pierre/wallabag
1
0
Fork 0
forked from wallabag/wallabag
Code Issues Pull Requests Packages Projects Releases 1 Wiki Activity

Protect delete_ignore_origin_rule with a CSRF token

Browse Source
This commit is contained in:
Yassine Guedidi
2025-03-18 23:57:18 +01:00
parent 264f91126e
commit 6fa61c0f9c
3 changed files with 18 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/Wallabag/CoreBundle/Controller/ConfigController.php
View File

@ -522,12 +522,16 @@ class ConfigController extends AbstractController
/**
* Deletes an ignore origin rule and redirect to the config homepage.
*
* @Route("/ignore-origin-user-rule/delete/{id}", requirements={"id" = "\d+"}, name="delete_ignore_origin_rule")
* @Route("/ignore-origin-user-rule/delete/{id}", name="delete_ignore_origin_rule", methods={"POST"}, requirements={"id" = "\d+"})
*
* @return RedirectResponse
*/
public function deleteIgnoreOriginRuleAction(IgnoreOriginUserRule $rule)
public function deleteIgnoreOriginRuleAction(Request $request, IgnoreOriginUserRule $rule)
{
if (!$this->isCsrfTokenValid('delete-ignore-origin-rule', $request->request->get('token'))) {
throw new BadRequestHttpException('Bad CSRF token.');
}
$this->validateRuleAction($rule);
$this->entityManager->remove($rule);