archive/kevinpapst_kimai2
0
0
Fork 0
mirror of https://github.com/kevinpapst/kimai2.git synced 2025-04-03 13:05:24 +00:00
Code Issues Projects Releases Wiki Activity

prevent csrf to flush logs ()

Browse source
This commit is contained in:
Kevin Papst 2021-11-14 20:39:22 +01:00 • committed by GitHub
parent 8b0962e192
commit 6b49535b52
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 13 additions and 3 deletions
src/Controller
DoctorController.php
templates/doctor
index.html.twig

14
src/Controller/DoctorController.php
View file

@ -15,6 +15,8 @@ use PackageVersions\Versions;
use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Annotation\Route;
use Symfony\Component\Security\Csrf\CsrfToken;
use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
/**
* @Route(path="/doctor")
@ -56,11 +58,19 @@ class DoctorController extends AbstractController
}
/**
* @Route(path="/flush-log", name="doctor_flush_log", methods={"GET"})
* @Route(path="/flush-log/{token}", name="doctor_flush_log", methods={"GET"})
* @Security("is_granted('system_configuration')")
*/
public function deleteLogfileAction(): Response
public function deleteLogfileAction(string $token, CsrfTokenManagerInterface $csrfTokenManager): Response
{
if (!$csrfTokenManager->isTokenValid(new CsrfToken('doctor.flush_log', $token))) {
$this->flashError('action.delete.error');
return $this->redirectToRoute('doctor');
}
$csrfTokenManager->refreshToken($token);
$logfile = $this->getLogFilename();
if (file_exists($logfile)) {

2
templates/doctor/index.html.twig
View file

@ -80,7 +80,7 @@
{% block box_title %}Logfile (max. {{ logLines }} last lines){% endblock %}
{% block box_tools %}
{% if log_delete %}
<a class="btn-box-tool confirmation-link" href="{{ path('doctor_flush_log') }}" data-question="confirm.delete"><i class="{{ 'delete'|icon }}"></i></a>
<a class="btn-box-tool confirmation-link" href="{{ path('doctor_flush_log', {'token': csrf_token('doctor.flush_log')}) }}" data-question="confirm.delete"><i class="{{ 'delete'|icon }}"></i></a>
{% endif %}
{% endblock %}
{% block box_body %}