redmine_plugins/redmine_issue_dynamic_edit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix missing authentication (CSRF) when using related issues block (#90 and PR #93)

Browse Source
This commit is contained in:
Hugo Zilliox 2022-04-23 22:51:24 +02:00
parent 750e602be3
commit dac2c85811
2 changed files with 22 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
assets/javascripts/issue_dynamic_edit.js
View File

@ -37,6 +37,23 @@ if (_CONF_DISPLAY_EDIT_ICON === "block"){
$('body.controller-issues.action-show .issue.details').addClass('showPencils');
}
let updateCSRFToken = function(token){
document.querySelectorAll('input[name="authenticity_token"]').forEach(elt => elt.value = token);
document.querySelector('meta[name="csrf-token"]').setAttribute("content", token);
}
let setCSRFTokenInput = function(token){
document.querySelectorAll('form[method="post"]').forEach(elt => {
if(!elt.querySelectorAll('input[name="authenticity_token"]').length){
let input = document.createElement("input");
input.setAttribute("type", "hidden");
input.setAttribute("name", "authenticity_token");
input.value = token;
elt.insertBefore(input, null);
}
});
}
/* Generate edit block */
var getEditFormHTML = function(attribute){
var formElement = $('#issue_' + attribute + "_id");
@ -317,6 +334,8 @@ var sendData = function(serialized_data){
$('body').find('input[type=date]').datepickerFallback(datepickerOptions);
}
setCSRFTokenInput($(parsed).find('input[name="authenticity_token"]').val());
updateCSRFToken($(parsed).find('input[name="authenticity_token"]').val());
setCheckVersionInterval(true);
},
error: function(xhr, msg, error) {
@ -354,4 +373,5 @@ var sendData = function(serialized_data){
}
// Init plugin
cloneEditForm();
cloneEditForm();
setCSRFTokenInput(document.querySelector('meta[name="csrf-token"]').getAttribute("content"));

2
init.rb
View File

@ -1,6 +1,6 @@
require 'redmine'
require 'details_issue_hooks'
require_relative './lib/details_issue_hooks.rb'
Redmine::Plugin.register :redmine_issue_dynamic_edit do
name 'Redmine Dynamic edit Issue plugin'