Skip to content

Commit c161bb0

Browse files
jolheiserguillep2k
jolheiser
and
guillep2k
authoredFeb 25, 2020
Change action GETs to POST (go-gitea#10462)
* Change action GETs to POST * submite = submit + smite * No more # href * Fix test * Match other tests * Explicit csrf Signed-off-by: jolheiser <[email protected]> Co-authored-by: guillep2k <[email protected]>
·
v1.20.0-devv1.10.5
1 parent 4427a93 commit c161bb0

File tree

11 files changed

+79
-35
lines changed

11 files changed

+79
-35
lines changed
 

‎integrations/release_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ func createNewRelease(t *testing.T, session *TestSession, repoURL, tag, title st
2020
resp := session.MakeRequest(t, req, http.StatusOK)
2121
htmlDoc := NewHTMLParser(t, resp.Body)
2222

23-
link, exists := htmlDoc.doc.Find("form").Attr("action")
23+
link, exists := htmlDoc.doc.Find("form.ui.form").Attr("action")
2424
assert.True(t, exists, "The template has changed")
2525

2626
postData := map[string]string{

‎routers/routes/routes.go

+6-6
Original file line numberDiff line numberDiff line change
@@ -502,7 +502,7 @@ func RegisterRoutes(m *macaron.Macaron) {
502502
}, reqSignIn)
503503

504504
m.Group("/:username", func() {
505-
m.Get("/action/:action", user.Action)
505+
m.Post("/action/:action", user.Action)
506506
}, reqSignIn)
507507

508508
if macaron.Env == macaron.DEV {
@@ -534,16 +534,16 @@ func RegisterRoutes(m *macaron.Macaron) {
534534
m.Get("/^:type(issues|pulls)$", user.Issues)
535535
m.Get("/milestones", reqMilestonesDashboardPageEnabled, user.Milestones)
536536
m.Get("/members", org.Members)
537-
m.Get("/members/action/:action", org.MembersAction)
537+
m.Post("/members/action/:action", org.MembersAction)
538538

539539
m.Get("/teams", org.Teams)
540540
}, context.OrgAssignment(true))
541541

542542
m.Group("/:org", func() {
543543
m.Get("/teams/:team", org.TeamMembers)
544544
m.Get("/teams/:team/repositories", org.TeamRepositories)
545-
m.Route("/teams/:team/action/:action", "GET,POST", org.TeamsAction)
546-
m.Route("/teams/:team/action/repo/:action", "GET,POST", org.TeamsRepoAction)
545+
m.Post("/teams/:team/action/:action", org.TeamsAction)
546+
m.Post("/teams/:team/action/repo/:action", org.TeamsRepoAction)
547547
}, context.OrgAssignment(true, false, true))
548548

549549
m.Group("/:org", func() {
@@ -681,7 +681,7 @@ func RegisterRoutes(m *macaron.Macaron) {
681681
})
682682
}, reqSignIn, context.RepoAssignment(), context.UnitTypes(), reqRepoAdmin, context.RepoRef())
683683

684-
m.Get("/:username/:reponame/action/:action", reqSignIn, context.RepoAssignment(), context.UnitTypes(), repo.Action)
684+
m.Post("/:username/:reponame/action/:action", reqSignIn, context.RepoAssignment(), context.UnitTypes(), repo.Action)
685685

686686
m.Group("/:username/:reponame", func() {
687687
m.Group("/issues", func() {
@@ -735,7 +735,7 @@ func RegisterRoutes(m *macaron.Macaron) {
735735
Post(bindIgnErr(auth.CreateMilestoneForm{}), repo.NewMilestonePost)
736736
m.Get("/:id/edit", repo.EditMilestone)
737737
m.Post("/:id/edit", bindIgnErr(auth.CreateMilestoneForm{}), repo.EditMilestonePost)
738-
m.Get("/:id/:action", repo.ChangeMilestonStatus)
738+
m.Post("/:id/:action", repo.ChangeMilestonStatus)
739739
m.Post("/delete", repo.DeleteMilestone)
740740
}, context.RepoMustNotBeArchived(), reqRepoIssuesOrPullsWriter, context.RepoRef())
741741
m.Group("/milestone", func() {

‎templates/org/member/members.tmpl

+2-2
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,10 @@
2222
{{ $isPublic := index $.MembersIsPublicMember .ID}}
2323
{{if $isPublic}}
2424
<strong>{{$.i18n.Tr "org.members.public"}}</strong>
25-
{{if or (eq $.SignedUser.ID .ID) $.IsOrganizationOwner}}(<a href="{{$.OrgLink}}/members/action/private?uid={{.ID}}">{{$.i18n.Tr "org.members.public_helper"}}</a>){{end}}
25+
{{if or (eq $.SignedUser.ID .ID) $.IsOrganizationOwner}}(<a class="link-action" href data-url="{{$.OrgLink}}/members/action/private?uid={{.ID}}">{{$.i18n.Tr "org.members.public_helper"}}</a>){{end}}
2626
{{else}}
2727
<strong>{{$.i18n.Tr "org.members.private"}}</strong>
28-
{{if or (eq $.SignedUser.ID .ID) $.IsOrganizationOwner}}(<a href="{{$.OrgLink}}/members/action/public?uid={{.ID}}">{{$.i18n.Tr "org.members.private_helper"}}</a>){{end}}
28+
{{if or (eq $.SignedUser.ID .ID) $.IsOrganizationOwner}}(<a class="link-action" href data-url="{{$.OrgLink}}/members/action/public?uid={{.ID}}">{{$.i18n.Tr "org.members.private_helper"}}</a>){{end}}
2929
{{end}}
3030
</div>
3131
</div>

‎templates/org/team/members.tmpl

+4-1
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,10 @@
2727
{{range .Team.Members}}
2828
<div class="item">
2929
{{if $.IsOrganizationOwner}}
30-
<a class="ui red small button right" href="{{$.OrgLink}}/teams/{{$.Team.LowerName}}/action/remove?uid={{.ID}}">{{$.i18n.Tr "org.members.remove"}}</a>
30+
<form method="post" action="{{$.OrgLink}}/teams/{{$.Team.LowerName}}/action/remove?uid={{.ID}}">
31+
{{$.CsrfTokenHtml}}
32+
<button type="submit" class="ui red small button right" >{{$.i18n.Tr "org.members.remove"}}</button>
33+
</form>
3134
{{end}}
3235
<a href="{{.HomeLink}}">
3336
<img class="ui avatar image" src="{{.RelAvatarLink}}">

‎templates/org/team/repositories.tmpl

+4-1
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,10 @@
3535
{{range .Team.Repos}}
3636
<div class="item">
3737
{{if $canAddRemove}}
38-
<a class="ui red small button right" href="{{$.OrgLink}}/teams/{{$.Team.LowerName}}/action/repo/remove?repoid={{.ID}}">{{$.i18n.Tr "remove"}}</a>
38+
<form method="post" action="{{$.OrgLink}}/teams/{{$.Team.LowerName}}/action/repo/remove?repoid={{.ID}}">
39+
{{$.CsrfTokenHtml}}
40+
<button type="submit" class="ui red small button right">{{$.i18n.Tr "remove"}}</button>
41+
</form>
3942
{{end}}
4043
<a class="member" href="{{AppSubUrl}}/{{$.Org.Name}}/{{.Name}}">
4144
{{if .IsPrivate}}

‎templates/org/team/sidebar.tmpl

+8-2
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,15 @@
33
<strong>{{.Team.Name}}</strong>
44
<div class="ui right">
55
{{if .Team.IsMember $.SignedUser.ID}}
6-
<a class="ui red tiny button" href="{{.OrgLink}}/teams/{{.Team.LowerName}}/action/leave?uid={{$.SignedUser.ID}}&page=home">{{$.i18n.Tr "org.teams.leave"}}</a>
6+
<form method="post" action="{{.OrgLink}}/teams/{{.Team.LowerName}}/action/leave?uid={{$.SignedUser.ID}}&page=home">
7+
{{$.CsrfTokenHtml}}
8+
<button type="submit" class="ui red tiny button">{{$.i18n.Tr "org.teams.leave"}}</button>
9+
</form>
710
{{else if .IsOrganizationOwner}}
8-
<a class="ui blue tiny button" href="{{.OrgLink}}/teams/{{.Team.LowerName}}/action/join?uid={{$.SignedUser.ID}}&page=team">{{$.i18n.Tr "org.teams.join"}}</a>
11+
<form method="post" action="{{.OrgLink}}/teams/{{.Team.LowerName}}/action/join?uid={{$.SignedUser.ID}}&page=team">
12+
{{$.CsrfTokenHtml}}
13+
<button type="submit" class="ui blue tiny button">{{$.i18n.Tr "org.teams.join"}}</button>
14+
</form>
915
{{end}}
1016
</div>
1117
</h4>

‎templates/org/team/teams.tmpl

+8-2
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,15 @@
1717
<a class="text black" href="{{$.OrgLink}}/teams/{{.LowerName}}"><strong>{{.Name}}</strong></a>
1818
<div class="ui right">
1919
{{if .IsMember $.SignedUser.ID}}
20-
<a class="ui red small button" href="{{$.OrgLink}}/teams/{{.LowerName}}/action/leave?uid={{$.SignedUser.ID}}">{{$.i18n.Tr "org.teams.leave"}}</a>
20+
<form method="post" action="{{$.OrgLink}}/teams/{{.LowerName}}/action/leave?uid={{$.SignedUser.ID}}">
21+
{{$.CsrfTokenHtml}}
22+
<button type="submit" class="ui red small button">{{$.i18n.Tr "org.teams.leave"}}</button>
23+
</form>
2124
{{else if $.IsOrganizationOwner}}
22-
<a class="ui blue small button" href="{{$.OrgLink}}/teams/{{.LowerName}}/action/join?uid={{$.SignedUser.ID}}">{{$.i18n.Tr "org.teams.join"}}</a>
25+
<form method="post" action="{{$.OrgLink}}/teams/{{.LowerName}}/action/join?uid={{$.SignedUser.ID}}">
26+
{{$.CsrfTokenHtml}}
27+
<button type="submit" class="ui blue small button">{{$.i18n.Tr "org.teams.join"}}</button>
28+
</form>
2329
{{end}}
2430
</div>
2531
</div>

‎templates/repo/header.tmpl

+22-16
Original file line numberDiff line numberDiff line change
@@ -51,22 +51,28 @@
5151
</div>
5252
{{if not .IsBeingCreated}}
5353
<div class="repo-buttons">
54-
<div class="ui labeled button" tabindex="0">
55-
<a class="ui compact basic button" href="{{$.RepoLink}}/action/{{if $.IsWatchingRepo}}un{{end}}watch?redirect_to={{$.Link}}">
56-
<i class="icon fa-eye{{if not $.IsWatchingRepo}}-slash{{end}}"></i>{{if $.IsWatchingRepo}}{{$.i18n.Tr "repo.unwatch"}}{{else}}{{$.i18n.Tr "repo.watch"}}{{end}}
57-
</a>
58-
<a class="ui basic label" href="{{.Link}}/watchers">
59-
{{.NumWatches}}
60-
</a>
61-
</div>
62-
<div class="ui labeled button" tabindex="0">
63-
<a class="ui compact basic button" href="{{$.RepoLink}}/action/{{if $.IsStaringRepo}}un{{end}}star?redirect_to={{$.Link}}">
64-
<i class="icon star{{if not $.IsStaringRepo}} outline{{end}}"></i>{{if $.IsStaringRepo}}{{$.i18n.Tr "repo.unstar"}}{{else}}{{$.i18n.Tr "repo.star"}}{{end}}
65-
</a>
66-
<a class="ui basic label" href="{{.Link}}/stars">
67-
{{.NumStars}}
68-
</a>
69-
</div>
54+
<form method="post" action="{{$.RepoLink}}/action/{{if $.IsWatchingRepo}}un{{end}}watch?redirect_to={{$.Link}}">
55+
{{$.CsrfTokenHtml}}
56+
<div class="ui labeled button" tabindex="0">
57+
<button type="submit" class="ui compact basic button">
58+
<i class="icon fa-eye{{if not $.IsWatchingRepo}}-slash{{end}}"></i>{{if $.IsWatchingRepo}}{{$.i18n.Tr "repo.unwatch"}}{{else}}{{$.i18n.Tr "repo.watch"}}{{end}}
59+
</button>
60+
<a class="ui basic label" href="{{.Link}}/watchers">
61+
{{.NumWatches}}
62+
</a>
63+
</div>
64+
</form>
65+
<form method="post" action="{{$.RepoLink}}/action/{{if $.IsStaringRepo}}un{{end}}star?redirect_to={{$.Link}}">
66+
{{$.CsrfTokenHtml}}
67+
<div class="ui labeled button" tabindex="0">
68+
<button type="submit" class="ui compact basic button">
69+
<i class="icon star{{if not $.IsStaringRepo}} outline{{end}}"></i>{{if $.IsStaringRepo}}{{$.i18n.Tr "repo.unstar"}}{{else}}{{$.i18n.Tr "repo.star"}}{{end}}
70+
</button>
71+
<a class="ui basic label" href="{{.Link}}/stars">
72+
{{.NumStars}}
73+
</a>
74+
</div>
75+
</form>
7076
{{if and (not .IsEmpty) ($.Permission.CanRead $.UnitTypeCode)}}
7177
<div class="ui labeled button {{if and ($.IsSigned) (not $.CanSignedUserFork)}}disabled-repo-button{{end}}" tabindex="0">
7278
<a class="ui compact basic button {{if or (not $.IsSigned) (not $.CanSignedUserFork)}}poping up{{end}}" {{if $.CanSignedUserFork}}href="{{AppSubUrl}}/repo/fork/{{.ID}}"{{else if $.IsSigned}} data-content="{{$.i18n.Tr "repo.fork_from_self"}}" {{ else }} data-content="{{$.i18n.Tr "repo.fork_guest_user" }}" rel="nofollow" href="{{AppSubUrl}}/user/login?redirect_to={{AppSubUrl}}/repo/fork/{{.ID}}" {{end}} data-position="top center" data-variation="tiny">

‎templates/repo/issue/milestones.tmpl

+2-2
Original file line numberDiff line numberDiff line change
@@ -71,9 +71,9 @@
7171
<div class="ui right operate">
7272
<a href="{{$.Link}}/{{.ID}}/edit" data-id={{.ID}} data-title={{.Name}}>{{svg "octicon-pencil" 16}} {{$.i18n.Tr "repo.issues.label_edit"}}</a>
7373
{{if .IsClosed}}
74-
<a href="{{$.Link}}/{{.ID}}/open" data-id={{.ID}} data-title={{.Name}}>{{svg "octicon-check" 16}} {{$.i18n.Tr "repo.milestones.open"}}</a>
74+
<a class="link-action" href data-url="{{$.Link}}/{{.ID}}/open">{{svg "octicon-check" 16}} {{$.i18n.Tr "repo.milestones.open"}}</a>
7575
{{else}}
76-
<a href="{{$.Link}}/{{.ID}}/close" data-id={{.ID}} data-title={{.Name}}>{{svg "octicon-x" 16}} {{$.i18n.Tr "repo.milestones.close"}}</a>
76+
<a class="link-action" href data-url="{{$.Link}}/{{.ID}}/close">{{svg "octicon-x" 16}} {{$.i18n.Tr "repo.milestones.close"}}</a>
7777
{{end}}
7878
<a class="delete-button" href="#" data-url="{{$.RepoLink}}/milestones/delete" data-id="{{.ID}}">{{svg "octicon-trashcan" 16}} {{$.i18n.Tr "repo.issues.label_delete"}}</a>
7979
</div>

‎templates/user/profile.tmpl

+8-2
Original file line numberDiff line numberDiff line change
@@ -65,9 +65,15 @@
6565
{{if and .IsSigned (ne .SignedUserName .Owner.Name)}}
6666
<li class="follow">
6767
{{if .SignedUser.IsFollowing .Owner.ID}}
68-
<a class="ui basic red button" href="{{.Link}}/action/unfollow?redirect_to={{$.Link}}">{{svg "octicon-person" 16}} {{.i18n.Tr "user.unfollow"}}</a>
68+
<form method="post" action="{{.Link}}/action/unfollow?redirect_to={{$.Link}}">
69+
{{$.CsrfTokenHtml}}
70+
<button type="submit" class="ui basic red button">{{svg "octicon-person" 16}} {{.i18n.Tr "user.unfollow"}}</button>
71+
</form>
6972
{{else}}
70-
<a class="ui basic green button" href="{{.Link}}/action/follow?redirect_to={{$.Link}}">{{svg "octicon-person" 16}} {{.i18n.Tr "user.follow"}}</a>
73+
<form method="post" action="{{.Link}}/action/follow?redirect_to={{$.Link}}">
74+
{{$.CsrfTokenHtml}}
75+
<button type="submit" class="ui basic green button">{{svg "octicon-person" 16}} {{.i18n.Tr "user.follow"}}</button>
76+
</form>
7177
{{end}}
7278
</li>
7379
{{end}}

‎web_src/js/index.js

+14
Original file line numberDiff line numberDiff line change
@@ -2469,6 +2469,7 @@ $(document).ready(async () => {
24692469
// Helpers.
24702470
$('.delete-button').click(showDeletePopup);
24712471
$('.add-all-button').click(showAddAllPopup);
2472+
$('.link-action').click(linkAction);
24722473

24732474
$('.delete-branch-button').click(showDeletePopup);
24742475

@@ -2735,6 +2736,19 @@ function showAddAllPopup() {
27352736
return false;
27362737
}
27372738

2739+
function linkAction() {
2740+
const $this = $(this);
2741+
$.post($this.data('url'), {
2742+
_csrf: csrf
2743+
}).done((data) => {
2744+
if (data.redirect) {
2745+
window.location.href = data.redirect;
2746+
} else {
2747+
window.location.reload();
2748+
}
2749+
});
2750+
}
2751+
27382752
function initVueComponents() {
27392753
const vueDelimeters = ['${', '}'];
27402754

0 commit comments

Comments
 (0)
Please sign in to comment.