diff --git a/src/Wallabag/CoreBundle/Controller/EntryController.php b/src/Wallabag/CoreBundle/Controller/EntryController.php index 1efc81991..fc82cb71f 100644 --- a/src/Wallabag/CoreBundle/Controller/EntryController.php +++ b/src/Wallabag/CoreBundle/Controller/EntryController.php @@ -570,12 +570,16 @@ class EntryController extends AbstractController /** * Disable public sharing for an entry. * - * @Route("/share/delete/{id}", requirements={"id" = "\d+"}, name="delete_share") + * @Route("/share/delete/{id}", name="delete_share", methods={"POST"}, requirements={"id" = "\d+"}) * * @return Response */ - public function deleteShareAction(Entry $entry) + public function deleteShareAction(Request $request, Entry $entry) { + if (!$this->isCsrfTokenValid('delete-share', $request->request->get('token'))) { + throw new BadRequestHttpException('Bad CSRF token.'); + } + $this->checkUserAction($entry); $entry->cleanUid(); diff --git a/src/Wallabag/CoreBundle/Resources/views/Entry/entry.html.twig b/src/Wallabag/CoreBundle/Resources/views/Entry/entry.html.twig index 9f2154766..505f60eba 100644 --- a/src/Wallabag/CoreBundle/Resources/views/Entry/entry.html.twig +++ b/src/Wallabag/CoreBundle/Resources/views/Entry/entry.html.twig @@ -168,9 +168,13 @@
  • - - {{ 'entry.view.left_menu.delete_public_link'|trans }} - +
    + + + +
  • {% endif %} {% if craue_setting('share_twitter') %} diff --git a/tests/Wallabag/CoreBundle/Controller/EntryControllerTest.php b/tests/Wallabag/CoreBundle/Controller/EntryControllerTest.php index 2b7a22e70..145f42ef4 100644 --- a/tests/Wallabag/CoreBundle/Controller/EntryControllerTest.php +++ b/tests/Wallabag/CoreBundle/Controller/EntryControllerTest.php @@ -1185,12 +1185,19 @@ class EntryControllerTest extends WallabagCoreTestCase $this->assertSame(404, $client->getResponse()->getStatusCode()); // removing the share - $client->request('GET', '/share/delete/' . $content->getId()); + $client->getContainer()->get(Config::class)->set('share_public', 1); + $this->logInAs('admin'); + $crawler = $client->request('GET', '/view/' . $content->getId()); + + $client->submit($crawler->filter('.left-bar')->selectButton('entry.view.left_menu.delete_public_link')->form()); + $this->assertSame(302, $client->getResponse()->getStatusCode()); - // share is now disable + // share is now removed $client->request('GET', '/share/' . $content->getUid()); $this->assertSame(404, $client->getResponse()->getStatusCode()); + + $client->getContainer()->get(Config::class)->set('share_public', 0); } /**