security: cross-site request forgery

HDInnovations · Oct 9, 2021 · 63ae97f · 63ae97f
1 parent 8d4e399
commit 63ae97f
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 7 deletions.
diff --git a/resources/views/pm/inbox.blade.php b/resources/views/pm/inbox.blade.php
@@ -36,12 +36,13 @@ class="{{ config('other.font-awesome') }} fa-eye"></i></button>
                                         data-original-title="@lang('pm.refresh')"><i
                                             class="{{ config('other.font-awesome') }} fa-sync-alt"></i></button>
                                 </a>
-                                <a href="{{ route('empty-inbox') }}">
-                                    <button type="button" id="btn_refresh" class="btn btn-danger dropdown-toggle"
-                                        data-toggle="tooltip" data-placement="top"
-                                        data-original-title="@lang('pm.empty-inbox')"><i
-                                            class="{{ config('other.font-awesome') }} fa-trash"></i> @lang('pm.empty-inbox')</button>
-                                </a>
+                                <form role="form" method="POST" action="{{ route('empty-inbox') }}" style="display: inline-block;">
+                                    @csrf
+                                    @method('DELETE')
+                                    <button type="submit" class="btn btn-danger dropdown-toggle">
+                                        <i class="{{ config('other.font-awesome') }} fa-trash"></i> @lang('pm.empty-inbox')
+                                    </button>
+                                </form>
                             </div>
                         </div>
                         <div class="col-md-4 col-xs-7">

diff --git a/routes/web.php b/routes/web.php
@@ -222,7 +222,7 @@
             Route::get('/outbox', [App\Http\Controllers\PrivateMessageController::class, 'getPrivateMessagesSent'])->name('outbox');
             Route::get('/create', [App\Http\Controllers\PrivateMessageController::class, 'makePrivateMessage'])->name('create');
             Route::get('/mark-all-read', [App\Http\Controllers\PrivateMessageController::class, 'markAllAsRead'])->name('mark-all-read');
-            Route::get('/empty-inbox', [App\Http\Controllers\PrivateMessageController::class, 'emptyInbox'])->name('empty-inbox');
+            Route::delete('/empty-inbox', [App\Http\Controllers\PrivateMessageController::class, 'emptyInbox'])->name('empty-inbox');
             Route::post('/send', [App\Http\Controllers\PrivateMessageController::class, 'sendPrivateMessage'])->name('send-pm');
             Route::post('/{id}/reply', [App\Http\Controllers\PrivateMessageController::class, 'replyPrivateMessage'])->name('reply-pm');
             Route::post('/{id}/destroy', [App\Http\Controllers\PrivateMessageController::class, 'deletePrivateMessage'])->name('delete-pm');