Skip to content

Commit

Permalink
Merged in fix-csrf (pull request #1)
Browse files Browse the repository at this point in the history
管理画面の不具合を修正
  • Loading branch information
ryo-endo committed Apr 13, 2016
2 parents bb6b505 + c89ee1e commit 01e95d4
Show file tree
Hide file tree
Showing 4 changed files with 30 additions and 3 deletions.
14 changes: 14 additions & 0 deletions src/Eccube/Controller/Admin/Product/ProductController.php
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,9 @@
use Symfony\Component\HttpFoundation\File\File;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\StreamedResponse;
use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
use Symfony\Component\HttpKernel\Exception\UnsupportedMediaTypeHttpException;

class ProductController extends AbstractController
{
Expand Down Expand Up @@ -177,12 +179,22 @@ public function index(Application $app, Request $request, $page_no = null)

public function addImage(Application $app, Request $request)
{
if (!$request->isXmlHttpRequest()) {
throw new BadRequestHttpException();
}

$images = $request->files->get('admin_product');

$files = array();
if (count($images) > 0) {
foreach ($images as $img) {
foreach ($img as $image) {
//ファイルフォーマット検証
$mimeType = $image->getMimeType();
if (0 !== strpos($mimeType, 'image')) {
throw new UnsupportedMediaTypeHttpException();
}

$extension = $image->getClientOriginalExtension();
$filename = date('mdHis') . uniqid('_') . '.' . $extension;
$image->move($app['config']['image_temp_realdir'], $filename);
Expand Down Expand Up @@ -556,6 +568,8 @@ public function delete(Application $app, Request $request, $id = null)

public function copy(Application $app, Request $request, $id = null)
{
$this->isTokenValid($app);

if (!is_null($id)) {
$Product = $app['eccube.repository.product']->find($id);
if ($Product instanceof \Eccube\Entity\Product) {
Expand Down
13 changes: 13 additions & 0 deletions src/Eccube/Controller/Admin/Setting/Shop/PaymentController.php
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,8 @@
use Eccube\Event\EventArgs;
use Symfony\Component\Filesystem\Filesystem;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
use Symfony\Component\HttpKernel\Exception\UnsupportedMediaTypeHttpException;

class PaymentController extends AbstractController
{
Expand Down Expand Up @@ -126,10 +128,21 @@ public function edit(Application $app, Request $request, $id = null)

public function imageAdd(Application $app, Request $request)
{
if (!$request->isXmlHttpRequest()) {
throw new BadRequestHttpException();
}

$images = $request->files->get('payment_register');
$filename = null;
if (isset($images['payment_image_file'])) {
$image = $images['payment_image_file'];

//ファイルフォーマット検証
$mimeType = $image->getMimeType();
if (0 !== strpos($mimeType, 'image')) {
throw new UnsupportedMediaTypeHttpException();
}

$extension = $image->guessExtension();
$filename = date('mdHis') . uniqid('_') . '.' . $extension;
$image->move($app['config']['image_temp_realdir'], $filename);
Expand Down
2 changes: 1 addition & 1 deletion src/Eccube/Resource/template/admin/Product/index.twig
Original file line number Diff line number Diff line change
Expand Up @@ -264,7 +264,7 @@ $(function() {
<ul id="result_list__item_menu--{{ Product.id }}" class="dropdown-menu dropdown-menu-right">
<li><a href="{{ url('admin_product_product_class', { id : Product.id }) }}">規格</a></li>
<li><a href="{{ url('admin_product_product_display', {'id' : Product.id}) }}" target="_blank">確認</a></li>
<li><a href="#" onclick="fnCopy('{{ url('admin_product_product_copy', {'id' : Product.id}) }}');return false;">複製</a></li>
<li><a href="{{ url('admin_product_product_copy', {'id' : Product.id}) }}" {{ csrf_token_for_anchor() }} data-method="post" data-message="商品情報を複製してもよろしいですか?">複製</a></li>
<li><a href="{{ url('admin_product_product_delete', {'id' : Product.id}) }}" {{ csrf_token_for_anchor() }} data-method="delete" data-message="商品情報を削除してもよろしいですか?">削除</a></li>
</ul>
</div>
Expand Down
4 changes: 2 additions & 2 deletions src/Eccube/Resource/template/admin/Product/product.twig
Original file line number Diff line number Diff line change
Expand Up @@ -442,9 +442,9 @@ function fnClass(action) {
</a>
</li>
<li>
<button class="btn btn-default btn-block btn-sm" onclick="fnCopy('{{ url('admin_product_product_copy', {'id' : id}) }}');return false;">
<a class="btn btn-default btn-block btn-sm" href="{{ url('admin_product_product_copy', {'id' : Product.id}) }}" {{ csrf_token_for_anchor() }} data-method="post" data-message="この商品情報を複製してもよろしいですか?">
複製
</button>
</a>
</li>
<li>
<a class="btn btn-default btn-block btn-sm" href="{{ url('admin_product_product_delete', {'id' : Product.id}) }}" {{ csrf_token_for_anchor() }} data-method="delete" data-message="この商品情報を削除してもよろしいですか?">
Expand Down

0 comments on commit 01e95d4

Please sign in to comment.