +181,21 @@ final class ProjectController extends AbstractController
}
/**
* @Route(path="/{id}/comment_delete", name="project_comment_delete", methods={"GET"})
* @Route(path="/{id}/comment_delete/{token}", name="project_comment_delete", methods={"GET"})
* @Security("is_granted('edit', comment.getProject()) and is_granted('comments', comment.getProject())")
*/
public function deleteCommentAction(ProjectComment $comment)
public function deleteCommentAction(ProjectComment $comment, string $token, CsrfTokenManagerInterface $csrfTokenManager)
{
$projectId = $comment->getProject()->getId();
if (!$csrfTokenManager->isTokenValid(new CsrfToken('project.delete_comment', $token))) {
$this->flashError('action.csrf.error');
return $this->redirectToRoute('project_details', ['id' => $projectId]);
}
$csrfTokenManager->refreshToken($token);
try {
$this->repository->deleteComment($comment);
} catch (\Exception $ex) {
@@ -218,11 +228,21 @@ final class ProjectController extends AbstractController
}
/**
* @Route(path="/{id}/comment_pin", name="project_comment_pin", methods={"GET"})
* @Route(path="/{id}/comment_pin/{token}", name="project_comment_pin", methods={"GET"})
* @Security("is_granted('edit', comment.getProject()) and is_granted('comments', comment.getProject())")
*/
public function pinCommentAction(ProjectComment $comment)
public function pinCommentAction(ProjectComment $comment, string $token, CsrfTokenManagerInterface $csrfTokenManager)
{
$projectId = $comment->getProject()->getId();
if (!$csrfTokenManager->isTokenValid(new CsrfToken('project.pin_comment', $token))) {
$this->flashError('action.csrf.error');
return $this->redirectToRoute('project_details', ['id' => $projectId]);
}
$csrfTokenManager->refreshToken($token);
$comment->setPinned(!$comment->isPinned());
try {
$this->repository->saveComment($comment);
@@ -230,7 +250,7 @@ final class ProjectController extends AbstractController
$this->flashUpdateException($ex);
}
return $this->redirectToRoute('project_details', ['id' => $comment->getProject()->getId()]);
return $this->redirectToRoute('project_details', ['id' => $projectId]);
}
/**