Skip to content

Commit e68890f

Browse files
authored
Fix: CSRF check failed (#54)
* Fix: CSRF check failed * changelog * fix
1 parent 3d89838 commit e68890f

5 files changed

Lines changed: 53 additions & 22 deletions

File tree

CHANGELOG.md

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,16 @@ All notable changes to this project will be documented in this file.
55
The format is based on [Keep a Changelog](http://keepachangelog.com/)
66
and this project adheres to [Semantic Versioning](http://semver.org/).
77

8+
## [UNRELEASED]
9+
10+
### Fixed
11+
12+
- Avoids a CSRF check error if print is clicked multiple times
13+
- Fixes some SQL errors during export
14+
815
## [4.1.1] - 2025-10-30
916

10-
## Fixed
17+
### Fixed
1118

1219
- Fix error message `Unknown '__s' function`
1320

front/export.php

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,6 @@
3333
/** @var array $PLUGIN_HOOKS */
3434
global $PLUGIN_HOOKS;
3535

36-
define('GLPI_KEEP_CSRF_TOKEN', true); // 0.90
3736
$token = ($_POST['_glpi_csrf_token'] ?? false);
3837

3938
Session::checkRight('plugin_pdf', READ);

inc/item_device.class.php

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
* http://www.gnu.org/licenses/agpl-3.0-standalone.html
3030
* --------------------------------------------------------------------------
3131
*/
32+
use Glpi\DBAL\QueryExpression;
3233

3334
class PluginPdfItem_Device extends PluginPdfCommon
3435
{
@@ -69,15 +70,14 @@ public static function pdfForItem(PluginPdfSimplePDF $pdf, $item)
6970
$linktable = $dbu->getTableForItemType($itemtype);
7071
$fk = $dbu->getForeignKeyFieldForTable($dbu->getTableForItemType($associated_type));
7172

72-
$select_fields = ['COUNT(*) AS NB', 'id', $fk];
73-
if ($specif_fields !== []) {
74-
$select_fields = array_merge($select_fields, $specif_fields);
75-
}
76-
73+
$select_fields = [new QueryExpression('COUNT(*) AS NB'), 'id', $fk];
7774
// Construction of the GROUP BY clause
7875
$group_by = [$fk];
79-
if ($specif_fields !== []) {
80-
$group_by = array_merge($group_by, $specif_fields);
76+
foreach ($specif_fields as $field) {
77+
if ($DB->fieldExists($linktable, $field)) {
78+
$select_fields[] = $field;
79+
$group_by[] = $field;
80+
}
8181
}
8282

8383
$query_params = [

inc/item_softwareversion.class.php

Lines changed: 6 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -498,19 +498,12 @@ public static function pdfForItem(PluginPdfSimplePDF $pdf, $item)
498498
],
499499
'glpi_softwareversions' => [
500500
'ON' => [
501-
'OR' => [
502-
[
503-
'glpi_softwarelicenses' => 'softwareversions_id_use',
504-
'glpi_softwareversions' => 'id',
505-
],
506-
[
507-
'AND' => [
508-
'glpi_softwarelicenses.softwareversions_id_use' => 0,
509-
[
510-
'glpi_softwarelicenses' => 'softwareversions_id_buy',
511-
'glpi_softwareversions' => 'id',
512-
],
513-
],
501+
'glpi_softwarelicenses' => 'softwareversions_id_use',
502+
'glpi_softwareversions' => 'id',
503+
[
504+
'OR' => [
505+
'glpi_softwarelicenses.softwareversions_id_use' => 0,
506+
'glpi_softwarelicenses.softwareversions_id_buy' => 'glpi_softwareversions.id',
514507
],
515508
],
516509
],

templates/preference_form.html.twig

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -206,5 +206,37 @@
206206
});
207207
208208
updateSelectionCount(formId);
209+
210+
function refreshCsrfToken(formId) {
211+
fetch(window.location.href, { credentials: 'same-origin' })
212+
.then(r => r.text())
213+
.then(html => {
214+
try {
215+
const newTokenInput = new DOMParser()
216+
.parseFromString(html, 'text/html')
217+
.querySelector('input[name="_glpi_csrf_token"]');
218+
if (!newTokenInput) return;
219+
220+
const currentTokenInput = document.querySelector(`#${formId} input[name="_glpi_csrf_token"]`);
221+
if (currentTokenInput) {
222+
currentTokenInput.value = newTokenInput.value;
223+
}
224+
} catch (e) {
225+
// Ignore errors silently
226+
}
227+
})
228+
.catch(() => {
229+
// Ignore errors silently
230+
});
231+
}
232+
233+
// Schedule a CSRF token refresh after form submission
234+
const form = document.getElementById(formId);
235+
if (form) {
236+
form.addEventListener('submit', () => {
237+
// Delay to allow server-side AJAX handlers to complete; full navigation will reload everything
238+
setTimeout(() => refreshCsrfToken(formId), 800);
239+
});
240+
}
209241
});
210242
</script>

0 commit comments

Comments
 (0)