Protect mass_action with a CSRF token

2025-03-30 05:58:54 +02:00
parent 27f0d94db7
commit 5ea5115a72
3 changed files with 24 additions and 2 deletions
--- a/src/Wallabag/CoreBundle/Controller/EntryController.php
+++ b/src/Wallabag/CoreBundle/Controller/EntryController.php
@ -53,12 +53,16 @@ class EntryController extends AbstractController
    }

    /**
-     * @Route("/mass", name="mass_action")
+     * @Route("/mass", name="mass_action", methods={"POST"})
     *
     * @return Response
     */
    public function massAction(Request $request, TagRepository $tagRepository)
    {
+        if (!$this->isCsrfTokenValid('mass-action', $request->request->get('token'))) {
+            throw new BadRequestHttpException('Bad CSRF token.');
+        }
+
        $values = $request->request->all();

        $tagsToAdd = [];