#7371 Add missing CSRF check (save reordered items)

pkp · Oct 19, 2021 · 169885a · 169885a
1 parent 3018049
commit 169885a
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 2 deletions.
diff --git a/classes/controllers/grid/GridHandler.inc.php b/classes/controllers/grid/GridHandler.inc.php
@@ -857,6 +857,9 @@ public function fetchCell(&$args, $request)
      */
     public function saveSequence($args, $request)
     {
+        if (!$request->checkCSRF()) {
+            throw new \Exception('CSRF mismatch!');
+        }
         $this->callFeaturesHook('saveSequence', ['request' => &$request, 'grid' => &$this]);
 
         return \PKP\db\DAO::getDataChangedEvent();

diff --git a/classes/controllers/grid/feature/OrderItemsFeature.inc.php b/classes/controllers/grid/feature/OrderItemsFeature.inc.php
@@ -111,7 +111,8 @@ public function setOptions($request, $grid)
 
         $router = $request->getRouter();
         $this->addOptions([
-            'saveItemsSequenceUrl' => $router->url($request, null, null, 'saveSequence', null, $grid->getRequestArgs())
+            'saveItemsSequenceUrl' => $router->url($request, null, null, 'saveSequence', null, $grid->getRequestArgs()),
+            'csrfToken' => $request->getSession()->getCsrfToken(),
         ]);
     }
 

diff --git a/js/classes/features/OrderGridItemsFeature.js b/js/classes/features/OrderGridItemsFeature.js
@@ -56,7 +56,7 @@
 		stringifiedData = JSON.stringify(this.getItemsDataId());
 		saveOrderCallback = this.callbackWrapper(
 				this.saveOrderResponseHandler_, this);
-		$.post(options.saveItemsSequenceUrl, {data: stringifiedData},
+		$.post(options.saveItemsSequenceUrl, {data: stringifiedData, csrfToken: options.csrfToken},
 				saveOrderCallback, 'json');
 
 		return false;