pierre/wallabag
1
0
Fork 0
forked from wallabag/wallabag
Code Issues Pull Requests Packages Projects Releases 1 Wiki Activity

Protect archive_entry with a CSRF token

Browse Source
This commit is contained in:
Yassine Guedidi
2025-03-21 23:21:25 +01:00
parent 3817010e29
commit edffef8375
7 changed files with 73 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/Wallabag/CoreBundle/Controller/EntryController.php
View File

@ -434,12 +434,16 @@ class EntryController extends AbstractController
/**
* Changes read status for an entry.
*
* @Route("/archive/{id}", requirements={"id" = "\d+"}, name="archive_entry")
* @Route("/archive/{id}", name="archive_entry", methods={"POST"}, requirements={"id" = "\d+"})
*
* @return RedirectResponse
*/
public function toggleArchiveAction(Request $request, Entry $entry)
{
if (!$this->isCsrfTokenValid('archive-entry', $request->request->get('token'))) {
throw new BadRequestHttpException('Bad CSRF token.');
}
$this->checkUserAction($entry);
$entry->toggleArchive();