fix: use post request for exportToSql (#5314)

monicahq · Jun 27, 2021 · cefeb9b · cefeb9b
1 parent 8b4821f
commit cefeb9b
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 3 deletions.
diff --git a/resources/views/settings/export.blade.php b/resources/views/settings/export.blade.php
@@ -38,7 +38,12 @@
             <h4>{{ trans('settings.export_title_sql') }}</h4>
             <p>{{ trans('settings.export_sql_explanation') }}</p>
             <p>{{ trans('settings.export_be_patient') }}</p>
-            <p><a href="{{ route('settings.sql') }}" class="btn">{{ trans('settings.export_sql_cta') }}</a></p>
+            <form action="{{ route('settings.sql') }}" method="POST">
+              @csrf
+              <p>
+                <button type="submit" class="btn">{{ trans('settings.export_sql_cta') }}</button>
+              </p>
+            </form>
             <p>{!! trans('settings.export_sql_link_instructions', ['url' => 'https://github.com/monicahq/monica/blob/master/docs/installation/update.md#importing-sql-from-the-exporter-feature']) !!}</p>
           </div>
         </div>

diff --git a/routes/web.php b/routes/web.php
@@ -237,7 +237,7 @@
         });
 
         Route::get('/settings/export', 'SettingsController@export')->name('export');
-        Route::get('/settings/exportToSql', 'SettingsController@exportToSQL')->name('sql');
+        Route::post('/settings/exportToSql', 'SettingsController@exportToSQL')->name('sql');
         Route::get('/settings/import', 'SettingsController@import')->name('import');
         Route::get('/settings/import/report/{importjobid}', 'SettingsController@report')->name('report');
         Route::get('/settings/import/upload', 'SettingsController@upload')->name('upload');

diff --git a/tests/Feature/SettingsTest.php b/tests/Feature/SettingsTest.php
@@ -51,7 +51,7 @@ public function test_user_can_export_account()
 
         Carbon::setTestNow(Carbon::create(2021, 11, 25, 7, 0, 0));
 
-        $response = $this->get(route('settings.sql'));
+        $response = $this->post(route('settings.sql'));
 
         $response->assertStatus(200);
         $this->assertTrue($response->headers->get('content-disposition') == 'attachment; filename=monica-export.2021-11-25.sql');