From c161bb013e091c0bcc524f07d50c028d9daf8cce Mon Sep 17 00:00:00 2001 From: John Olheiser Date: Tue, 25 Feb 2020 14:28:47 -0600 Subject: [PATCH] Change action GETs to POST (#10462) * Change action GETs to POST * submite = submit + smite * No more # href * Fix test * Match other tests * Explicit csrf Signed-off-by: jolheiser Co-authored-by: guillep2k <18600385+guillep2k@users.noreply.github.com> --- integrations/release_test.go | 2 +- routers/routes/routes.go | 12 ++++----- templates/org/member/members.tmpl | 4 +-- templates/org/team/members.tmpl | 5 +++- templates/org/team/repositories.tmpl | 5 +++- templates/org/team/sidebar.tmpl | 10 ++++++-- templates/org/team/teams.tmpl | 10 ++++++-- templates/repo/header.tmpl | 38 ++++++++++++++++------------ templates/repo/issue/milestones.tmpl | 4 +-- templates/user/profile.tmpl | 10 ++++++-- web_src/js/index.js | 14 ++++++++++ 11 files changed, 79 insertions(+), 35 deletions(-) diff --git a/integrations/release_test.go b/integrations/release_test.go index 33badcb0a..be0abd5e3 100644 --- a/integrations/release_test.go +++ b/integrations/release_test.go @@ -20,7 +20,7 @@ func createNewRelease(t *testing.T, session *TestSession, repoURL, tag, title st resp := session.MakeRequest(t, req, http.StatusOK) htmlDoc := NewHTMLParser(t, resp.Body) - link, exists := htmlDoc.doc.Find("form").Attr("action") + link, exists := htmlDoc.doc.Find("form.ui.form").Attr("action") assert.True(t, exists, "The template has changed") postData := map[string]string{ diff --git a/routers/routes/routes.go b/routers/routes/routes.go index 525115fb9..69745f6eb 100644 --- a/routers/routes/routes.go +++ b/routers/routes/routes.go @@ -502,7 +502,7 @@ func RegisterRoutes(m *macaron.Macaron) { }, reqSignIn) m.Group("/:username", func() { - m.Get("/action/:action", user.Action) + m.Post("/action/:action", user.Action) }, reqSignIn) if macaron.Env == macaron.DEV { @@ -534,7 +534,7 @@ func RegisterRoutes(m *macaron.Macaron) { m.Get("/^:type(issues|pulls)$", user.Issues) m.Get("/milestones", reqMilestonesDashboardPageEnabled, user.Milestones) m.Get("/members", org.Members) - m.Get("/members/action/:action", org.MembersAction) + m.Post("/members/action/:action", org.MembersAction) m.Get("/teams", org.Teams) }, context.OrgAssignment(true)) @@ -542,8 +542,8 @@ func RegisterRoutes(m *macaron.Macaron) { m.Group("/:org", func() { m.Get("/teams/:team", org.TeamMembers) m.Get("/teams/:team/repositories", org.TeamRepositories) - m.Route("/teams/:team/action/:action", "GET,POST", org.TeamsAction) - m.Route("/teams/:team/action/repo/:action", "GET,POST", org.TeamsRepoAction) + m.Post("/teams/:team/action/:action", org.TeamsAction) + m.Post("/teams/:team/action/repo/:action", org.TeamsRepoAction) }, context.OrgAssignment(true, false, true)) m.Group("/:org", func() { @@ -681,7 +681,7 @@ func RegisterRoutes(m *macaron.Macaron) { }) }, reqSignIn, context.RepoAssignment(), context.UnitTypes(), reqRepoAdmin, context.RepoRef()) - m.Get("/:username/:reponame/action/:action", reqSignIn, context.RepoAssignment(), context.UnitTypes(), repo.Action) + m.Post("/:username/:reponame/action/:action", reqSignIn, context.RepoAssignment(), context.UnitTypes(), repo.Action) m.Group("/:username/:reponame", func() { m.Group("/issues", func() { @@ -735,7 +735,7 @@ func RegisterRoutes(m *macaron.Macaron) { Post(bindIgnErr(auth.CreateMilestoneForm{}), repo.NewMilestonePost) m.Get("/:id/edit", repo.EditMilestone) m.Post("/:id/edit", bindIgnErr(auth.CreateMilestoneForm{}), repo.EditMilestonePost) - m.Get("/:id/:action", repo.ChangeMilestonStatus) + m.Post("/:id/:action", repo.ChangeMilestonStatus) m.Post("/delete", repo.DeleteMilestone) }, context.RepoMustNotBeArchived(), reqRepoIssuesOrPullsWriter, context.RepoRef()) m.Group("/milestone", func() { diff --git a/templates/org/member/members.tmpl b/templates/org/member/members.tmpl index 81cfcf51e..15af60d57 100644 --- a/templates/org/member/members.tmpl +++ b/templates/org/member/members.tmpl @@ -22,10 +22,10 @@ {{ $isPublic := index $.MembersIsPublicMember .ID}} {{if $isPublic}} {{$.i18n.Tr "org.members.public"}} - {{if or (eq $.SignedUser.ID .ID) $.IsOrganizationOwner}}({{$.i18n.Tr "org.members.public_helper"}}){{end}} + {{if or (eq $.SignedUser.ID .ID) $.IsOrganizationOwner}}({{$.i18n.Tr "org.members.public_helper"}}){{end}} {{else}} {{$.i18n.Tr "org.members.private"}} - {{if or (eq $.SignedUser.ID .ID) $.IsOrganizationOwner}}({{$.i18n.Tr "org.members.private_helper"}}){{end}} + {{if or (eq $.SignedUser.ID .ID) $.IsOrganizationOwner}}({{$.i18n.Tr "org.members.private_helper"}}){{end}} {{end}} diff --git a/templates/org/team/members.tmpl b/templates/org/team/members.tmpl index 74e5e1908..f3b08652c 100644 --- a/templates/org/team/members.tmpl +++ b/templates/org/team/members.tmpl @@ -27,7 +27,10 @@ {{range .Team.Members}}
{{if $.IsOrganizationOwner}} - {{$.i18n.Tr "org.members.remove"}} +
+ {{$.CsrfTokenHtml}} + +
{{end}} diff --git a/templates/org/team/repositories.tmpl b/templates/org/team/repositories.tmpl index e81ff889e..d6046f86a 100644 --- a/templates/org/team/repositories.tmpl +++ b/templates/org/team/repositories.tmpl @@ -35,7 +35,10 @@ {{range .Team.Repos}}
{{if $canAddRemove}} - {{$.i18n.Tr "remove"}} +
+ {{$.CsrfTokenHtml}} + +
{{end}} {{if .IsPrivate}} diff --git a/templates/org/team/sidebar.tmpl b/templates/org/team/sidebar.tmpl index ee612069b..ff2474f00 100644 --- a/templates/org/team/sidebar.tmpl +++ b/templates/org/team/sidebar.tmpl @@ -3,9 +3,15 @@ {{.Team.Name}}
{{if .Team.IsMember $.SignedUser.ID}} - {{$.i18n.Tr "org.teams.leave"}} +
+ {{$.CsrfTokenHtml}} + +
{{else if .IsOrganizationOwner}} - {{$.i18n.Tr "org.teams.join"}} +
+ {{$.CsrfTokenHtml}} + +
{{end}}
diff --git a/templates/org/team/teams.tmpl b/templates/org/team/teams.tmpl index 9d4a46902..a042ef611 100644 --- a/templates/org/team/teams.tmpl +++ b/templates/org/team/teams.tmpl @@ -17,9 +17,15 @@ {{.Name}}
{{if .IsMember $.SignedUser.ID}} - {{$.i18n.Tr "org.teams.leave"}} +
+ {{$.CsrfTokenHtml}} + +
{{else if $.IsOrganizationOwner}} - {{$.i18n.Tr "org.teams.join"}} +
+ {{$.CsrfTokenHtml}} + +
{{end}}
diff --git a/templates/repo/header.tmpl b/templates/repo/header.tmpl index c92feb5a7..1fc298bcb 100644 --- a/templates/repo/header.tmpl +++ b/templates/repo/header.tmpl @@ -51,22 +51,28 @@
{{if not .IsBeingCreated}}
-
- - {{if $.IsWatchingRepo}}{{$.i18n.Tr "repo.unwatch"}}{{else}}{{$.i18n.Tr "repo.watch"}}{{end}} - - - {{.NumWatches}} - -
-
- - {{if $.IsStaringRepo}}{{$.i18n.Tr "repo.unstar"}}{{else}}{{$.i18n.Tr "repo.star"}}{{end}} - - - {{.NumStars}} - -
+
+ {{$.CsrfTokenHtml}} +
+ + + {{.NumWatches}} + +
+
+
+ {{$.CsrfTokenHtml}} +
+ + + {{.NumStars}} + +
+
{{if and (not .IsEmpty) ($.Permission.CanRead $.UnitTypeCode)}}
diff --git a/templates/repo/issue/milestones.tmpl b/templates/repo/issue/milestones.tmpl index e33124e66..bee1cee65 100644 --- a/templates/repo/issue/milestones.tmpl +++ b/templates/repo/issue/milestones.tmpl @@ -71,9 +71,9 @@
{{svg "octicon-pencil" 16}} {{$.i18n.Tr "repo.issues.label_edit"}} {{if .IsClosed}} - {{svg "octicon-check" 16}} {{$.i18n.Tr "repo.milestones.open"}} + {{svg "octicon-check" 16}} {{$.i18n.Tr "repo.milestones.open"}} {{else}} - {{svg "octicon-x" 16}} {{$.i18n.Tr "repo.milestones.close"}} + {{svg "octicon-x" 16}} {{$.i18n.Tr "repo.milestones.close"}} {{end}} {{svg "octicon-trashcan" 16}} {{$.i18n.Tr "repo.issues.label_delete"}}
diff --git a/templates/user/profile.tmpl b/templates/user/profile.tmpl index 945cc90f0..f3cac7bef 100644 --- a/templates/user/profile.tmpl +++ b/templates/user/profile.tmpl @@ -65,9 +65,15 @@ {{if and .IsSigned (ne .SignedUserName .Owner.Name)}} {{end}} diff --git a/web_src/js/index.js b/web_src/js/index.js index d4f8bb40e..ec39a1c40 100644 --- a/web_src/js/index.js +++ b/web_src/js/index.js @@ -2469,6 +2469,7 @@ $(document).ready(async () => { // Helpers. $('.delete-button').click(showDeletePopup); $('.add-all-button').click(showAddAllPopup); + $('.link-action').click(linkAction); $('.delete-branch-button').click(showDeletePopup); @@ -2735,6 +2736,19 @@ function showAddAllPopup() { return false; } +function linkAction() { + const $this = $(this); + $.post($this.data('url'), { + _csrf: csrf + }).done((data) => { + if (data.redirect) { + window.location.href = data.redirect; + } else { + window.location.reload(); + } + }); +} + function initVueComponents() { const vueDelimeters = ['${', '}'];