Skip to content

Commit 4cb1860

Browse files
jolheiserguillep2k
jolheiser
and
guillep2k
authored
Change action GETs to POST (#10462) (#10464)
* Change action GETs to POST * submite = submit + smite * No more # href * Fix test * Match other tests * Explicit csrf Signed-off-by: jolheiser <[email protected]> Co-authored-by: guillep2k <[email protected]>
1 parent 3abb251 commit 4cb1860

File tree

11 files changed

+79
-35
lines changed

11 files changed

+79
-35
lines changed

‎integrations/release_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ func createNewRelease(t *testing.T, session *TestSession, repoURL, tag, title st
2020
resp := session.MakeRequest(t, req, http.StatusOK)
2121
htmlDoc := NewHTMLParser(t, resp.Body)
2222

23-
link, exists := htmlDoc.doc.Find("form").Attr("action")
23+
link, exists := htmlDoc.doc.Find("form.ui.form").Attr("action")
2424
assert.True(t, exists, "The template has changed")
2525

2626
postData := map[string]string{

‎routers/routes/routes.go

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -485,7 +485,7 @@ func RegisterRoutes(m *macaron.Macaron) {
485485
}, reqSignIn)
486486

487487
m.Group("/:username", func() {
488-
m.Get("/action/:action", user.Action)
488+
m.Post("/action/:action", user.Action)
489489
}, reqSignIn)
490490

491491
if macaron.Env == macaron.DEV {
@@ -517,16 +517,16 @@ func RegisterRoutes(m *macaron.Macaron) {
517517
m.Get("/^:type(issues|pulls)$", user.Issues)
518518
m.Get("/milestones", reqMilestonesDashboardPageEnabled, user.Milestones)
519519
m.Get("/members", org.Members)
520-
m.Get("/members/action/:action", org.MembersAction)
520+
m.Post("/members/action/:action", org.MembersAction)
521521

522522
m.Get("/teams", org.Teams)
523523
}, context.OrgAssignment(true))
524524

525525
m.Group("/:org", func() {
526526
m.Get("/teams/:team", org.TeamMembers)
527527
m.Get("/teams/:team/repositories", org.TeamRepositories)
528-
m.Route("/teams/:team/action/:action", "GET,POST", org.TeamsAction)
529-
m.Route("/teams/:team/action/repo/:action", "GET,POST", org.TeamsRepoAction)
528+
m.Post("/teams/:team/action/:action", org.TeamsAction)
529+
m.Post("/teams/:team/action/repo/:action", org.TeamsRepoAction)
530530
}, context.OrgAssignment(true, false, true))
531531

532532
m.Group("/:org", func() {
@@ -660,7 +660,7 @@ func RegisterRoutes(m *macaron.Macaron) {
660660
})
661661
}, reqSignIn, context.RepoAssignment(), context.UnitTypes(), reqRepoAdmin, context.RepoRef())
662662

663-
m.Get("/:username/:reponame/action/:action", reqSignIn, context.RepoAssignment(), context.UnitTypes(), repo.Action)
663+
m.Post("/:username/:reponame/action/:action", reqSignIn, context.RepoAssignment(), context.UnitTypes(), repo.Action)
664664

665665
m.Group("/:username/:reponame", func() {
666666
m.Group("/issues", func() {
@@ -714,7 +714,7 @@ func RegisterRoutes(m *macaron.Macaron) {
714714
Post(bindIgnErr(auth.CreateMilestoneForm{}), repo.NewMilestonePost)
715715
m.Get("/:id/edit", repo.EditMilestone)
716716
m.Post("/:id/edit", bindIgnErr(auth.CreateMilestoneForm{}), repo.EditMilestonePost)
717-
m.Get("/:id/:action", repo.ChangeMilestonStatus)
717+
m.Post("/:id/:action", repo.ChangeMilestonStatus)
718718
m.Post("/delete", repo.DeleteMilestone)
719719
}, context.RepoMustNotBeArchived(), reqRepoIssuesOrPullsWriter, context.RepoRef())
720720
m.Group("/milestone", func() {

‎templates/org/member/members.tmpl

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,10 @@
2222
{{ $isPublic := index $.MembersIsPublicMember .ID}}
2323
{{if $isPublic}}
2424
<strong>{{$.i18n.Tr "org.members.public"}}</strong>
25-
{{if or (eq $.SignedUser.ID .ID) $.IsOrganizationOwner}}(<a href="{{$.OrgLink}}/members/action/private?uid={{.ID}}">{{$.i18n.Tr "org.members.public_helper"}}</a>){{end}}
25+
{{if or (eq $.SignedUser.ID .ID) $.IsOrganizationOwner}}(<a class="link-action" href data-url="{{$.OrgLink}}/members/action/private?uid={{.ID}}">{{$.i18n.Tr "org.members.public_helper"}}</a>){{end}}
2626
{{else}}
2727
<strong>{{$.i18n.Tr "org.members.private"}}</strong>
28-
{{if or (eq $.SignedUser.ID .ID) $.IsOrganizationOwner}}(<a href="{{$.OrgLink}}/members/action/public?uid={{.ID}}">{{$.i18n.Tr "org.members.private_helper"}}</a>){{end}}
28+
{{if or (eq $.SignedUser.ID .ID) $.IsOrganizationOwner}}(<a class="link-action" href data-url="{{$.OrgLink}}/members/action/public?uid={{.ID}}">{{$.i18n.Tr "org.members.private_helper"}}</a>){{end}}
2929
{{end}}
3030
</div>
3131
</div>

‎templates/org/team/members.tmpl

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,10 @@
2727
{{range .Team.Members}}
2828
<div class="item">
2929
{{if $.IsOrganizationOwner}}
30-
<a class="ui red small button right" href="{{$.OrgLink}}/teams/{{$.Team.LowerName}}/action/remove?uid={{.ID}}">{{$.i18n.Tr "org.members.remove"}}</a>
30+
<form method="post" action="{{$.OrgLink}}/teams/{{$.Team.LowerName}}/action/remove?uid={{.ID}}">
31+
{{$.CsrfTokenHtml}}
32+
<button type="submit" class="ui red small button right" >{{$.i18n.Tr "org.members.remove"}}</button>
33+
</form>
3134
{{end}}
3235
<a href="{{.HomeLink}}">
3336
<img class="ui avatar image" src="{{.RelAvatarLink}}">

‎templates/org/team/repositories.tmpl

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,10 @@
3535
{{range .Team.Repos}}
3636
<div class="item">
3737
{{if $canAddRemove}}
38-
<a class="ui red small button right" href="{{$.OrgLink}}/teams/{{$.Team.LowerName}}/action/repo/remove?repoid={{.ID}}">{{$.i18n.Tr "remove"}}</a>
38+
<form method="post" action="{{$.OrgLink}}/teams/{{$.Team.LowerName}}/action/repo/remove?repoid={{.ID}}">
39+
{{$.CsrfTokenHtml}}
40+
<button type="submit" class="ui red small button right">{{$.i18n.Tr "remove"}}</button>
41+
</form>
3942
{{end}}
4043
<a class="member" href="{{AppSubUrl}}/{{$.Org.Name}}/{{.Name}}">
4144
<i class="octicon octicon-{{if .IsPrivate}}lock{{else if .IsFork}}repo-forked{{else if .IsMirror}}repo-clone{{else}}repo{{end}}"></i>

‎templates/org/team/sidebar.tmpl

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,15 @@
33
<strong>{{.Team.Name}}</strong>
44
<div class="ui right">
55
{{if .Team.IsMember $.SignedUser.ID}}
6-
<a class="ui red tiny button" href="{{.OrgLink}}/teams/{{.Team.LowerName}}/action/leave?uid={{$.SignedUser.ID}}&page=home">{{$.i18n.Tr "org.teams.leave"}}</a>
6+
<form method="post" action="{{.OrgLink}}/teams/{{.Team.LowerName}}/action/leave?uid={{$.SignedUser.ID}}&page=home">
7+
{{$.CsrfTokenHtml}}
8+
<button type="submit" class="ui red tiny button">{{$.i18n.Tr "org.teams.leave"}}</button>
9+
</form>
710
{{else if .IsOrganizationOwner}}
8-
<a class="ui blue tiny button" href="{{.OrgLink}}/teams/{{.Team.LowerName}}/action/join?uid={{$.SignedUser.ID}}&page=team">{{$.i18n.Tr "org.teams.join"}}</a>
11+
<form method="post" action="{{.OrgLink}}/teams/{{.Team.LowerName}}/action/join?uid={{$.SignedUser.ID}}&page=team">
12+
{{$.CsrfTokenHtml}}
13+
<button type="submit" class="ui blue tiny button">{{$.i18n.Tr "org.teams.join"}}</button>
14+
</form>
915
{{end}}
1016
</div>
1117
</h4>

‎templates/org/team/teams.tmpl

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,15 @@
1717
<a class="text black" href="{{$.OrgLink}}/teams/{{.LowerName}}"><strong>{{.Name}}</strong></a>
1818
<div class="ui right">
1919
{{if .IsMember $.SignedUser.ID}}
20-
<a class="ui red small button" href="{{$.OrgLink}}/teams/{{.LowerName}}/action/leave?uid={{$.SignedUser.ID}}">{{$.i18n.Tr "org.teams.leave"}}</a>
20+
<form method="post" action="{{$.OrgLink}}/teams/{{.LowerName}}/action/leave?uid={{$.SignedUser.ID}}">
21+
{{$.CsrfTokenHtml}}
22+
<button type="submit" class="ui red small button">{{$.i18n.Tr "org.teams.leave"}}</button>
23+
</form>
2124
{{else if $.IsOrganizationOwner}}
22-
<a class="ui blue small button" href="{{$.OrgLink}}/teams/{{.LowerName}}/action/join?uid={{$.SignedUser.ID}}">{{$.i18n.Tr "org.teams.join"}}</a>
25+
<form method="post" action="{{$.OrgLink}}/teams/{{.LowerName}}/action/join?uid={{$.SignedUser.ID}}">
26+
{{$.CsrfTokenHtml}}
27+
<button type="submit" class="ui blue small button">{{$.i18n.Tr "org.teams.join"}}</button>
28+
</form>
2329
{{end}}
2430
</div>
2531
</div>

‎templates/repo/header.tmpl

Lines changed: 22 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -20,22 +20,28 @@
2020
</div>
2121
{{if not .IsBeingCreated}}
2222
<div class="repo-buttons">
23-
<div class="ui labeled button" tabindex="0">
24-
<a class="ui compact basic button" href="{{$.RepoLink}}/action/{{if $.IsWatchingRepo}}un{{end}}watch?redirect_to={{$.Link}}">
25-
<i class="icon fa-eye{{if not $.IsWatchingRepo}}-slash{{end}}"></i>{{if $.IsWatchingRepo}}{{$.i18n.Tr "repo.unwatch"}}{{else}}{{$.i18n.Tr "repo.watch"}}{{end}}
26-
</a>
27-
<a class="ui basic label" href="{{.Link}}/watchers">
28-
{{.NumWatches}}
29-
</a>
30-
</div>
31-
<div class="ui labeled button" tabindex="0">
32-
<a class="ui compact basic button" href="{{$.RepoLink}}/action/{{if $.IsStaringRepo}}un{{end}}star?redirect_to={{$.Link}}">
33-
<i class="icon star{{if not $.IsStaringRepo}} outline{{end}}"></i>{{if $.IsStaringRepo}}{{$.i18n.Tr "repo.unstar"}}{{else}}{{$.i18n.Tr "repo.star"}}{{end}}
34-
</a>
35-
<a class="ui basic label" href="{{.Link}}/stars">
36-
{{.NumStars}}
37-
</a>
38-
</div>
23+
<form method="post" action="{{$.RepoLink}}/action/{{if $.IsWatchingRepo}}un{{end}}watch?redirect_to={{$.Link}}">
24+
{{$.CsrfTokenHtml}}
25+
<div class="ui labeled button" tabindex="0">
26+
<button type="submit" class="ui compact basic button">
27+
<i class="icon fa-eye{{if not $.IsWatchingRepo}}-slash{{end}}"></i>{{if $.IsWatchingRepo}}{{$.i18n.Tr "repo.unwatch"}}{{else}}{{$.i18n.Tr "repo.watch"}}{{end}}
28+
</button>
29+
<a class="ui basic label" href="{{.Link}}/watchers">
30+
{{.NumWatches}}
31+
</a>
32+
</div>
33+
</form>
34+
<form method="post" action="{{$.RepoLink}}/action/{{if $.IsStaringRepo}}un{{end}}star?redirect_to={{$.Link}}">
35+
{{$.CsrfTokenHtml}}
36+
<div class="ui labeled button" tabindex="0">
37+
<button type="submit" class="ui compact basic button">
38+
<i class="icon star{{if not $.IsStaringRepo}} outline{{end}}"></i>{{if $.IsStaringRepo}}{{$.i18n.Tr "repo.unstar"}}{{else}}{{$.i18n.Tr "repo.star"}}{{end}}
39+
</button>
40+
<a class="ui basic label" href="{{.Link}}/stars">
41+
{{.NumStars}}
42+
</a>
43+
</div>
44+
</form>
3945
{{if and (not .IsEmpty) ($.Permission.CanRead $.UnitTypeCode)}}
4046
<div class="ui labeled button {{if and ($.IsSigned) (not $.CanSignedUserFork)}}disabled-repo-button{{end}}" tabindex="0">
4147
<a class="ui compact basic button {{if or (not $.IsSigned) (not $.CanSignedUserFork)}}poping up{{end}}" {{if $.CanSignedUserFork}}href="{{AppSubUrl}}/repo/fork/{{.ID}}"{{else if $.IsSigned}} data-content="{{$.i18n.Tr "repo.fork_from_self"}}" {{ else }} data-content="{{$.i18n.Tr "repo.fork_guest_user" }}" rel="nofollow" href="{{AppSubUrl}}/user/login?redirect_to={{AppSubUrl}}/repo/fork/{{.ID}}" {{end}} data-position="top center" data-variation="tiny">

‎templates/repo/issue/milestones.tmpl

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -71,9 +71,9 @@
7171
<div class="ui right operate">
7272
<a href="{{$.Link}}/{{.ID}}/edit" data-id={{.ID}} data-title={{.Name}}><i class="octicon octicon-pencil"></i> {{$.i18n.Tr "repo.issues.label_edit"}}</a>
7373
{{if .IsClosed}}
74-
<a href="{{$.Link}}/{{.ID}}/open" data-id={{.ID}} data-title={{.Name}}><i class="octicon octicon-check"></i> {{$.i18n.Tr "repo.milestones.open"}}</a>
74+
<a class="link-action" href data-url="{{$.Link}}/{{.ID}}/open" data-id={{.ID}} data-title={{.Name}}><i class="octicon octicon-check"></i> {{$.i18n.Tr "repo.milestones.open"}}</a>
7575
{{else}}
76-
<a href="{{$.Link}}/{{.ID}}/close" data-id={{.ID}} data-title={{.Name}}><i class="octicon octicon-x"></i> {{$.i18n.Tr "repo.milestones.close"}}</a>
76+
<a class="link-action" href data-url="{{$.Link}}/{{.ID}}/close" data-id={{.ID}} data-title={{.Name}}><i class="octicon octicon-x"></i> {{$.i18n.Tr "repo.milestones.close"}}</a>
7777
{{end}}
7878
<a class="delete-button" href="#" data-url="{{$.RepoLink}}/milestones/delete" data-id="{{.ID}}"><i class="octicon octicon-trashcan"></i> {{$.i18n.Tr "repo.issues.label_delete"}}</a>
7979
</div>

‎templates/user/profile.tmpl

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -65,9 +65,15 @@
6565
{{if and .IsSigned (ne .SignedUserName .Owner.Name)}}
6666
<li class="follow">
6767
{{if .SignedUser.IsFollowing .Owner.ID}}
68-
<a class="ui basic red button" href="{{.Link}}/action/unfollow?redirect_to={{$.Link}}"><i class="octicon octicon-person"></i> {{.i18n.Tr "user.unfollow"}}</a>
68+
<form method="post" action="{{.Link}}/action/unfollow?redirect_to={{$.Link}}">
69+
{{$.CsrfTokenHtml}}
70+
<button type="submit" class="ui basic red button"><i class="octicon octicon-person"></i> {{.i18n.Tr "user.unfollow"}}</button>
71+
</form>
6972
{{else}}
70-
<a class="ui basic green button" href="{{.Link}}/action/follow?redirect_to={{$.Link}}"><i class="octicon octicon-person"></i> {{.i18n.Tr "user.follow"}}</a>
73+
<form method="post" action="{{.Link}}/action/follow?redirect_to={{$.Link}}">
74+
{{$.CsrfTokenHtml}}
75+
<button type="submit" class="ui basic green button"><i class="octicon octicon-person"></i> {{.i18n.Tr "user.follow"}}</button>
76+
</form>
7177
{{end}}
7278
</li>
7379
{{end}}

‎web_src/js/index.js

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2479,6 +2479,7 @@ $(document).ready(() => {
24792479
// Helpers.
24802480
$('.delete-button').click(showDeletePopup);
24812481
$('.add-all-button').click(showAddAllPopup);
2482+
$('.link-action').click(linkAction);
24822483

24832484
$('.delete-branch-button').click(showDeletePopup);
24842485

@@ -2736,6 +2737,19 @@ function showAddAllPopup() {
27362737
return false;
27372738
}
27382739

2740+
function linkAction() {
2741+
const $this = $(this);
2742+
$.post($this.data('url'), {
2743+
_csrf: csrf
2744+
}).done((data) => {
2745+
if (data.redirect) {
2746+
window.location.href = data.redirect;
2747+
} else {
2748+
window.location.reload();
2749+
}
2750+
});
2751+
}
2752+
27392753
function initVueComponents() {
27402754
const vueDelimeters = ['${', '}'];
27412755

0 commit comments

Comments
 (0)