CVE-2021-3729: Cross-Site Request Forgery (CSRF) (CWE-352)
value: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 4.3
Published: 2021-08-23T13:15Z
Repository: https://github.com/firefly-iii/firefly-iii
Language: PHP
Files changed: app/Http/Controllers/CurrencyController.php, public/v1/js/ff/currencies/index.js, resources/views/v1/currencies/index.twig, routes/web.php
Commit date: 2021-08-20 09:51:00 +0200
Commit message: Fix https://huntr.dev/bounties/d32f3d5a-0738-41ba-89de-34f2a772de76/

Diff: diff --git a/app/Http/Controllers/CurrencyController.php b/app/Http/Controllers/CurrencyController.php
index 0b8eba1feb..3b04b612b9 100644
--- a/app/Http/Controllers/CurrencyController.php
+++ b/app/Http/Controllers/CurrencyController.php
@@ -19,10 +19,11 @@
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
 declare(strict_types=1);
 
 namespace FireflyIII\Http\Controllers;
+
 use FireflyIII\Exceptions\FireflyException;
 use FireflyIII\Http\Requests\CurrencyFormRequest;
 use FireflyIII\Models\TransactionCurrency;
 use FireflyIII\Repositories\Currency\CurrencyRepositoryInterface;
 use FireflyIII\Repositories\User\UserRepositoryInterface;
@@ -39,11 +40,11 @@
  * Class CurrencyController.
  */
 class CurrencyController extends Controller
 {
     protected CurrencyRepositoryInterface $repository;
-    protected UserRepositoryInterface $userRepository;
+    protected UserRepositoryInterface     $userRepository;
 
     /**
      * CurrencyController constructor.
      *
      * @codeCoverageIgnore
@@ -52,19 +53,20 @@ public function __construct()
     {
         parent::__construct();
 
         $this->middleware(
             function ($request, $next) {
-                app('view')->share('title', (string) trans('firefly.currencies'));
+                app('view')->share('title', (string)trans('firefly.currencies'));
                 app('view')->share('mainTitleIcon', 'fa-usd');
                 $this->repository     = app(CurrencyRepositoryInterface::class);
                 $this->userRepository = app(UserRepositoryInterface::class);
 
                 return $next($request);
             }
         );
     }
+
     /**
      * Create a currency.
      *
      * @param Request $request
      *
@@ -73,17 +75,17 @@ function ($request, $next) {
     public function create(Request $request)
     {
         /** @var User $user */
         $user = auth()->user();
         if (!$this->userRepository->hasRole($user, 'owner')) {
-            $request->session()->flash('error', (string) trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
+            $request->session()->flash('error', (string)trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
 
             return redirect(route('currencies.index'));
         }
 
         $subTitleIcon = 'fa-plus';
-        $subTitle     = (string) trans('firefly.create_currency');
+        $subTitle     = (string)trans('firefly.create_currency');
 
         // put previous url in session if not redirect from store (not "create another").
         if (true !== session('currencies.create.fromStore')) {
             $this->rememberPreviousUri('currencies.create.uri');
         }
@@ -100,19 +102,27 @@ public function create(Request $request)
      * @param Request             $request
      * @param TransactionCurrency $currency
      *
      * @return RedirectResponse|Redirector
      */
-    public function defaultCurrency(Request $request, TransactionCurrency $currency)
+    public function defaultCurrency(Request $request)
     {
-        app('preferences')->set('currencyPreference', $currency->code);
-        app('preferences')->mark();
-
-        Log::channel('audit')->info(sprintf('Make %s the default currency.', $currency->code));
-
-        $this->repository->enable($currency);
-        $request->session()->flash('success', (string) trans('firefly.new_default_currency', ['name' => $currency->name]));
+        $currencyId = (int)$request->get('id');
+        if ($currencyId > 0) {
+            // valid currency?
+            $currency = $this->repository->find($currencyId);
+            if (null !== $currency) {
+                app('preferences')->set('currencyPreference', $currency->code);
+                app('preferences')->mark();
+                Log::channel('audit')->info(sprintf('Make %s the default currency.', $currency->code));
+
+                $this->repository->enable($currency);
+                $request->session()->flash('success', (string)trans('firefly.new_default_currency', ['name' => $currency->name]));
+
+                return redirect(route('currencies.index'));
+            }
+        }
 
         return redirect(route('currencies.index'));
     }
 
     /**
@@ -127,29 +137,29 @@ public function delete(Request $request, TransactionCurrency $currency)
     {
         /** @var User $user */
         $user = auth()->user();
         if (!$this->userRepository->hasRole($user, 'owner')) {
 
-            $request->session()->flash('error', (string) trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
+            $request->session()->flash('error', (string)trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
             Log::channel('audit')->info(sprintf('Tried to visit page to delete currency %s but is not site owner.', $currency->code));
 
             return redirect(route('currencies.index'));
 
         }
 
         if ($this->repository->currencyInUse($currency)) {
             $location = $this->repository->currencyInUseAt($currency);
-            $message  = (string) trans(sprintf('firefly.cannot_disable_currency_%s', $location), ['name' => e($currency->name)]);
+            $message  = (string)trans(sprintf('firefly.cannot_disable_currency_%s', $location), ['name' => e($currency->name)]);
             $request->session()->flash('error', $message);
             Log::channel('audit')->info(sprintf('Tried to visit page to delete currency %s but currency is in use.', $currency->code));
 
             return redirect(route('currencies.index'));
         }
 
         // put previous url in session
         $this->rememberPreviousUri('currencies.delete.uri');
-        $subTitle = (string) trans('form.delete_currency', ['name' => $currency->name]);
+        $subTitle = (string)trans('form.delete_currency', ['name' => $currency->name]);
         Log::channel('audit')->info(sprintf('Visit page to delete currency %s.', $currency->code));
 
         return prefixView('currencies.delete', compact('currency', 'subTitle'));
     }
 
@@ -165,65 +175,65 @@ public function destroy(Request $request, TransactionCurrency $currency)
     {
         /** @var User $user */
         $user = auth()->user();
         if (!$this->userRepository->hasRole($user, 'owner')) {
 
-            $request->session()->flash('error', (string) trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
+            $request->session()->flash('error', (string)trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
             Log::channel('audit')->info(sprintf('Tried to delete currency %s but is not site owner.', $currency->code));
 
             return redirect(route('currencies.index'));
 
         }
 
         if ($this->repository->currencyInUse($currency)) {
-            $request->session()->flash('error', (string) trans('firefly.cannot_delete_currency', ['name' => e($currency->name)]));
+            $request->session()->flash('error', (string)trans('firefly.cannot_delete_currency', ['name' => e($currency->name)]));
             Log::channel('audit')->info(sprintf('Tried to delete currency %s but is in use.', $currency->code));
 
             return redirect(route('currencies.index'));
         }
 
         if ($this->repository->isFallbackCurrency($currency)) {
-            $request->session()->flash('error', (string) trans('firefly.cannot_delete_fallback_currency', ['name' => e($currency->name)]));
+            $request->session()->flash('error', (string)trans('firefly.cannot_delete_fallback_currency', ['name' => e($currency->name)]));
             Log::channel('audit')->info(sprintf('Tried to delete currency %s but is FALLBACK.', $currency->code));
 
             return redirect(route('currencies.index'));
         }
 
         Log::channel('audit')->info(sprintf('Deleted currency %s.', $currency->code));
         $this->repository->destroy($currency);
 
-        $request->session()->flash('success', (string) trans('firefly.deleted_currency', ['name' => $currency->name]));
+        $request->session()->flash('success', (string)trans('firefly.deleted_currency', ['name' => $currency->name]));
 
         return redirect($this->getPreviousUri('currencies.delete.uri'));
     }
 
     /**
      * @param Request             $request
      * @param TransactionCurrency $currency
      *
-     * @throws FireflyException
      * @return RedirectResponse|Redirector
+     * @throws FireflyException
      */
     public function disableCurrency(Request $request, TransactionCurrency $currency)
     {
         app('preferences')->mark();
 
         /** @var User $user */
         $user = auth()->user();
         if (!$this->userRepository->hasRole($user, 'owner')) {
 
-            $request->session()->flash('error', (string) trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
+            $request->session()->flash('error', (string)trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
             Log::channel('audit')->info(sprintf('Tried to disable currency %s but is not site owner.', $currency->code));
 
             return redirect(route('currencies.index'));
 
         }
 
         if ($this->repository->currencyInUse($currency)) {
 
             $location = $this->repository->currencyInUseAt($currency);
-            $message  = (string) trans(sprintf('firefly.cannot_disable_currency_%s', $location), ['name' => e($currency->name)]);
+            $message  = (string)trans(sprintf('firefly.cannot_disable_currency_%s', $location), ['name' => e($currency->name)]);
 
             $request->session()->flash('error', $message);
             Log::channel('audit')->info(sprintf('Tried to disable currency %s but is in use.', $currency->code));
 
             return redirect(route('currencies.index'));
@@ -243,14 +253,14 @@ public function disableCurrency(Request $request, TransactionCurrency $currency)
             app('preferences')->set('currencyPreference', $first->code);
             app('preferences')->mark();
         }
 
         if ('EUR' === $currency->code) {
-            session()->flash('warning', (string) trans('firefly.disable_EUR_side_effects'));
+            session()->flash('warning', (string)trans('firefly.disable_EUR_side_effects'));
         }
 
-        session()->flash('success', (string) trans('firefly.currency_is_now_disabled', ['name' => $currency->name]));
+        session()->flash('success', (string)trans('firefly.currency_is_now_disabled', ['name' => $currency->name]));
 
         return redirect(route('currencies.index'));
     }
 
     /**
@@ -265,25 +275,25 @@ public function edit(Request $request, TransactionCurrency $currency)
     {
         /** @var User $user */
         $user = auth()->user();
         if (!$this->userRepository->hasRole($user, 'owner')) {
 
-            $request->session()->flash('error', (string) trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
+            $request->session()->flash('error', (string)trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
             Log::channel('audit')->info(sprintf('Tried to edit currency %s but is not owner.', $currency->code));
 
             return redirect(route('currencies.index'));
 
         }
 
         $subTitleIcon     = 'fa-pencil';
-        $subTitle         = (string) trans('breadcrumbs.edit_currency', ['name' => $currency->name]);
+        $subTitle         = (string)trans('breadcrumbs.edit_currency', ['name' => $currency->name]);
         $currency->symbol = htmlentities($currency->symbol);
 
         // code to handle active-checkboxes
         $hasOldInput = null !== $request->old('_token');
         $preFilled   = [
-            'enabled' => $hasOldInput ? (bool) $request->old('enabled') : $currency->enabled,
+            'enabled' => $hasOldInput ? (bool)$request->old('enabled') : $currency->enabled,
         ];
 
         $request->session()->flash('preFilled', $preFilled);
         Log::channel('audit')->info('Edit currency.', $currency->toArray());
 
@@ -304,11 +314,11 @@ public function edit(Request $request, TransactionCurrency $currency)
     public function enableCurrency(TransactionCurrency $currency)
     {
         app('preferences')->mark();
 
         $this->repository->enable($currency);
-        session()->flash('success', (string) trans('firefly.currency_is_now_enabled', ['name' => $currency->name]));
+        session()->flash('success', (string)trans('firefly.currency_is_now_enabled', ['name' => $currency->name]));
         Log::channel('audit')->info(sprintf('Enabled currency %s.', $currency->code));
 
         return redirect(route('currencies.index'));
     }
 
@@ -321,27 +331,28 @@ public function enableCurrency(TransactionCurrency $currency)
      */
     public function index(Request $request)
     {
         /** @var User $user */
         $user       = auth()->user();
-        $page       = 0 === (int) $request->get('page') ? 1 : (int) $request->get('page');
-        $pageSize   = (int) app('preferences')->get('listPageSize', 50)->data;
+        $page       = 0 === (int)$request->get('page') ? 1 : (int)$request->get('page');
+        $pageSize   = (int)app('preferences')->get('listPageSize', 50)->data;
         $collection = $this->repository->getAll();
         $total      = $collection->count();
         $collection = $collection->slice(($page - 1) * $pageSize, $pageSize);
         $currencies = new LengthAwarePaginator($collection, $total, $pageSize, $page);
         $currencies->setPath(route('currencies.index'));
 
         $defaultCurrency = $this->repository->getCurrencyByPreference(app('preferences')->get('currencyPreference', config('firefly.default_currency', 'EUR')));
         $isOwner         = true;
         if (!$this->userRepository->hasRole($user, 'owner')) {
-            $request->session()->flash('info', (string) trans('firefly.ask_site_owner', ['owner' => config('firefly.site_owner')]));
+            $request->session()->flash('info', (string)trans('firefly.ask_site_owner', ['owner' => config('firefly.site_owner')]));
             $isOwner = false;
         }
 
         return prefixView('currencies.index', compact('currencies', 'defaultCurrency', 'isOwner'));
     }
+
     /**
      * Store new currency.
      *
      * @param CurrencyFormRequest $request
      *
@@ -365,29 +376,30 @@ public function store(CurrencyFormRequest $request)
         try {
             $currency = $this->repository->store($data);
         } catch (FireflyException $e) {
             Log::error($e->getMessage());
             Log::channel('audit')->info('Could not store (POST) currency without admin rights.', $data);
-            $request->session()->flash('error', (string) trans('firefly.could_not_store_currency'));
+            $request->session()->flash('error', (string)trans('firefly.could_not_store_currency'));
             $currency = null;
         }
         $redirect = redirect($this->getPreviousUri('currencies.create.uri'));
 
         if (null !== $currency) {
-            $request->session()->flash('success', (string) trans('firefly.created_currency', ['name' => $currency->name]));
+            $request->session()->flash('success', (string)trans('firefly.created_currency', ['name' => $currency->name]));
             Log::channel('audit')->info('Created (POST) currency.', $data);
-            if (1 === (int) $request->get('create_another')) {
+            if (1 === (int)$request->get('create_another')) {
 
                 $request->session()->put('currencies.create.fromStore', true);
 
                 $redirect = redirect(route('currencies.create'))->withInput();
 
             }
         }
 
         return $redirect;
     }
+
     /**
      * Updates a currency.
      *
      * @param CurrencyFormRequest $request
      * @param TransactionCurrency $currency
@@ -403,22 +415,22 @@ public function update(CurrencyFormRequest $request, TransactionCurrency $curren
         if (false === $data['enabled'] && $this->repository->currencyInUse($currency)) {
             $data['enabled'] = true;
         }
         if (!$this->userRepository->hasRole($user, 'owner')) {
 
-            $request->session()->flash('error', (string) trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
+            $request->session()->flash('error', (string)trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
             Log::channel('audit')->info('Tried to update (POST) currency without admin rights.', $data);
 
             return redirect(route('currencies.index'));
 
         }
         $currency = $this->repository->update($currency, $data);
         Log::channel('audit')->info('Updated (POST) currency.', $data);
-        $request->session()->flash('success', (string) trans('firefly.updated_currency', ['name' => $currency->name]));
+        $request->session()->flash('success', (string)trans('firefly.updated_currency', ['name' => $currency->name]));
         app('preferences')->mark();
 
-        if (1 === (int) $request->get('return_to_edit')) {
+        if (1 === (int)$request->get('return_to_edit')) {
 
             $request->session()->put('currencies.edit.fromUpdate', true);
 
             return redirect(route('currencies.edit', [$currency->id]));
 
diff --git a/public/v1/js/ff/currencies/index.js b/public/v1/js/ff/currencies/index.js
new file mode 100644
index 0000000000..eb0ad1f1f2
--- /dev/null
+++ b/public/v1/js/ff/currencies/index.js
@@ -0,0 +1,43 @@
+/*
+ * index.js
+ * Copyright (c) 2019 james@firefly-iii.org
+ *
+ * This file is part of Firefly III (https://github.com/firefly-iii).
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/**
+ *
+ */
+$(function () {
+    "use strict";
+    $('.make_default').on('click', setDefaultCurrency);
+
+});
+
+function setDefaultCurrency(e) {
+    var button = $(e.currentTarget);
+    var currencyId = parseInt(button.data('id'));
+
+    $.post(makeDefaultUrl, {
+        _token: token,
+        id: currencyId
+    }).done(function (data) {
+        // lame but it works
+        location.reload();
+    }).fail(function () {
+        console.error('I failed :(');
+    });
+}
diff --git a/resources/views/v1/currencies/index.twig b/resources/views/v1/currencies/index.twig
index de8e4c7dcc..f1014591d8 100644
--- a/resources/views/v1/currencies/index.twig
+++ b/resources/views/v1/currencies/index.twig
@@ -8,11 +8,11 @@
     <div class="row">
         <div class="col-lg-12 col-sm-12 col-md-12">
             <div class="box">
                 <div class="box-header with-border">
                     <h3 class="box-title">{{ 'currencies'|_ }}</h3>
-                        <a class="btn btn-success pull-right" href="{{ route('currencies.create') }}">{{ 'create_currency'|_ }}</a>
+                    <a class="btn btn-success pull-right" href="{{ route('currencies.create') }}">{{ 'create_currency'|_ }}</a>
                 </div>
                 <div class="box-body">
                     <p class="text-info">
                         {{ 'currencies_intro'|_ }}
                     </p>
@@ -38,50 +38,50 @@
                             {% for currency in currencies %}
                                 <tr>
                                     {% if isOwner %}
                                         <td>
                                             <div class="btn-group btn-group-xs">
-                                                <a class="btn btn-default" href="{{ route('currencies.edit',currency.id) }}"><span class="fa fa-fw fa-pencil"></span></a>
-                                                <a class="btn btn-danger" href="{{ route('currencies.delete',currency.id) }}"><span class="fa fa-fw fa-trash"></span></a>
+                                                <a class="btn btn-default" href="{{ route('currencies.edit',currency.id) }}"><span
+                                                            class="fa fa-fw fa-pencil"></span></a>
+                                                <a class="btn btn-danger" href="{{ route('currencies.delete',currency.id) }}"><span
+                                                            class="fa fa-fw fa-trash"></span></a>
                                             </div>
                                         </td>
                                     {% endif %}
                                     <td>
                                         {% if currency.enabled == false %}
-                                            <span class="text-muted">
+                                        <span class="text-muted">
                                         {% endif %}
-                                        {{ currency.name }} ({{ currency.code }}) ({{ currency.symbol|raw }})
+                                            {{ currency.name }} ({{ currency.code }}) ({{ currency.symbol|raw }})
                                         {% if currency.id == defaultCurrency.id %}
-                                        <span class="label label-success" id="default-currency">{{ 'default_currency'|_ }}</span>
+                                            <span class="label label-success" id="default-currency">{{ 'default_currency'|_ }}</span>
                                         {% endif %}
-                                        {% if currency.enabled == false %}
+                                            {% if currency.enabled == false %}
                                         </span>
-                                        <br><small class="text-danger">{{ 'currency_is_disabled'|_ }}</small>
+                                    <br><small class="text-danger">{{ 'currency_is_disabled'|_ }}</small>
                                         {% endif %}
                                     </td>
 
                                     <td>{{ currency.decimal_places }}</td>
                                     <td class="buttons">
                                         <div class="btn-group">
-                                        {% if currency.id != defaultCurrency.id %}
-                                            <a class="btn btn-default"
-                                               href="{{ route('currencies.default',currency.id) }}">
-                                                <span class="fa fa-fw fa-star"></span>
-                                                {{ 'make_default_currency'|_ }}</a>
-                                        {% endif %}
-                                        {% if currency.enabled %}
-                                            <a class="btn btn-default"
-                                               href="{{ route('currencies.disable',currency.id) }}">
-                                                <span class="fa fa-fw fa-square-o"></span>
-                                                {{ 'disable_currency'|_ }}</a>
-                                        {% endif %}
-                                        {% if not currency.enabled %}
-                                            <a class="btn btn-default"
-                                               href="{{ route('currencies.enable',currency.id) }}">
-                                                <span class="fa fa-fw fa-check-square-o"></span>
-                                                {{ 'enable_currency'|_ }}</a>
-                                        {% endif %}
+                                            {% if currency.id != defaultCurrency.id %}
+                                                <button data-id="{{ currency.id }}" class="make_default btn btn-default"><span
+                                                            class="fa fa-fw fa-star"></span> {{ 'make_default_currency'|_ }}</button>
+                                            {% endif %}
+                                            {% if currency.enabled %}
+                                                <a class="btn btn-default"
+                                                   href="{{ route('currencies.disable',currency.id) }}">
+                                                    <span class="fa fa-fw fa-square-o"></span>
+                                                    {{ 'disable_currency'|_ }}</a>
+                                            {% endif %}
+                                            {% if not currency.enabled %}
+                                                <a class="btn btn-default"
+                                                   href="{{ route('currencies.enable',currency.id) }}">
+                                                    <span class="fa fa-fw fa-check-square-o"></span>
+                                                    {{ 'enable_currency'|_ }}</a>
+                                            {% endif %}
                                         </div>
                                     </td>
                                 </tr>
                             {% endfor %}
                             </tbody>
@@ -96,5 +96,11 @@
                 </div>
             </div>
         </div>
     </div>
 {% endblock %}
+{% block scripts %}
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
+        var makeDefaultUrl = "{{ route('currencies.default') }}";
+    </script>
+    <script type="text/javascript" src="v1/js/ff/currencies/index.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+{% endblock %}
\ No newline at end of file
diff --git a/routes/web.php b/routes/web.php
index 7982d04aaa..0d4bad5087 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -328,11 +328,11 @@ static function () {
     static function () {
         Route::get('', ['uses' => 'CurrencyController@index', 'as' => 'index']);
         Route::get('create', ['uses' => 'CurrencyController@create', 'as' => 'create']);
         Route::get('edit/{currency}', ['uses' => 'CurrencyController@edit', 'as' => 'edit']);
         Route::get('delete/{currency}', ['uses' => 'CurrencyController@delete', 'as' => 'delete']);
-        Route::get('default/{currency}', ['uses' => 'CurrencyController@defaultCurrency', 'as' => 'default']);
+        Route::post('default', ['uses' => 'CurrencyController@defaultCurrency', 'as' => 'default']);
         Route::get('enable/{currency}', ['uses' => 'CurrencyController@enableCurrency', 'as' => 'enable']);
         Route::get('disable/{currency}', ['uses' => 'CurrencyController@disableCurrency', 'as' => 'disable']);
 
         Route::post('store', ['uses' => 'CurrencyController@store', 'as' => 'store']);
         Route::post('update/{currency}', ['uses' => 'CurrencyController@update', 'as' => 'update']);

Vulnerable code:     protected UserRepositoryInterface $userRepository;
                app('view')->share('title', (string) trans('firefly.currencies'));
            $request->session()->flash('error', (string) trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
        $subTitle     = (string) trans('firefly.create_currency');
    public function defaultCurrency(Request $request, TransactionCurrency $currency)
        app('preferences')->set('currencyPreference', $currency->code);
        app('preferences')->mark();

        Log::channel('audit')->info(sprintf('Make %s the default currency.', $currency->code));

        $this->repository->enable($currency);
        $request->session()->flash('success', (string) trans('firefly.new_default_currency', ['name' => $currency->name]));
            $request->session()->flash('error', (string) trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
            $message  = (string) trans(sprintf('firefly.cannot_disable_currency_%s', $location), ['name' => e($currency->name)]);
        $subTitle = (string) trans('form.delete_currency', ['name' => $currency->name]);
            $request->session()->flash('error', (string) trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
            $request->session()->flash('error', (string) trans('firefly.cannot_delete_currency', ['name' => e($currency->name)]));
            $request->session()->flash('error', (string) trans('firefly.cannot_delete_fallback_currency', ['name' => e($currency->name)]));
        $request->session()->flash('success', (string) trans('firefly.deleted_currency', ['name' => $currency->name]));
     * @throws FireflyException
            $request->session()->flash('error', (string) trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
            $message  = (string) trans(sprintf('firefly.cannot_disable_currency_%s', $location), ['name' => e($currency->name)]);
            session()->flash('warning', (string) trans('firefly.disable_EUR_side_effects'));
        session()->flash('success', (string) trans('firefly.currency_is_now_disabled', ['name' => $currency->name]));
            $request->session()->flash('error', (string) trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
        $subTitle         = (string) trans('breadcrumbs.edit_currency', ['name' => $currency->name]);
            'enabled' => $hasOldInput ? (bool) $request->old('enabled') : $currency->enabled,
        session()->flash('success', (string) trans('firefly.currency_is_now_enabled', ['name' => $currency->name]));
        $page       = 0 === (int) $request->get('page') ? 1 : (int) $request->get('page');
        $pageSize   = (int) app('preferences')->get('listPageSize', 50)->data;
            $request->session()->flash('info', (string) trans('firefly.ask_site_owner', ['owner' => config('firefly.site_owner')]));
            $request->session()->flash('error', (string) trans('firefly.could_not_store_currency'));
            $request->session()->flash('success', (string) trans('firefly.created_currency', ['name' => $currency->name]));
            if (1 === (int) $request->get('create_another')) {
            $request->session()->flash('error', (string) trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
        $request->session()->flash('success', (string) trans('firefly.updated_currency', ['name' => $currency->name]));
        if (1 === (int) $request->get('return_to_edit')) {
                        <a class="btn btn-success pull-right" href="{{ route('currencies.create') }}">{{ 'create_currency'|_ }}</a>
                                                <a class="btn btn-default" href="{{ route('currencies.edit',currency.id) }}"><span class="fa fa-fw fa-pencil"></span></a>
                                                <a class="btn btn-danger" href="{{ route('currencies.delete',currency.id) }}"><span class="fa fa-fw fa-trash"></span></a>
                                            <span class="text-muted">
                                        {{ currency.name }} ({{ currency.code }}) ({{ currency.symbol|raw }})
                                        <span class="label label-success" id="default-currency">{{ 'default_currency'|_ }}</span>
                                        {% if currency.enabled == false %}
                                        <br><small class="text-danger">{{ 'currency_is_disabled'|_ }}</small>
                                        {% if currency.id != defaultCurrency.id %}
                                            <a class="btn btn-default"
                                               href="{{ route('currencies.default',currency.id) }}">
                                                <span class="fa fa-fw fa-star"></span>
                                                {{ 'make_default_currency'|_ }}</a>
                                        {% endif %}
                                        {% if currency.enabled %}
                                            <a class="btn btn-default"
                                               href="{{ route('currencies.disable',currency.id) }}">
                                                <span class="fa fa-fw fa-square-o"></span>
                                                {{ 'disable_currency'|_ }}</a>
                                        {% endif %}
                                        {% if not currency.enabled %}
                                            <a class="btn btn-default"
                                               href="{{ route('currencies.enable',currency.id) }}">
                                                <span class="fa fa-fw fa-check-square-o"></span>
                                                {{ 'enable_currency'|_ }}</a>
                                        {% endif %}
        Route::get('default/{currency}', ['uses' => 'CurrencyController@defaultCurrency', 'as' => 'default']);
Fixed code: 
    protected UserRepositoryInterface     $userRepository;
                app('view')->share('title', (string)trans('firefly.currencies'));

            $request->session()->flash('error', (string)trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
        $subTitle     = (string)trans('firefly.create_currency');
    public function defaultCurrency(Request $request)
        $currencyId = (int)$request->get('id');
        if ($currencyId > 0) {
            // valid currency?
            $currency = $this->repository->find($currencyId);
            if (null !== $currency) {
                app('preferences')->set('currencyPreference', $currency->code);
                app('preferences')->mark();
                Log::channel('audit')->info(sprintf('Make %s the default currency.', $currency->code));

                $this->repository->enable($currency);
                $request->session()->flash('success', (string)trans('firefly.new_default_currency', ['name' => $currency->name]));

                return redirect(route('currencies.index'));
            }
        }
            $request->session()->flash('error', (string)trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
            $message  = (string)trans(sprintf('firefly.cannot_disable_currency_%s', $location), ['name' => e($currency->name)]);
        $subTitle = (string)trans('form.delete_currency', ['name' => $currency->name]);
            $request->session()->flash('error', (string)trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
            $request->session()->flash('error', (string)trans('firefly.cannot_delete_currency', ['name' => e($currency->name)]));
            $request->session()->flash('error', (string)trans('firefly.cannot_delete_fallback_currency', ['name' => e($currency->name)]));
        $request->session()->flash('success', (string)trans('firefly.deleted_currency', ['name' => $currency->name]));
     * @throws FireflyException
            $request->session()->flash('error', (string)trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
            $message  = (string)trans(sprintf('firefly.cannot_disable_currency_%s', $location), ['name' => e($currency->name)]);
            session()->flash('warning', (string)trans('firefly.disable_EUR_side_effects'));
        session()->flash('success', (string)trans('firefly.currency_is_now_disabled', ['name' => $currency->name]));
            $request->session()->flash('error', (string)trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
        $subTitle         = (string)trans('breadcrumbs.edit_currency', ['name' => $currency->name]);
            'enabled' => $hasOldInput ? (bool)$request->old('enabled') : $currency->enabled,
        session()->flash('success', (string)trans('firefly.currency_is_now_enabled', ['name' => $currency->name]));
        $page       = 0 === (int)$request->get('page') ? 1 : (int)$request->get('page');
        $pageSize   = (int)app('preferences')->get('listPageSize', 50)->data;
            $request->session()->flash('info', (string)trans('firefly.ask_site_owner', ['owner' => config('firefly.site_owner')]));

            $request->session()->flash('error', (string)trans('firefly.could_not_store_currency'));
            $request->session()->flash('success', (string)trans('firefly.created_currency', ['name' => $currency->name]));
            if (1 === (int)$request->get('create_another')) {

            $request->session()->flash('error', (string)trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
        $request->session()->flash('success', (string)trans('firefly.updated_currency', ['name' => $currency->name]));
        if (1 === (int)$request->get('return_to_edit')) {
/*
 * index.js
 * Copyright (c) 2019 james@firefly-iii.org
 *
 * This file is part of Firefly III (https://github.com/firefly-iii).
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as
 * published by the Free Software Foundation, either version 3 of the
 * License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Affero General Public License for more details.
 *
 * You should have received a copy of the GNU Affero General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */

/**
 *
 */
$(function () {
    "use strict";
    $('.make_default').on('click', setDefaultCurrency);

});

function setDefaultCurrency(e) {
    var button = $(e.currentTarget);
    var currencyId = parseInt(button.data('id'));

    $.post(makeDefaultUrl, {
        _token: token,
        id: currencyId
    }).done(function (data) {
        // lame but it works
        location.reload();
    }).fail(function () {
        console.error('I failed :(');
    });
}
                    <a class="btn btn-success pull-right" href="{{ route('currencies.create') }}">{{ 'create_currency'|_ }}</a>
                                                <a class="btn btn-default" href="{{ route('currencies.edit',currency.id) }}"><span
                                                            class="fa fa-fw fa-pencil"></span></a>
                                                <a class="btn btn-danger" href="{{ route('currencies.delete',currency.id) }}"><span
                                                            class="fa fa-fw fa-trash"></span></a>
                                        <span class="text-muted">
                                            {{ currency.name }} ({{ currency.code }}) ({{ currency.symbol|raw }})
                                            <span class="label label-success" id="default-currency">{{ 'default_currency'|_ }}</span>
                                            {% if currency.enabled == false %}
                                    <br><small class="text-danger">{{ 'currency_is_disabled'|_ }}</small>
                                            {% if currency.id != defaultCurrency.id %}
                                                <button data-id="{{ currency.id }}" class="make_default btn btn-default"><span
                                                            class="fa fa-fw fa-star"></span> {{ 'make_default_currency'|_ }}</button>
                                            {% endif %}
                                            {% if currency.enabled %}
                                                <a class="btn btn-default"
                                                   href="{{ route('currencies.disable',currency.id) }}">
                                                    <span class="fa fa-fw fa-square-o"></span>
                                                    {{ 'disable_currency'|_ }}</a>
                                            {% endif %}
                                            {% if not currency.enabled %}
                                                <a class="btn btn-default"
                                                   href="{{ route('currencies.enable',currency.id) }}">
                                                    <span class="fa fa-fw fa-check-square-o"></span>
                                                    {{ 'enable_currency'|_ }}</a>
                                            {% endif %}
{% block scripts %}
    <script type="text/javascript" nonce="{{ JS_NONCE }}">
        var makeDefaultUrl = "{{ route('currencies.default') }}";
    </script>
    <script type="text/javascript" src="v1/js/ff/currencies/index.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
{% endblock %}
        Route::post('default', ['uses' => 'CurrencyController@defaultCurrency', 'as' => 'default']);