Verified Commit 1f5f2c4e authored by Dave Long's avatar Dave Long
Browse files

fix: #3575821 locale.check_translation route is not protected against CSRF 

By: prudloff
By: smustgrave
By: longwave
parent d7b083a6

core/modules/locale/locale.routing.yml

+1 −0
Original line number Diff line number Diff line
@@ -12,6 +12,7 @@ locale.check_translation: 
    _controller: '\Drupal\locale\Controller\LocaleController::checkTranslation'

  requirements:

    _permission: 'translate interface'

    _csrf_token: 'TRUE'



locale.translate_page:

  path: '/admin/config/regional/translate'

core/modules/locale/tests/src/Functional/LocaleConfigTranslationImportTest.php

+5 −2
Original line number Diff line number Diff line
@@ -68,7 +68,8 @@ public function testConfigTranslationImport(): void { 


    // Check and update the translation status. This will import the Afrikaans

    // translations of locale_test_translate module.

    $this->drupalGet('admin/reports/translations/check');

    $this->drupalGet('admin/reports/translations');

    $this->clickLink('Check manually');



    // Override the Drupal core translation status to be up to date.

    // Drupal core should not be a subject in this test.
@@ -103,7 +104,9 @@ public function testConfigTranslationImport(): void { 


    $this->configImporter()->import();



    $this->drupalGet('admin/reports/translations/check');

    $this->drupalGet('admin/reports/translations');

    $this->clickLink('Check manually');

    $this->checkForMetaRefresh();

    $status = locale_translation_get_status();

    $status['drupal']['af']->type = 'current';

    \Drupal::state()->set('locale.translation_status', $status);

core/modules/locale/tests/src/Functional/LocaleUpdateCronTest.php

+3 −1
Original line number Diff line number Diff line
@@ -52,7 +52,9 @@ public function testUpdateCron(): void { 
    $this->config('locale.settings')->set('translation.default_filename', '%project-%version.%language._po')->save();



    // Update translations using batch to ensure a clean test starting point.

    $this->drupalGet('admin/reports/translations/check');

    $this->drupalGet('admin/reports/translations');

    $this->clickLink('Check manually');

    $this->checkForMetaRefresh();

    $this->drupalGet('admin/reports/translations');

    $this->submitForm([], 'Update translations');

core/modules/locale/tests/src/Functional/LocaleUpdateTest.php

+22 −7
Original line number Diff line number Diff line
@@ -78,8 +78,9 @@ public function testUpdateCheckStatus(): void { 
    $this->drupalGet('admin/config/regional/translate/settings');

    $this->submitForm($edit, 'Save configuration');



    // Get status of translation sources at local file system.

    $this->drupalGet('admin/reports/translations/check');

    $this->drupalGet('admin/reports/translations');

    $this->clickLink('Check manually');

    $this->checkForMetaRefresh();

    $result = locale_translation_get_status();

    $this->assertEquals(LOCALE_TRANSLATION_LOCAL, $result['contrib_module_one']['de']->type, 'Translation of contrib_module_one found');

    $this->assertEquals($this->timestampOld, $result['contrib_module_one']['de']->timestamp, 'Translation timestamp found');
@@ -96,7 +97,9 @@ public function testUpdateCheckStatus(): void { 
    $this->submitForm($edit, 'Save configuration');



    // Get status of translation sources at both local and remote locations.

    $this->drupalGet('admin/reports/translations/check');

    $this->drupalGet('admin/reports/translations');

    $this->clickLink('Check manually');

    $this->checkForMetaRefresh();

    $result = locale_translation_get_status();

    $this->assertEquals(LOCALE_TRANSLATION_REMOTE, $result['contrib_module_one']['de']->type, 'Translation of contrib_module_one found');

    $this->assertEquals($this->timestampNew, $result['contrib_module_one']['de']->timestamp, 'Translation timestamp found');
@@ -106,6 +109,10 @@ public function testUpdateCheckStatus(): void { 
    $this->assertEquals($this->timestampOld, $result['contrib_module_three']['de']->timestamp, 'Translation timestamp found');

    $this->assertEquals(LOCALE_TRANSLATION_LOCAL, $result['locale_test']['de']->type, 'Translation of locale_test found');

    $this->assertEquals(LOCALE_TRANSLATION_LOCAL, $result['custom_module_one']['de']->type, 'Translation of custom_module_one found');



    // Tests that the check route is protected against CSRF.

    $this->drupalGet('admin/reports/translations/check');

    $this->assertSession()->statusCodeEquals(403);

  }



  /**
@@ -132,7 +139,9 @@ public function testUpdateImportSourceRemote(): void { 
    $this->submitForm($edit, 'Save configuration');



    // Get the translation status.

    $this->drupalGet('admin/reports/translations/check');

    $this->drupalGet('admin/reports/translations');

    $this->clickLink('Check manually');

    $this->checkForMetaRefresh();



    // Check the status on the Available translation status page.

    $this->assertSession()->responseContains('<label for="edit-langcodes-de" class="visually-hidden">Update German</label>');
@@ -203,7 +212,9 @@ public function testUpdateImportSourceLocal(): void { 
    $this->submitForm($edit, 'Save configuration');



    // Execute the translation update.

    $this->drupalGet('admin/reports/translations/check');

    $this->drupalGet('admin/reports/translations');

    $this->clickLink('Check manually');

    $this->checkForMetaRefresh();

    $this->drupalGet('admin/reports/translations');

    $this->submitForm([], 'Update translations');
@@ -263,7 +274,9 @@ public function testUpdateImportModeNonCustomized(): void { 
    $this->submitForm($edit, 'Save configuration');



    // Execute translation update.

    $this->drupalGet('admin/reports/translations/check');

    $this->drupalGet('admin/reports/translations');

    $this->clickLink('Check manually');

    $this->checkForMetaRefresh();

    $this->drupalGet('admin/reports/translations');

    $this->submitForm([], 'Update translations');
@@ -303,7 +316,9 @@ public function testUpdateImportModeNone(): void { 
    $this->submitForm($edit, 'Save configuration');



    // Execute translation update.

    $this->drupalGet('admin/reports/translations/check');

    $this->drupalGet('admin/reports/translations');

    $this->clickLink('Check manually');

    $this->checkForMetaRefresh();

    $this->drupalGet('admin/reports/translations');

    $this->submitForm([], 'Update translations');