Merge remote-tracking branch 'origin/2.5.x'

src/Wallabag/CoreBundle/Controller/ConfigController.php

@@ -592,7 +592,7 @@ class ConfigController extends AbstractController
     /**
      * Delete account for current user.
      *
-     * @Route("/account/delete", name="delete_account")
+     * @Route("/account/delete", name="delete_account", methods={"POST"})
      *
      * @throws AccessDeniedHttpException
      *
@@ -600,6 +600,10 @@ class ConfigController extends AbstractController
      */
     public function deleteAccountAction(Request $request, UserRepository $userRepository, TokenStorageInterface $tokenStorage)
     {
+        if (!$this->isCsrfTokenValid('delete-account', $request->request->get('token'))) {
+            throw $this->createAccessDeniedException('Bad CSRF token.');
+        }
+
         $enabledUsers = $userRepository->getSumEnabledUsers();
 
         if ($enabledUsers <= 1) {

src/Wallabag/CoreBundle/Controller/ExportController.php

@@ -7,7 +7,6 @@ use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 use Symfony\Component\Routing\Annotation\Route;
-use Wallabag\CoreBundle\Entity\Entry;
 use Wallabag\CoreBundle\Helper\EntriesExport;
 use Wallabag\CoreBundle\Repository\EntryRepository;
 use Wallabag\CoreBundle\Repository\TagRepository;
@@ -28,9 +27,20 @@ class ExportController extends AbstractController
      *
      * @return Response
      */
-    public function downloadEntryAction(Entry $entry, EntriesExport $entriesExport, string $format)
+    public function downloadEntryAction(Request $request, EntryRepository $entryRepository, EntriesExport $entriesExport, string $format, int $id)
     {
         try {
+            $entry = $entryRepository->find($id);
+
+            /*
+             * We duplicate EntryController::checkUserAction here as a quick fix for an improper authorization vulnerability
+             *
+             * This should be eventually rewritten
+             */
+            if (null === $entry || null === $this->getUser() || $this->getUser()->getId() !== $entry->getUser()->getId()) {
+                throw new NotFoundHttpException();
+            }
+
             return $entriesExport
                 ->setEntries($entry)
                 ->updateTitle('entry')

src/Wallabag/CoreBundle/Controller/TagController.php

@@ -35,7 +35,7 @@ class TagController extends AbstractController
     }
 
     /**
-     * @Route("/new-tag/{entry}", requirements={"entry" = "\d+"}, name="new_tag")
+     * @Route("/new-tag/{entry}", requirements={"entry" = "\d+"}, name="new_tag", methods={"POST"})
      *
      * @return Response
      */
@@ -44,7 +44,17 @@ class TagController extends AbstractController
         $form = $this->createForm(NewTagType::class, new Tag());
         $form->handleRequest($request);
 
+        $tags = $form->get('label')->getData();
+        $tagsExploded = explode(',', $tags);
+
+        // avoid too much tag to be added
+        if (\count($tagsExploded) >= 5 || \strlen($tags) >= NewTagType::MAX_LENGTH) {
+            return $this->redirect($this->generateUrl('view', ['id' => $entry->getId()]));
+        }
+
         if ($form->isSubmitted() && $form->isValid()) {
+            $this->checkUserAction($entry);
+
             $this->tagsAssigner->assignTagsToEntry(
                 $entry,
                 $form->get('label')->getData()
@@ -76,6 +86,8 @@ class TagController extends AbstractController
      */
     public function removeTagFromEntry(Request $request, Entry $entry, Tag $tag)
     {
+        $this->checkUserAction($entry);
+
         $entry->removeTag($tag);
         $this->entityManager->flush();
 
@@ -260,4 +272,14 @@ class TagController extends AbstractController
 
         return $this->redirect($redirectUrl);
     }
+
+    /**
+     * Check if the logged user can manage the given entry.
+     */
+    private function checkUserAction(Entry $entry)
+    {
+        if (null === $this->getUser() || $this->getUser()->getId() !== $entry->getUser()->getId()) {
+            throw $this->createAccessDeniedException('You can not access this entry.');
+        }
+    }
 }

src/Wallabag/CoreBundle/Form/Type/NewTagType.php

@@ -11,6 +11,8 @@ use Wallabag\CoreBundle\Entity\Tag;
 
 class NewTagType extends AbstractType
 {
+    public const MAX_LENGTH = 40;
+
     public function buildForm(FormBuilderInterface $builder, array $options)
     {
         $builder
@@ -18,6 +20,7 @@ class NewTagType extends AbstractType
                 'required' => true,
                 'attr' => [
                     'placeholder' => 'tag.new.placeholder',
+                    'max_length' => self::MAX_LENGTH,
                 ],
             ])
             ->add('add', SubmitType::class, [

src/Wallabag/CoreBundle/Resources/views/Config/index.html.twig

@@ -561,9 +561,11 @@
                             <div class="row">
                                 <h5>{{ 'config.form_user.delete.title'|trans }}</h5>
                                 <p>{{ 'config.form_user.delete.description'|trans }}</p>
-                                <a href="{{ path('delete_account') }}" onclick="return confirm('{{ 'config.form_user.delete.confirm'|trans|escape('js') }}')" class="waves-effect waves-light btn red delete-account">
-                                    {{ 'config.form_user.delete.button'|trans }}
-                                </a>
+                                <form action="{{ path('delete_account') }}" method="post" onsubmit="return confirm('{{ 'config.form_user.delete.confirm'|trans|escape('js') }}')" name="delete-account">
+                                    <input type="hidden" name="token" value="{{ csrf_token('delete-account') }}" />
+
+                                    <button class="waves-effect waves-light btn red" type="submit">{{ 'config.form_user.delete.button'|trans }}</button>
+                                </form>
                             </div>
                         {% endif %}
                     </div>

src/Wallabag/CoreBundle/Resources/views/Entry/share.html.twig

@@ -28,7 +28,7 @@
         <header class="block">
             <h1>{{ entry.title|e|raw }}</h1>
             <a href="{{ entry.url|e }}" target="_blank" rel="noopener" title="{{ 'entry.view.original_article'|trans }} : {{ entry.title|e|raw }}" class="tool">{{ entry.domainName|removeWww }}</a>
-            <p class="shared-by">{{ "entry.public.shared_by_wallabag"|trans({'%wallabag_instance%': url('homepage'), '%username%': entry.user.username})|raw }}.</p>
+            <p class="shared-by">{{ "entry.public.shared_by_wallabag"|trans({'%wallabag_instance%': url('homepage'), '%username%': entry.user.username|escape})|raw }}.</p>
         </header>
         <article class="block">
             {{ entry.content|raw }}