From ad50e90a03b49f2e4c5e7a312825c6e1e2e2534e Mon Sep 17 00:00:00 2001 From: Ludy Date: Wed, 8 Jan 2025 16:33:35 +0100 Subject: [PATCH 1/9] Defines a unique Python version (#2646) # Description Please provide a summary of the changes, including relevant motivation and context. Closes #(issue_number) ## Checklist - [x] I have read the [Contribution Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md) - [x] I have performed a self-review of my own code - [ ] I have attached images of the change if it is UI based - [ ] I have commented my code, particularly in hard-to-understand areas - [ ] If my code has heavily changed functionality I have updated relevant docs on [Stirling-PDFs doc repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/) - [x] My changes generate no new warnings - [ ] I have read the section [Add New Translation Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/HowToAddNewLanguage.md#add-new-translation-tags) (for new translation tags only) --- .github/workflows/check_properties.yml | 2 +- .github/workflows/sync_files.yml | 2 +- .github/workflows/update-translations.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/check_properties.yml b/.github/workflows/check_properties.yml index b45da71f..2cc141cc 100644 --- a/.github/workflows/check_properties.yml +++ b/.github/workflows/check_properties.yml @@ -28,7 +28,7 @@ jobs: - name: Set up Python uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0 with: - python-version: "3.x" + python-version: "3.12" - name: Get PR data id: get-pr-data diff --git a/.github/workflows/sync_files.yml b/.github/workflows/sync_files.yml index e27f1b39..60047031 100644 --- a/.github/workflows/sync_files.yml +++ b/.github/workflows/sync_files.yml @@ -28,7 +28,7 @@ jobs: - name: Set up Python uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0 with: - python-version: "3.x" + python-version: "3.12" - name: Install dependencies run: pip install tomlkit - name: Sync README diff --git a/.github/workflows/update-translations.yml b/.github/workflows/update-translations.yml index 8c1a82d6..ece0f7f0 100644 --- a/.github/workflows/update-translations.yml +++ b/.github/workflows/update-translations.yml @@ -28,7 +28,7 @@ jobs: - name: Set up Python uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0 with: - python-version: "3.x" + python-version: "3.12" - name: Run Python script to check files id: run-check From f8e1ce6a7bdd2c142276a19958b17f8fab087083 Mon Sep 17 00:00:00 2001 From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com> Date: Wed, 8 Jan 2025 17:10:34 +0000 Subject: [PATCH 2/9] csrf fixes (#2647) # Description Please provide a summary of the changes, including relevant motivation and context. Closes #(issue_number) ## Checklist - [ ] I have read the [Contribution Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md) - [ ] I have performed a self-review of my own code - [ ] I have attached images of the change if it is UI based - [ ] I have commented my code, particularly in hard-to-understand areas - [ ] If my code has heavily changed functionality I have updated relevant docs on [Stirling-PDFs doc repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/) - [ ] My changes generate no new warnings - [ ] I have read the section [Add New Translation Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/HowToAddNewLanguage.md#add-new-translation-tags) (for new translation tags only) --- src/main/resources/static/js/csrf.js | 37 +++++++++++++++++++ .../resources/templates/fragments/common.html | 1 + 2 files changed, 38 insertions(+) create mode 100644 src/main/resources/static/js/csrf.js diff --git a/src/main/resources/static/js/csrf.js b/src/main/resources/static/js/csrf.js new file mode 100644 index 00000000..2dc1c0ca --- /dev/null +++ b/src/main/resources/static/js/csrf.js @@ -0,0 +1,37 @@ +document.addEventListener('DOMContentLoaded', function() { + // Get CSRF token from cookie + const getCsrfToken = () => { + return document.cookie + .split('; ') + .find(row => row.startsWith('XSRF-TOKEN=')) + ?.split('=')[1]; + }; + + // Function to decode the URI-encoded cookie value + const decodeCsrfToken = (token) => { + if (token) { + return decodeURIComponent(token); + } + return null; + }; + + // Find all forms and add CSRF token + const forms = document.querySelectorAll('form'); + const csrfToken = decodeCsrfToken(getCsrfToken()); + + // Only proceed if we have a cookie-based token + if (csrfToken) { + forms.forEach(form => { + // Only now remove existing CSRF input fields since we have a new token + const existingCsrfInputs = form.querySelectorAll('input[name="_csrf"]'); + existingCsrfInputs.forEach(input => input.remove()); + + // Create and add new CSRF input field + const csrfInput = document.createElement('input'); + csrfInput.type = 'hidden'; + csrfInput.name = '_csrf'; + csrfInput.value = csrfToken; + form.appendChild(csrfInput); + }); + } +}); \ No newline at end of file diff --git a/src/main/resources/templates/fragments/common.html b/src/main/resources/templates/fragments/common.html index 1cd908a6..a6099f5a 100644 --- a/src/main/resources/templates/fragments/common.html +++ b/src/main/resources/templates/fragments/common.html @@ -73,6 +73,7 @@ +