From 944c29b96429ec95ac1371cb33cc43704a60c7b1 Mon Sep 17 00:00:00 2001
From: Igor Scheller <igor.scheller@igorshp.de>
Date: Tue, 20 Nov 2018 16:02:03 +0100
Subject: Require POST for sending forms

* Ensure that the form is submitted with a post request
* Replaced several links with forms

Closes #494 (Security Vulnerability)
---
 includes/view/ShiftEntry_view.php | 31 +++++++++++++++----------------
 1 file changed, 15 insertions(+), 16 deletions(-)

(limited to 'includes/view/ShiftEntry_view.php')

diff --git a/includes/view/ShiftEntry_view.php b/includes/view/ShiftEntry_view.php
index 5d4364f5..26e9896d 100644
--- a/includes/view/ShiftEntry_view.php
+++ b/includes/view/ShiftEntry_view.php
@@ -5,14 +5,13 @@ use Engelsystem\Models\User\User;
 /**
  * Sign off from an user from a shift with admin permissions, asking for ack.
  *
- * @param array $shiftEntry
  * @param array $shift
  * @param array $angeltype
  * @param User  $signoff_user
  *
  * @return string HTML
  */
-function ShiftEntry_delete_view_admin($shiftEntry, $shift, $angeltype, $signoff_user)
+function ShiftEntry_delete_view_admin($shift, $angeltype, $signoff_user)
 {
     return page_with_title(ShiftEntry_delete_title(), [
         info(sprintf(
@@ -23,26 +22,25 @@ function ShiftEntry_delete_view_admin($shiftEntry, $shift, $angeltype, $signoff_
             date('Y-m-d H:i', $shift['end']),
             $angeltype['name']
         ), true),
-        buttons([
-            button(user_link($signoff_user->id), glyph('remove') . __('cancel')),
-            button(shift_entry_delete_link($shiftEntry, [
-                'continue' => 1
-            ]), glyph('ok') . __('delete'), 'btn-danger')
-        ])
+        form([
+            buttons([
+                button(user_link($signoff_user->id), glyph('remove') . __('cancel')),
+                form_submit('delete', glyph('ok') . __('delete'), 'btn-danger', false)
+            ]),
+        ]),
     ]);
 }
 
 /**
  * Sign off from a shift, asking for ack.
  *
- * @param array $shiftEntry
  * @param array $shift
  * @param array $angeltype
  * @param int   $signoff_user_id
  *
  * @return string HTML
  */
-function ShiftEntry_delete_view($shiftEntry, $shift, $angeltype, $signoff_user_id)
+function ShiftEntry_delete_view($shift, $angeltype, $signoff_user_id)
 {
     return page_with_title(ShiftEntry_delete_title(), [
         info(sprintf(
@@ -52,12 +50,13 @@ function ShiftEntry_delete_view($shiftEntry, $shift, $angeltype, $signoff_user_i
             date('Y-m-d H:i', $shift['end']),
             $angeltype['name']
         ), true),
-        buttons([
-            button(user_link($signoff_user_id), glyph('remove') . __('cancel')),
-            button(shift_entry_delete_link($shiftEntry, [
-                'continue' => 1
-            ]), glyph('ok') . __('delete'), 'btn-danger')
-        ])
+
+        form([
+            buttons([
+                button(user_link($signoff_user_id), glyph('remove') . __('cancel')),
+                form_submit('delete', glyph('ok') . __('delete'), 'btn-danger', false),
+            ]),
+        ]),
     ]);
 }
 
-- 
cgit v1.2.3-54-g00ecf