Merge pull request #4996 from devansh-webkul/vul-issue
Missing CSRF added to three routes
This commit is contained in:
Glenn Hermans
GitHub
commit
265aa14db1
|
|
@ -247,7 +247,7 @@ Route::group(['middleware' => ['web', 'locale', 'theme', 'currency']], function
|
|||
Route::get('addresses/default/{id}', 'Webkul\Customer\Http\Controllers\AddressController@makeDefault')->name('make.default.address');
|
||||
|
||||
//Customer Address Delete
|
||||
Route::get('addresses/delete/{id}', 'Webkul\Customer\Http\Controllers\AddressController@destroy')->name('address.delete');
|
||||
Route::delete('addresses/delete/{id}', 'Webkul\Customer\Http\Controllers\AddressController@destroy')->name('address.delete');
|
||||
|
||||
/* Wishlist route */
|
||||
//Customer wishlist(listing)
|
||||
|
|
@ -281,7 +281,7 @@ Route::group(['middleware' => ['web', 'locale', 'theme', 'currency']], function
|
|||
'view' => 'shop::customers.account.orders.print'
|
||||
])->name('customer.orders.print');
|
||||
|
||||
Route::get('/orders/cancel/{id}', 'Webkul\Shop\Http\Controllers\OrderController@cancel')->name('customer.orders.cancel');
|
||||
Route::post('/orders/cancel/{id}', 'Webkul\Shop\Http\Controllers\OrderController@cancel')->name('customer.orders.cancel');
|
||||
|
||||
/* Reviews route */
|
||||
//Customer reviews
|
||||
|
|
@ -290,7 +290,7 @@ Route::group(['middleware' => ['web', 'locale', 'theme', 'currency']], function
|
|||
])->name('customer.reviews.index');
|
||||
|
||||
//Customer review delete
|
||||
Route::get('reviews/delete/{id}', 'Webkul\Shop\Http\Controllers\ReviewController@destroy')->defaults('_config', [
|
||||
Route::delete('reviews/delete/{id}', 'Webkul\Shop\Http\Controllers\ReviewController@destroy')->defaults('_config', [
|
||||
'redirect' => 'customer.reviews.index'
|
||||
])->name('customer.review.delete');
|
||||
|
||||
|
|
|
|||
|
|
@ -391,7 +391,11 @@ return [
|
|||
|
||||
'view' => [
|
||||
'page-tile' => '#:id مراجعة',
|
||||
]
|
||||
],
|
||||
|
||||
'delete' => [
|
||||
'confirmation-message' => 'هل أنت متأكد أنك تريد حذف هذه المراجعة؟',
|
||||
],
|
||||
]
|
||||
]
|
||||
],
|
||||
|
|
|
|||
|
|
@ -388,7 +388,11 @@ return [
|
|||
|
||||
'view' => [
|
||||
'page-tile' => 'Bewertung #:id',
|
||||
]
|
||||
],
|
||||
|
||||
'delete' => [
|
||||
'confirmation-message' => 'Möchten Sie diese Bewertung wirklich löschen?',
|
||||
],
|
||||
]
|
||||
]
|
||||
],
|
||||
|
|
|
|||
|
|
@ -387,12 +387,17 @@ return [
|
|||
'review' => [
|
||||
'index' => [
|
||||
'title' => 'Reviews',
|
||||
'page-title' => 'Reviews'
|
||||
'page-title' => 'Reviews',
|
||||
|
||||
],
|
||||
|
||||
'view' => [
|
||||
'page-tile' => 'Review #:id',
|
||||
]
|
||||
],
|
||||
|
||||
'delete' => [
|
||||
'confirmation-message' => 'Are you sure you want to delete this review?',
|
||||
],
|
||||
]
|
||||
]
|
||||
],
|
||||
|
|
|
|||
|
|
@ -391,7 +391,11 @@ return [
|
|||
|
||||
'view' => [
|
||||
'page-tile' => 'Opinión #:id',
|
||||
]
|
||||
],
|
||||
|
||||
'delete' => [
|
||||
'confirmation-message' => '¿Seguro que quieres eliminar esta crítica?',
|
||||
],
|
||||
]
|
||||
]
|
||||
],
|
||||
|
|
|
|||
|
|
@ -387,7 +387,11 @@ return [
|
|||
|
||||
'view' => [
|
||||
'page-tile' => '#:id بررسی',
|
||||
]
|
||||
],
|
||||
|
||||
'delete' => [
|
||||
'confirmation-message' => 'آیا شما مطمئن هستید که می خواهید این نظر را حذف کنید؟',
|
||||
],
|
||||
]
|
||||
]
|
||||
],
|
||||
|
|
|
|||
|
|
@ -390,6 +390,10 @@ return [
|
|||
'view' => [
|
||||
'page-tile' => 'Avis n° :id',
|
||||
],
|
||||
|
||||
'delete' => [
|
||||
'confirmation-message' => 'Êtes-vous sûr de vouloir supprimer cet avis ?',
|
||||
],
|
||||
],
|
||||
],
|
||||
],
|
||||
|
|
|
|||
|
|
@ -389,7 +389,11 @@ return [
|
|||
|
||||
'view' => [
|
||||
'page-tile' => 'Recensione #:id',
|
||||
]
|
||||
],
|
||||
|
||||
'delete' => [
|
||||
'confirmation-message' => 'Sei sicuro di voler eliminare questa recensione?',
|
||||
],
|
||||
]
|
||||
]
|
||||
],
|
||||
|
|
|
|||
|
|
@ -369,7 +369,11 @@ return [
|
|||
|
||||
'view' => [
|
||||
'page-tile' => 'レビュー #:id',
|
||||
]
|
||||
],
|
||||
|
||||
'delete' => [
|
||||
'confirmation-message' => 'このレビューを削除してもよろしいですか？',
|
||||
],
|
||||
]
|
||||
]
|
||||
],
|
||||
|
|
|
|||
|
|
@ -395,7 +395,11 @@ return [
|
|||
|
||||
'view' => [
|
||||
'page-tile' => 'Recensies #:id',
|
||||
]
|
||||
],
|
||||
|
||||
'delete' => [
|
||||
'confirmation-message' => 'Weet je zeker dat je deze recensie wilt verwijderen?',
|
||||
],
|
||||
]
|
||||
]
|
||||
],
|
||||
|
|
|
|||
|
|
@ -389,7 +389,11 @@ return [
|
|||
|
||||
'view' => [
|
||||
'page-tile' => 'Recenzja #:id',
|
||||
]
|
||||
],
|
||||
|
||||
'delete' => [
|
||||
'confirmation-message' => 'Czy na pewno chcesz usunąć tę recenzję?',
|
||||
],
|
||||
]
|
||||
]
|
||||
],
|
||||
|
|
|
|||
|
|
@ -383,7 +383,11 @@ return [
|
|||
|
||||
'view' => [
|
||||
'page-tile' => 'Avaliação #:id',
|
||||
]
|
||||
],
|
||||
|
||||
'delete' => [
|
||||
'confirmation-message' => 'Tem certeza de que deseja excluir este comentário?',
|
||||
],
|
||||
]
|
||||
]
|
||||
],
|
||||
|
|
|
|||
|
|
@ -388,7 +388,11 @@ return [
|
|||
|
||||
'view' => [
|
||||
'page-tile' => 'İnceleme #:id',
|
||||
]
|
||||
],
|
||||
|
||||
'delete' => [
|
||||
'confirmation-message' => 'Bu incelemeyi silmek istediğinizden emin misiniz?',
|
||||
],
|
||||
]
|
||||
]
|
||||
],
|
||||
|
|
|
|||
|
|
@ -84,10 +84,14 @@
|
|||
</span>
|
||||
|
||||
<span>
|
||||
<a href="{{ route('address.delete', $address->id) }}"
|
||||
onclick="deleteAddress('{{ __('shop::app.customer.account.address.index.confirm-delete') }}')">
|
||||
<a href="javascript:void(0);" onclick="deleteAddress('{{ __('shop::app.customer.account.address.index.confirm-delete') }}')">
|
||||
{{ __('shop::app.customer.account.address.index.delete') }}
|
||||
</a>
|
||||
|
||||
<form id="deleteAddressForm" action="{{ route('address.delete', $address->id) }}" method="post">
|
||||
@method('delete')
|
||||
@csrf
|
||||
</form>
|
||||
</span>
|
||||
</div>
|
||||
</div>
|
||||
|
|
@ -105,8 +109,11 @@
|
|||
@push('scripts')
|
||||
<script>
|
||||
function deleteAddress(message) {
|
||||
if (!confirm(message))
|
||||
event.preventDefault();
|
||||
if (! confirm(message)) {
|
||||
return;
|
||||
}
|
||||
|
||||
$('#deleteAddressForm').submit();
|
||||
}
|
||||
</script>
|
||||
@endpush
|
||||
|
|
|
|||
|
|
@ -21,7 +21,11 @@
|
|||
|
||||
|
||||
@if ($order->canCancel())
|
||||
<a href="{{ route('customer.orders.cancel', $order->id) }}" class="btn btn-lg btn-primary" v-alert:message="'{{ __('shop::app.customer.account.order.view.cancel-confirm-msg') }}'" style="float: right;">
|
||||
<form id="cancelOrderForm" action="{{ route('customer.orders.cancel', $order->id) }}" method="post">
|
||||
@csrf
|
||||
</form>
|
||||
|
||||
<a href="javascript:void(0);" class="btn btn-lg btn-primary" onclick="cancelOrder('{{ __('shop::app.customer.account.order.view.cancel-confirm-msg') }}')" style="float: right;">
|
||||
{{ __('shop::app.customer.account.order.view.cancel-btn-title') }}
|
||||
</a>
|
||||
@endif
|
||||
|
|
@ -560,3 +564,15 @@
|
|||
</div>
|
||||
|
||||
@endsection
|
||||
|
||||
@push('scripts')
|
||||
<script>
|
||||
function cancelOrder(message) {
|
||||
if (! confirm(message)) {
|
||||
return;
|
||||
}
|
||||
|
||||
$('#cancelOrderForm').submit();
|
||||
}
|
||||
</script>
|
||||
@endpush
|
||||
|
|
@ -57,7 +57,12 @@
|
|||
</div>
|
||||
|
||||
<div class="operations">
|
||||
<a class="mb-50" href="{{ route('customer.review.delete', $review->id) }}"><span class="icon trash-icon"></span></a>
|
||||
<form id="deleteReviewForm" action="{{ route('customer.review.delete', $review->id) }}" method="post">
|
||||
@method('delete')
|
||||
@csrf
|
||||
</form>
|
||||
|
||||
<a class="mb-50" href="javascript:void(0);" onclick="deleteReview('{{ __('shop::app.customer.account.review.delete.confirmation-message') }}')"><span class="icon trash-icon"></span></a>
|
||||
</div>
|
||||
</div>
|
||||
<div class="horizontal-rule mb-10 mt-10"></div>
|
||||
|
|
@ -78,3 +83,15 @@
|
|||
</div>
|
||||
</div>
|
||||
@endsection
|
||||
|
||||
@push('scripts')
|
||||
<script>
|
||||
function deleteReview(message) {
|
||||
if (! confirm(message)) {
|
||||
return;
|
||||
}
|
||||
|
||||
$('#deleteReviewForm').submit();
|
||||
}
|
||||
</script>
|
||||
@endpush
|
||||
|
|
@ -56,13 +56,14 @@
|
|||
{{ __('shop::app.customer.account.address.index.edit') }}
|
||||
</a>
|
||||
|
||||
<a
|
||||
class="card-link"
|
||||
href="{{ route('address.delete', $address->id) }}"
|
||||
onclick="deleteAddress('{{ __('shop::app.customer.account.address.index.confirm-delete') }}')">
|
||||
|
||||
<a class="card-link" href="javascript:void(0);" onclick="deleteAddress('{{ __('shop::app.customer.account.address.index.confirm-delete') }}')">
|
||||
{{ __('shop::app.customer.account.address.index.delete') }}
|
||||
</a>
|
||||
|
||||
<form id="deleteAddressForm" action="{{ route('address.delete', $address->id) }}" method="post">
|
||||
@method('delete')
|
||||
@csrf
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
|
@ -77,8 +78,11 @@
|
|||
@push('scripts')
|
||||
<script>
|
||||
function deleteAddress(message) {
|
||||
if (!confirm(message))
|
||||
event.preventDefault();
|
||||
if (! confirm(message)) {
|
||||
return;
|
||||
}
|
||||
|
||||
$('#deleteAddressForm').submit();
|
||||
}
|
||||
</script>
|
||||
@endpush
|
||||
|
|
|
|||
|
|
@ -28,7 +28,11 @@
|
|||
|
||||
@if ($order->canCancel())
|
||||
<span class="account-action">
|
||||
<a href="{{ route('customer.orders.cancel', $order->id) }}" class="theme-btn light unset float-right" v-alert:message="'{{ __('shop::app.customer.account.order.view.cancel-confirm-msg') }}'" style="float: right">
|
||||
<form id="cancelOrderForm" action="{{ route('customer.orders.cancel', $order->id) }}" method="post">
|
||||
@csrf
|
||||
</form>
|
||||
|
||||
<a href="javascript:void(0);" class="theme-btn light unset float-right" onclick="cancelOrder('{{ __('shop::app.customer.account.order.view.cancel-confirm-msg') }}')" style="float: right">
|
||||
{{ __('shop::app.customer.account.order.view.cancel-btn-title') }}
|
||||
</a>
|
||||
</span>
|
||||
|
|
@ -580,3 +584,15 @@
|
|||
</div>
|
||||
</div>
|
||||
@endsection
|
||||
|
||||
@push('scripts')
|
||||
<script>
|
||||
function cancelOrder(message) {
|
||||
if (! confirm(message)) {
|
||||
return;
|
||||
}
|
||||
|
||||
$('#cancelOrderForm').submit();
|
||||
}
|
||||
</script>
|
||||
@endpush
|
||||
|
|
@ -59,7 +59,12 @@
|
|||
</div>
|
||||
|
||||
<div class="col-2">
|
||||
<a class="unset" href="{{ route('customer.review.delete', $review->id) }}">
|
||||
<form id="deleteReviewForm" action="{{ route('customer.review.delete', $review->id) }}" method="post">
|
||||
@method('delete')
|
||||
@csrf
|
||||
</form>
|
||||
|
||||
<a class="unset" href="javacript:void(0);" onclick="deleteReview('{{ __('shop::app.customer.account.review.delete.confirmation-message') }}')">
|
||||
<span class="rango-delete fs24"></span>
|
||||
<span class="align-vertical-top">{{ __('shop::app.checkout.cart.remove') }}</span>
|
||||
</a>
|
||||
|
|
@ -84,6 +89,16 @@
|
|||
@endsection
|
||||
|
||||
@push('scripts')
|
||||
<script>
|
||||
function deleteReview(message) {
|
||||
if (! confirm(message)) {
|
||||
return;
|
||||
}
|
||||
|
||||
$('#deleteReviewForm').submit();
|
||||
}
|
||||
</script>
|
||||
|
||||
<script type="text/x-template" id="load-more-template">
|
||||
<div class="col-12 row justify-content-center">
|
||||
<button type="button" class="theme-btn light" @click="loadNextPage">Load More</button>
|
||||
|
|
|
|||
Loading…
Reference in New Issue