Przeglądaj źródła

Remove csrf

https://youtrack.weseek.co.jp/issue/GW-7759
- Implement `apiPostForm` instead of `apiPost` to upload brand logo
- Remove csrf from apiPost and apiPostFrom request params
mudana 3 lat temu
rodzic
commit
503390e89f

+ 2 - 4
packages/app/src/client/services/AdminCustomizeContainer.js

@@ -4,7 +4,7 @@ import { AttachmentType } from '~/server/interfaces/attachment';
 import loggerFactory from '~/utils/logger';
 import loggerFactory from '~/utils/logger';
 
 
 import { toastError } from '../util/apiNotification';
 import { toastError } from '../util/apiNotification';
-import { apiPost } from '../util/apiv1-client';
+import { apiPost, apiPostForm } from '../util/apiv1-client';
 import { apiv3Get, apiv3Put } from '../util/apiv3-client';
 import { apiv3Get, apiv3Put } from '../util/apiv3-client';
 
 
 // eslint-disable-next-line no-unused-vars
 // eslint-disable-next-line no-unused-vars
@@ -446,7 +446,6 @@ export default class AdminCustomizeContainer extends Container {
   async deleteLogo() {
   async deleteLogo() {
     try {
     try {
       const formData = {
       const formData = {
-        _csrf:  this.appContainer.csrfToken,
         brandLogoAttachmentId: this.state.brandLogoAttachmentId,
         brandLogoAttachmentId: this.state.brandLogoAttachmentId,
       };
       };
       await apiPost('/attachments.removeBrandLogo', formData);
       await apiPost('/attachments.removeBrandLogo', formData);
@@ -467,10 +466,9 @@ export default class AdminCustomizeContainer extends Container {
     try {
     try {
       const formData = new FormData();
       const formData = new FormData();
       formData.append('file', file);
       formData.append('file', file);
-      formData.append('_csrf', this.appContainer.csrfToken);
       formData.append('attachmentType', AttachmentType.BRAND_LOGO);
       formData.append('attachmentType', AttachmentType.BRAND_LOGO);
       formData.append('brandLogoAttachmentId', this.state.brandLogoAttachmentId);
       formData.append('brandLogoAttachmentId', this.state.brandLogoAttachmentId);
-      const response = await apiPost('/attachments.uploadBrandLogo', formData);
+      const response = await apiPostForm('/attachments.uploadBrandLogo', formData);
 
 
       this.setState({
       this.setState({
         uploadedLogoSrc: response.attachment.filePathProxied,
         uploadedLogoSrc: response.attachment.filePathProxied,