diff --git a/src/Wallabag/CoreBundle/Controller/EntryController.php b/src/Wallabag/CoreBundle/Controller/EntryController.php
index 1efc81991..fc82cb71f 100644
--- a/src/Wallabag/CoreBundle/Controller/EntryController.php
+++ b/src/Wallabag/CoreBundle/Controller/EntryController.php
@@ -570,12 +570,16 @@ class EntryController extends AbstractController
/**
* Disable public sharing for an entry.
*
- * @Route("/share/delete/{id}", requirements={"id" = "\d+"}, name="delete_share")
+ * @Route("/share/delete/{id}", name="delete_share", methods={"POST"}, requirements={"id" = "\d+"})
*
* @return Response
*/
- public function deleteShareAction(Entry $entry)
+ public function deleteShareAction(Request $request, Entry $entry)
{
+ if (!$this->isCsrfTokenValid('delete-share', $request->request->get('token'))) {
+ throw new BadRequestHttpException('Bad CSRF token.');
+ }
+
$this->checkUserAction($entry);
$entry->cleanUid();
diff --git a/src/Wallabag/CoreBundle/Resources/views/Entry/entry.html.twig b/src/Wallabag/CoreBundle/Resources/views/Entry/entry.html.twig
index 9f2154766..505f60eba 100644
--- a/src/Wallabag/CoreBundle/Resources/views/Entry/entry.html.twig
+++ b/src/Wallabag/CoreBundle/Resources/views/Entry/entry.html.twig
@@ -168,9 +168,13 @@
-
- {{ 'entry.view.left_menu.delete_public_link'|trans }}
-
+
{% endif %}
{% if craue_setting('share_twitter') %}
diff --git a/tests/Wallabag/CoreBundle/Controller/EntryControllerTest.php b/tests/Wallabag/CoreBundle/Controller/EntryControllerTest.php
index 2b7a22e70..145f42ef4 100644
--- a/tests/Wallabag/CoreBundle/Controller/EntryControllerTest.php
+++ b/tests/Wallabag/CoreBundle/Controller/EntryControllerTest.php
@@ -1185,12 +1185,19 @@ class EntryControllerTest extends WallabagCoreTestCase
$this->assertSame(404, $client->getResponse()->getStatusCode());
// removing the share
- $client->request('GET', '/share/delete/' . $content->getId());
+ $client->getContainer()->get(Config::class)->set('share_public', 1);
+ $this->logInAs('admin');
+ $crawler = $client->request('GET', '/view/' . $content->getId());
+
+ $client->submit($crawler->filter('.left-bar')->selectButton('entry.view.left_menu.delete_public_link')->form());
+
$this->assertSame(302, $client->getResponse()->getStatusCode());
- // share is now disable
+ // share is now removed
$client->request('GET', '/share/' . $content->getUid());
$this->assertSame(404, $client->getResponse()->getStatusCode());
+
+ $client->getContainer()->get(Config::class)->set('share_public', 0);
}
/**