Commit 125ea0ea authored by Jordan Karlov's avatar Jordan Karlov
Browse files

Issue #3277720 by JordiK, danmuzyka, kevin.dutra: Add _csrf_token access control to rate routes

parent 1eda1b3e

rate.routing.yml

+2 −0
Original line number Diff line number Diff line
@@ -12,12 +12,14 @@ rate.vote: 
    _controller: '\Drupal\rate\Controller\VoteController::vote'

  requirements:

    _permission: 'access content'

    _csrf_token: 'TRUE'

rate.undo_vote:

  path: '/rate/undo/{entity_type_id}/{entity_id}/{widget_type}'

  defaults:

    _controller: 'Drupal\rate\Controller\VoteController::undoVote'

  requirements:

    _permission: 'access content'

    _csrf_token: 'TRUE'

rate.results_page:

  path: '/node/{node}/rating'

  defaults:

src/Controller/VoteController.php

+3 −1
Original line number Diff line number Diff line
@@ -149,7 +149,9 @@ class VoteController extends ControllerBase implements ContainerInjectionInterfa 
      $response = new AjaxResponse();

      $vote_widget = $this->voteWidget->buildRateVotingWidget($entity_id, $entity_type_id, $bundle, $widget_type);

      $widget_id = '[data-drupal-selector=rate-' . $entity_type_id . '-' . $entity_id . ']';

      $html = $this->renderer->render($vote_widget);

      // Must render root to ensure CSRF placeholders are properly replaced for

      // any links in the response.

      $html = $this->renderer->renderRoot($vote_widget);

      $response->addCommand(new ReplaceCommand($widget_id, $html));

      return $response;

    }