Cutlery/invoiceninja
1
0
Fork 0
mirror of https://github.com/invoiceninja/invoiceninja.git synced 2025-07-08 22:14:33 -04:00
Code Issues Packages Projects Releases Wiki Activity

Prevent cross site migration (#3594)

Browse Source 
- php-cs-fixer applied
- Added new 'cross_migration_message'
- errors.blade.php - unescape characters
This commit is contained in:
Benjamin Beganović 2020-04-06 23:21:46 +02:00 committed by GitHub
parent 3239a1c041
commit 4323968240
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 26 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
app/Http/Controllers/Migration/StepsController.php
View File

@ -114,6 +114,10 @@ class StepsController extends BaseController
return redirect($this->access['auth']['redirect']); return redirect($this->access['auth']['redirect']);
} }
if (auth()->user()->email !== $request->email) {
return back()->with('responseErrors', [trans('texts.cross_migration_message')]);
}
$authentication = (new AuthService($request->email, $request->password)) $authentication = (new AuthService($request->email, $request->password))
->endpoint(session('MIGRATION_ENDPOINT')) ->endpoint(session('MIGRATION_ENDPOINT'))
->start(); ->start();

1
resources/lang/en/texts.php
View File

@ -3535,6 +3535,7 @@ $LANG = array(
'marked_credit_as_sent' => 'Successfully marked credit as sent', 'marked_credit_as_sent' => 'Successfully marked credit as sent',
'email_subject_payment_partial' => 'Email Partial Payment Subject', 'email_subject_payment_partial' => 'Email Partial Payment Subject',
'is_approved' => 'Is Approved', 'is_approved' => 'Is Approved',
'cross_migration_message' => 'Cross account migration is not allowed. Please read more about it here: <a href="https://invoiceninja.github.io/cross-site-migration.html">https://invoiceninja.github.io/cross-site-migration.html</a>'
); );
return $LANG; return $LANG;

4
resources/views/migration/includes/errors.blade.php
View File

@ -1,9 +1,7 @@
@if(session('responseErrors')) @if(session('responseErrors'))
<div class="alert alert-danger"> <div class="alert alert-danger">
<ul>
@foreach(session('responseErrors') as $error) @foreach(session('responseErrors') as $error)
<li>{{ $error }}</li> <p>{!! $error !!}</p>
@endforeach @endforeach
</ul>
</div> </div>
@endif @endif