Kimirock/freescout
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add csrf token to Clone Conversation action - GHSA-qp58-4g6r-qq78

Browse Source
This commit is contained in:
FreeScout
2026-09-24 21:46:25 -07:00
parent 12adf2470c
commit 8453429753
3 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
app/Http/Controllers/ConversationsController.php
View File

@@ -482,7 +482,7 @@ class ConversationsController extends Controller
/**
* Clone conversation.
*/
public function cloneConversation(Request $request, $mailbox_id, $from_thread_id)
public function cloneConversation(Request $request, $mailbox_id, $from_thread_id, $token)
{
$mailbox = Mailbox::findOrFail($mailbox_id);
$this->authorize('view', $mailbox);
@@ -494,6 +494,10 @@ class ConversationsController extends Controller
$orign_conv = $orig_thread->conversation;
$this->authorize('view', $orign_conv);
if (csrf_token() != $token) {
\Session::flash('flash_error_floating', __('Not enough permissions'));
return redirect()->away($orign_conv->url($orign_conv->folder_id));
}
// $thread = $orig_thread->replicate();
// $thread->id = '';

2
resources/views/conversations/partials/thread.blade.php
View File

@@ -323,7 +323,7 @@
@endif
<li><a href="{{ route('conversations.create', ['mailbox_id' => $mailbox->id]) }}?from_thread_id={{ $thread->id }}" title="{{ __("Start a conversation from this thread") }}" class="new-conv" role="button">{{ __("New Conversation") }}</a></li>
@if ($thread->isCustomerMessage())
<li><a href="{{ route('conversations.clone_conversation', ['mailbox_id' => $mailbox->id, 'from_thread_id' => $thread->id]) }}" title="{{ __("Clone a conversation from this thread") }}" class="new-conv" role="button">{{ __("Clone Conversation") }}</a></li>
<li><a href="{{ route('conversations.clone_conversation', ['mailbox_id' => $mailbox->id, 'from_thread_id' => $thread->id, 'token' => csrf_token()]) }}" title="{{ __("Clone a conversation from this thread") }}" class="new-conv" role="button">{{ __("Clone Conversation") }}</a></li>
@endif
@action('thread.menu', $thread)
@if (Auth::user()->isAdmin())

2
routes/web.php
View File

@@ -64,7 +64,7 @@ Route::get('/conversation/{id}', ['uses' => 'ConversationsController@view', 'lar
Route::post('/conversation/ajax', ['uses' => 'ConversationsController@ajax', 'laroute' => true])->name('conversations.ajax');
Route::post('/conversation/upload', ['uses' => 'ConversationsController@upload', 'laroute' => true])->middleware('throttle:100,1')->name('conversations.upload');
Route::get('/mailbox/{mailbox_id}/new-ticket', 'ConversationsController@create')->name('conversations.create');
Route::get('/mailbox/{mailbox_id}/clone-ticket/{from_thread_id}', 'ConversationsController@cloneConversation')->name('conversations.clone_conversation');
Route::get('/mailbox/{mailbox_id}/clone-ticket/{from_thread_id}/{token}', 'ConversationsController@cloneConversation')->name('conversations.clone_conversation');
//Route::get('/conversation/draft/{id}', 'ConversationsController@draft')->name('conversations.draft');
Route::get('/conversation/ajax-html/{action}', ['uses' => 'ConversationsController@ajaxHtml', 'laroute' => true])->name('conversations.ajax_html');
Route::get('/search', 'ConversationsController@search')->name('conversations.search');