CVE-2023-49076: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Customer-data-framework allows management of customer data within Pimcore. There are no tokens or headers to prevent CSRF attacks from occurring, therefore an attacker could abuse this vulnerability to create new customers. This issue has been patched in version 4.0.5.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 6.5
Published: 2023-11-30T06:15Z
Repository: https://github.com/pimcore/customer-data-framework
Language: JavaScript
Files changed: frontend/js/functions.js, src/Controller/Admin/CustomersController.php, src/Resources/public/admin/js/cmf.js, src/Resources/public/admin/js/cmf.min.js, src/Resources/views/admin/customers/partials/list_filter/box/header.html.twig
Commit date: 2023-11-03 12:18:07 +0100
Commit message: fix add customer to post and csrf

Diff: diff --git a/frontend/js/functions.js b/frontend/js/functions.js
index eb4b84fe1..04c3b018a 100644
--- a/frontend/js/functions.js
+++ b/frontend/js/functions.js
@@ -96,11 +96,15 @@
                         objectId
                     );
                     return false;
                 }
                 $.ajax({
+                    method : 'POST',
                     url: '/admin/customermanagementframework/customers/new',
+                    headers: {
+                        'X-Pimcore-Csrf-Token': $newCustomerButton.data('token')
+                    },
                     success: function (data) {
                         var objectId = data.id;
                         if ('undefined' !== typeof window.top.pimcore) {
                             window.top.pimcore.helpers.openObject(objectId, 'object');
                         } else {
diff --git a/src/Controller/Admin/CustomersController.php b/src/Controller/Admin/CustomersController.php
index 0a1e284e5..e093060f3 100644
--- a/src/Controller/Admin/CustomersController.php
+++ b/src/Controller/Admin/CustomersController.php
@@ -303,11 +303,11 @@ class CustomersController extends Admin
     }
 
     /**
      * Create new customer action
      *
-     * @Route("/new")
+     * @Route("/new", methods={"POST"})
      *
      * @throws ValidationException
      */
     public function createCustomerAction(CustomerProviderInterface $customerProvider): JsonResponse
     {
diff --git a/src/Resources/public/admin/js/cmf.js b/src/Resources/public/admin/js/cmf.js
index c36644909..9b541ab5e 100644
--- a/src/Resources/public/admin/js/cmf.js
+++ b/src/Resources/public/admin/js/cmf.js
@@ -801,11 +801,15 @@ app.SearchFilter.DateRangePicker = (function () {
                         objectId
                     );
                     return false;
                 }
                 $.ajax({
+                    method : 'POST',
                     url: '/admin/customermanagementframework/customers/new',
+                    headers: {
+                        'X-Pimcore-Csrf-Token': $newCustomerButton.data('token')
+                    },
                     success: function (data) {
                         var objectId = data.id;
                         if ('undefined' !== typeof window.top.pimcore) {
                             window.top.pimcore.helpers.openObject(objectId, 'object');
                         } else {
diff --git a/src/Resources/public/admin/js/cmf.min.js b/src/Resources/public/admin/js/cmf.min.js
index 15dba8990..4b2b701d7 100644
--- a/src/Resources/public/admin/js/cmf.min.js
+++ b/src/Resources/public/admin/js/cmf.min.js
@@ -1 +1 @@
-var _cfg=_config||{},cls={log:function(t){app.debug&&console.log(t)}},app={debug:_cfg.debug||!1,timeoutHandler:[],DEVICE:""};window.app=app||{},app.Util=function(){"use strict";return{getOrCreateInstance:function(t,e,n){return t.data(e)||t.data(e,n(t)),t.data(e)},featureDetect:function(){var t={},e={localStorage:function(){try{return localStorage.setItem("test","test"),localStorage.removeItem("test"),!0}catch(t){return!1}},json:function(){return"JSON"in window&&"parse"in JSON&&"stringify"in JSON}};return function(n){if(void 0===e[n])throw new Error("Test "+n+" is not defined");return void 0===t[n]&&(t[n]=e[n].call()),t[n]}}()}}(),app.Logger=function(){var t={forceLog:!1},e=function(){return!!window.console&&(!!t.forceLog||!!app.debug)};return t.canLog=e,$.each(["error","warn","info","debug","log"],function(n,i){t[i]=function(n){return function(){e()&&window.console[n].apply(t,Array.prototype.slice.call(arguments))}}(i)}),t}(),app.PimcoreLinks=function(){"use strict";return{initialize:function(t){var e=this;t.find(".js-pimcore-link").on("click",function(t){var n=$(this).data("pimcore-id");e.isPimcoreAvailable()?window.top.pimcore.helpers.openObject(n,"object"):app.Logger.error("Pimcore is not available (e.g. backend opened outside iframe) - can't load object with ID",n)})},isPimcoreAvailable:function(){return void 0!==window.top.pimcore}}}(),app.ToggleGroup={initialize:function(t){t.find("[data-toggle-group-trigger]").each(function(){var t=$(this),e=t.data("toggle-group-trigger"),n=t.closest(".js-toggle-group-container").find('[data-toggle-group="'+e+'"]');n.hide().removeClass("hide"),n.first().show(),t.on("click",function(t){t.preventDefault(),n.toggle()})})}},void 0===app.Box&&(app.Box={}),app.Box.CollapseHandler=function(){"use strict";return function(t){var e="collapsed-box",n=t.data("identifier"),i=t.find('[data-widget="collapse"]'),a=t.find('[data-widget="collapse"] i'),o=function(){if(!n)return!1;var t=!0;return $.each(["localStorage","json"],function(e,n){app.Util.featureDetect(n)||(t=!1)}),t}(),r=function(){var t=localStorage.getItem("collapseState");return t=null!==t?JSON.parse(t):{}},c=function(t){localStorage.setItem("collapseState",JSON.stringify(t))},s={isCollapsed:function(){return t.hasClass(e)},collapse:function(n){n?t.addClass(e):t.removeClass(e),s.updateCollapseIcon(n)},updateCollapseIcon:function(t){var e;e=t?"fa-plus":"fa-minus",a.attr("class","fa "+e)},handleState:function(){this.loadState()&&!this.isCollapsed()&&this.collapse(!0)},loadState:function(){if(o){var t=r(),e=!1;return void 0!==t[n]&&t[n]&&(e=!0),e}},saveState:function(t){if(t=!!t,o){var e=r();void 0===e[n]&&(e[n]={}),e[n]=t,c(e)}}};return o&&i.on("click",function(t){s.saveState(!s.isCollapsed()),s.updateCollapseIcon(!s.isCollapsed())}),t.find('[data-widget="collapse-trigger"]').on("click",function(t){t.preventDefault(),i.trigger("click")}),s.handleState(),s}}(),void 0===app.SearchFilter&&(app.SearchFilter={}),app.SearchFilter.Form=function(){"use strict";var t=function(t){this.$form=t,this.setupFormSubmitHandler(),this.setupDateRangePickers()};return t.prototype.setupFormSubmitHandler=function(){var t=this;this.$form.on("submit",function(e){t.prepareFormSubmit(),0===t.$form.serializeArray().length&&(e.preventDefault(),window.location=window.location.href.split("?")[0])})},t.prototype.setupDateRangePickers=function(){var t=this;this.dateRangePickers=[],this.$form.find(":input.plugin-daterangepicker").each(function(){var e=$(this);e.on("update.DateRangePicker",function(n,i){var a=e.attr("name").match(/^filter\[(.+)\]$/);null!==a?(a=a[1],$.each(["from","to"],function(e,n){var o="";i[n]&&(o=i[n].format("DD.MM.YYYY"));var r=a+n.charAt(0).toUpperCase()+n.slice(1);t.updateHiddenField("filter["+r+"]",o)})):app.Logger.error("Could not resolve base name for date range input",e.attr("name"))});var n=app.Util.getOrCreateInstance($(this),"SearchFilter.DateRangePicker",function(t){return new app.SearchFilter.DateRangePicker(t)});t.dateRangePickers.push(n)})},t.prototype.updateHiddenField=function(t,e){var n=this.$form.find(':input[type="hidden"][name="'+t+'"]');e=$.trim(e),0===n.length&&e.length>0&&(n=$("<input />").attr("type","hidden").attr("name",t)).appendTo(this.$form),1===n.length&&0===e.length?n.remove():n.val(e)},t.prototype.prepareFormSubmit=function(){this.$form.find(":input").each(function(){var t=$(this);!t.hasClass("form-submit-disabled")&&$.trim(t.val())||function(t){t.data("before-form-prepare-state",t.prop("disabled")),t.prop("disabled",!0)}(t)})},t.prototype.restoreFormFieldStates=function(){this.$form.find(":input").each(function(){var t=$(this),e=!!t.data("before-form-prepare-state");t.prop("disabled")&&t.prop("disabled",e)})},t}(),app.SearchFilter.DateRangePicker=function(){"use strict";var t=function(t){this.$input=t,t.addClass("form-submit-disabled"),this.initDateRangePicker()};return t.prototype.triggerUpdate=function(){var t=this.$input.data("daterangepicker");this.$input.trigger("update.DateRangePicker",{from:t.startDate,to:t.endDate})},t.prototype.initDateRangePicker=function(){var t=this.buildInitialDates(),e=this.buildRanges();this.$input.daterangepicker({autoUpdateInput:!0,autoApply:!0,alwaysShowCalendars:!0,showWeekNumbers:!0,startDate:t.startDate,endDate:t.endDate,locale:{format:"DD.MM.YYYY"},ranges:e}),this.$input.on("apply.daterangepicker",$.proxy(this.triggerUpdate,this)),this.triggerUpdate()},t.prototype.buildRanges=function(){var t={Today:[moment(),moment()],Yesterday:[moment().subtract(1,"days"),moment().subtract(1,"days")],"This Month":[moment().startOf("month"),moment().endOf("month")],"Last Month":[moment().subtract(1,"month").startOf("month"),moment().subtract(1,"month").endOf("month")]},e=this.$input.data("date-ranges");return e&&"object"==typeof e&&$.each(e,function(e,n){t[e]=[moment(n.startDate,"DD.MM.YYYY"),moment(n.endDate,"DD.MM.YYYY")]}),t},t.prototype.buildInitialDates=function(){var t;t=this.$input.data("date-from")?moment(this.$input.data("date-from"),"DD.MM.YYYY"):moment().startOf("month");var e;return e=this.$input.data("date-to")?moment(this.$input.data("date-to"),"DD.MM.YYYY"):t?t.clone().endOf("month"):moment().startOf("month"),{startDate:t,endDate:e}},t}(),function(t){"use strict";t.extend(window.app,{_init:function(t){matchMedia("(max-width:767px)").matches&&(app.DEVICE="mobile")},formAutoSubmit:function(e){e.find(".js-form-auto-submit").on("change",function(){t(this).closest("form").submit()})},select2:function(e){e.find(":input.plugin-select2").each(function(){var e=t(this),n="";e.data("placeholder")&&(n=e.data("placeholder"));var i=e.data("select2-options")||{};i=t.extend(!0,{},{width:"100%",allowClear:!0,placeholder:n},i),e.select2(i).focus(function(){t(this).select2("open")})})},iCheck:function(t){t.find(".plugin-icheck :input").iCheck({checkboxClass:"icheckbox_flat-blue",radioClass:"iradio_flat-blue"})},tooltip:function(t){t.find(".tooltip-trigger").tooltip()},searchFilter:function(e){e.find(".search-filters").each(function(){var e=t(this);app.Util.getOrCreateInstance(e,"SearchFilter.Form",function(t){return new app.SearchFilter.Form(t)})})},collapsibleStateBox:function(e){e.find(".box-collapsible-state").each(function(){var e=t(this);e.data("identifier")&&app.Util.getOrCreateInstance(e,"Box.CollapseHandler",function(t){return app.Box.CollapseHandler(t)})})},paginationFooterCount:function(e){e.find(".pagination-footer__count-selector-form").find("select").on("change",function(e){var n=t(this).find("option:selected");n.data("url")&&(window.location=n.data("url"))})},tableCollapse:function(e){e.find(".table-collapsible").each(function(){var e=t(this),n=e.find("caption");t('<span class="collapse-indicator" />').append('<span class="collapse-indicator-icon fa fa-chevron-down" />').prependTo(n),n.on("click",function(t){e.toggleClass("table-collapsible--collapsed")})})},urlSelect:function(e){e.find("select.url-select").on("change",function(e){e.preventDefault();var n=t(this).find("option:selected");1===n.length&&(window.location.href=n.data("url"))})},modal:function(e){e.on("hidden.bs.modal",".modal",function(){t(this).removeData("bs.modal")})},pimcoreLink:function(t){app.PimcoreLinks.initialize(t)},toggleGroup:function(t){app.ToggleGroup.initialize(t)}})}(jQuery),function(t){"use strict";t.extend(window.app,{declineDuplicates:function(e){0!==e.find(".js-decline-duplicate").length&&e.on("click",".js-decline-duplicate",function(){var e=t(this).closest(".js-duplicates-item");e.css("opacity",.5),t.ajax({url:"/admin/customermanagementframework/duplicates/decline/"+t(this).data("id"),success:function(t){t.success?e.remove():e.css("opacity",1)}})})},registerSaveFilterDefinition:function(){t("#save-filter-definition").on("click",function(e){e.preventDefault();var n=t('input[name="filterDefinition[name]"]'),i=t("#name-required-message");if(t(n).val().length<1)return n.focus(),i.slideDown(),void setTimeout(function(){i.slideUp()},3e3);i.hide();var a=t(this).closest("form"),o=a.attr("action"),r=a.find("select:disabled");r.each(function(){t(this).prop("disabled",!1)}),a.attr("action","/admin/customermanagementframework/customers/filter-definition/save").submit(),a.attr("action",o),r.each(function(){t(this).prop("disabled",!0)})})},registerUpdateFilterDefinition:function(){t("#update-filter-definition").on("click",function(e){e.preventDefault();var n=t('input[name="filterDefinition[name]"]'),i=t("#name-required-message");if(t(n).val().length<1)return n.focus(),i.slideDown(),void setTimeout(function(){i.slideUp()},3e3);i.hide();var a=t(this).closest("form"),o=a.attr("action"),r=a.find("select:disabled");r.each(function(){t(this).prop("disabled",!1)}),a.attr("action","/admin/customermanagementframework/customers/filter-definition/update").submit(),a.attr("action",o),r.each(function(){t(this).prop("disabled",!0)})})},registerShareFilterDefinition:function(){t("#share-filter-definition").on("click",function(e){e.preventDefault();var n=t(this).closest("form"),i=n.attr("action");n.attr("action","/admin/customermanagementframework/customers/filter-definition/share").submit(),n.attr("action",i)})},registerNewCustomerAction:function(){var e=t("#add-new-customer"),n=void 0!==window.top.pimcore;n||e.hide(),e.on("click",function(e){if(!n)return app.Logger.error("Pimcore is not available (e.g. backend opened outside iframe) - can't load object with ID",objectId),!1;t.ajax({url:"/admin/customermanagementframework/customers/new",success:function(t){var e=t.id;void 0!==window.top.pimcore?window.top.pimcore.helpers.openObject(e,"object"):app.Logger.error("Pimcore is not available (e.g. backend opened outside iframe) - can't load object with ID",e)}})})}})}(jQuery),function(t){"use strict";window.app.init=function(e){_cfg._preload&&t.each(_cfg._preload,function(t,n){"boolean"==typeof n&&"function"==typeof window.app[t]&&window.app[t](e)}),t.each(_cfg,function(t,n){"boolean"==typeof n&&"function"==typeof window.app[t]&&"_reload"!=t&&"_preload"!=t&&window.app[t](e)}),_cfg._reload&&t.each(_cfg._reload,function(t,n){"boolean"==typeof n&&"function"==typeof window.app[t]&&window.app[t](e)})},t(document).ready(function(){window.app.init(t("body"))})}(jQuery);
\ No newline at end of file
+var _cfg=_config||{},cls={log:function(t){app.debug&&console.log(t)}},app={debug:_cfg.debug||!1,timeoutHandler:[],DEVICE:""};window.app=app||{},app.Util=function(){"use strict";return{getOrCreateInstance:function(t,e,n){return t.data(e)||t.data(e,n(t)),t.data(e)},featureDetect:function(){var t={},e={localStorage:function(){try{return localStorage.setItem("test","test"),localStorage.removeItem("test"),!0}catch(t){return!1}},json:function(){return"JSON"in window&&"parse"in JSON&&"stringify"in JSON}};return function(n){if(void 0===e[n])throw new Error("Test "+n+" is not defined");return void 0===t[n]&&(t[n]=e[n].call()),t[n]}}()}}(),app.Logger=function(){var t={forceLog:!1},e=function(){return!!window.console&&(!!t.forceLog||!!app.debug)};return t.canLog=e,$.each(["error","warn","info","debug","log"],function(n,i){t[i]=function(n){return function(){e()&&window.console[n].apply(t,Array.prototype.slice.call(arguments))}}(i)}),t}(),app.PimcoreLinks=function(){"use strict";return{initialize:function(t){var e=this;t.find(".js-pimcore-link").on("click",function(t){var n=$(this).data("pimcore-id");e.isPimcoreAvailable()?window.top.pimcore.helpers.openObject(n,"object"):app.Logger.error("Pimcore is not available (e.g. backend opened outside iframe) - can't load object with ID",n)})},isPimcoreAvailable:function(){return void 0!==window.top.pimcore}}}(),app.ToggleGroup={initialize:function(t){t.find("[data-toggle-group-trigger]").each(function(){var t=$(this),e=t.data("toggle-group-trigger"),n=t.closest(".js-toggle-group-container").find('[data-toggle-group="'+e+'"]');n.hide().removeClass("hide"),n.first().show(),t.on("click",function(t){t.preventDefault(),n.toggle()})})}},void 0===app.Box&&(app.Box={}),app.Box.CollapseHandler=function(){"use strict";return function(t){var e="collapsed-box",n=t.data("identifier"),i=t.find('[data-widget="collapse"]'),a=t.find('[data-widget="collapse"] i'),o=function(){if(!n)return!1;var t=!0;return $.each(["localStorage","json"],function(e,n){app.Util.featureDetect(n)||(t=!1)}),t}(),r=function(){var t=localStorage.getItem("collapseState");return t=null!==t?JSON.parse(t):{}},c=function(t){localStorage.setItem("collapseState",JSON.stringify(t))},s={isCollapsed:function(){return t.hasClass(e)},collapse:function(n){n?t.addClass(e):t.removeClass(e),s.updateCollapseIcon(n)},updateCollapseIcon:function(t){var e;e=t?"fa-plus":"fa-minus",a.attr("class","fa "+e)},handleState:function(){this.loadState()&&!this.isCollapsed()&&this.collapse(!0)},loadState:function(){if(o){var t=r(),e=!1;return void 0!==t[n]&&t[n]&&(e=!0),e}},saveState:function(t){if(t=!!t,o){var e=r();void 0===e[n]&&(e[n]={}),e[n]=t,c(e)}}};return o&&i.on("click",function(t){s.saveState(!s.isCollapsed()),s.updateCollapseIcon(!s.isCollapsed())}),t.find('[data-widget="collapse-trigger"]').on("click",function(t){t.preventDefault(),i.trigger("click")}),s.handleState(),s}}(),void 0===app.SearchFilter&&(app.SearchFilter={}),app.SearchFilter.Form=function(){"use strict";var t=function(t){this.$form=t,this.setupFormSubmitHandler(),this.setupDateRangePickers()};return t.prototype.setupFormSubmitHandler=function(){var t=this;this.$form.on("submit",function(e){t.prepareFormSubmit(),0===t.$form.serializeArray().length&&(e.preventDefault(),window.location=window.location.href.split("?")[0])})},t.prototype.setupDateRangePickers=function(){var t=this;this.dateRangePickers=[],this.$form.find(":input.plugin-daterangepicker").each(function(){var e=$(this);e.on("update.DateRangePicker",function(n,i){var a=e.attr("name").match(/^filter\[(.+)\]$/);null!==a?(a=a[1],$.each(["from","to"],function(e,n){var o="";i[n]&&(o=i[n].format("DD.MM.YYYY"));var r=a+n.charAt(0).toUpperCase()+n.slice(1);t.updateHiddenField("filter["+r+"]",o)})):app.Logger.error("Could not resolve base name for date range input",e.attr("name"))});var n=app.Util.getOrCreateInstance($(this),"SearchFilter.DateRangePicker",function(t){return new app.SearchFilter.DateRangePicker(t)});t.dateRangePickers.push(n)})},t.prototype.updateHiddenField=function(t,e){var n=this.$form.find(':input[type="hidden"][name="'+t+'"]');e=$.trim(e),0===n.length&&e.length>0&&(n=$("<input />").attr("type","hidden").attr("name",t)).appendTo(this.$form),1===n.length&&0===e.length?n.remove():n.val(e)},t.prototype.prepareFormSubmit=function(){this.$form.find(":input").each(function(){var t=$(this);!t.hasClass("form-submit-disabled")&&$.trim(t.val())||function(t){t.data("before-form-prepare-state",t.prop("disabled")),t.prop("disabled",!0)}(t)})},t.prototype.restoreFormFieldStates=function(){this.$form.find(":input").each(function(){var t=$(this),e=!!t.data("before-form-prepare-state");t.prop("disabled")&&t.prop("disabled",e)})},t}(),app.SearchFilter.DateRangePicker=function(){"use strict";var t=function(t){this.$input=t,t.addClass("form-submit-disabled"),this.initDateRangePicker()};return t.prototype.triggerUpdate=function(){var t=this.$input.data("daterangepicker");this.$input.trigger("update.DateRangePicker",{from:t.startDate,to:t.endDate})},t.prototype.initDateRangePicker=function(){var t=this.buildInitialDates(),e=this.buildRanges();this.$input.daterangepicker({autoUpdateInput:!0,autoApply:!0,alwaysShowCalendars:!0,showWeekNumbers:!0,startDate:t.startDate,endDate:t.endDate,locale:{format:"DD.MM.YYYY"},ranges:e}),this.$input.on("apply.daterangepicker",$.proxy(this.triggerUpdate,this)),this.triggerUpdate()},t.prototype.buildRanges=function(){var t={Today:[moment(),moment()],Yesterday:[moment().subtract(1,"days"),moment().subtract(1,"days")],"This Month":[moment().startOf("month"),moment().endOf("month")],"Last Month":[moment().subtract(1,"month").startOf("month"),moment().subtract(1,"month").endOf("month")]},e=this.$input.data("date-ranges");return e&&"object"==typeof e&&$.each(e,function(e,n){t[e]=[moment(n.startDate,"DD.MM.YYYY"),moment(n.endDate,"DD.MM.YYYY")]}),t},t.prototype.buildInitialDates=function(){var t;t=this.$input.data("date-from")?moment(this.$input.data("date-from"),"DD.MM.YYYY"):moment().startOf("month");var e;return e=this.$input.data("date-to")?moment(this.$input.data("date-to"),"DD.MM.YYYY"):t?t.clone().endOf("month"):moment().startOf("month"),{startDate:t,endDate:e}},t}(),function(t){"use strict";t.extend(window.app,{_init:function(t){matchMedia("(max-width:767px)").matches&&(app.DEVICE="mobile")},formAutoSubmit:function(e){e.find(".js-form-auto-submit").on("change",function(){t(this).closest("form").submit()})},select2:function(e){e.find(":input.plugin-select2").each(function(){var e=t(this),n="";e.data("placeholder")&&(n=e.data("placeholder"));var i=e.data("select2-options")||{};i=t.extend(!0,{},{width:"100%",allowClear:!0,placeholder:n},i),e.select2(i).focus(function(){t(this).select2("open")})})},iCheck:function(t){t.find(".plugin-icheck :input").iCheck({checkboxClass:"icheckbox_flat-blue",radioClass:"iradio_flat-blue"})},tooltip:function(t){t.find(".tooltip-trigger").tooltip()},searchFilter:function(e){e.find(".search-filters").each(function(){var e=t(this);app.Util.getOrCreateInstance(e,"SearchFilter.Form",function(t){return new app.SearchFilter.Form(t)})})},collapsibleStateBox:function(e){e.find(".box-collapsible-state").each(function(){var e=t(this);e.data("identifier")&&app.Util.getOrCreateInstance(e,"Box.CollapseHandler",function(t){return app.Box.CollapseHandler(t)})})},paginationFooterCount:function(e){e.find(".pagination-footer__count-selector-form").find("select").on("change",function(e){var n=t(this).find("option:selected");n.data("url")&&(window.location=n.data("url"))})},tableCollapse:function(e){e.find(".table-collapsible").each(function(){var e=t(this),n=e.find("caption");t('<span class="collapse-indicator" />').append('<span class="collapse-indicator-icon fa fa-chevron-down" />').prependTo(n),n.on("click",function(t){e.toggleClass("table-collapsible--collapsed")})})},urlSelect:function(e){e.find("select.url-select").on("change",function(e){e.preventDefault();var n=t(this).find("option:selected");1===n.length&&(window.location.href=n.data("url"))})},modal:function(e){e.on("hidden.bs.modal",".modal",function(){t(this).removeData("bs.modal")})},pimcoreLink:function(t){app.PimcoreLinks.initialize(t)},toggleGroup:function(t){app.ToggleGroup.initialize(t)}})}(jQuery),function(t){"use strict";t.extend(window.app,{declineDuplicates:function(e){0!==e.find(".js-decline-duplicate").length&&e.on("click",".js-decline-duplicate",function(){var e=t(this).closest(".js-duplicates-item");e.css("opacity",.5),t.ajax({url:"/admin/customermanagementframework/duplicates/decline/"+t(this).data("id"),success:function(t){t.success?e.remove():e.css("opacity",1)}})})},registerSaveFilterDefinition:function(){t("#save-filter-definition").on("click",function(e){e.preventDefault();var n=t('input[name="filterDefinition[name]"]'),i=t("#name-required-message");if(t(n).val().length<1)return n.focus(),i.slideDown(),void setTimeout(function(){i.slideUp()},3e3);i.hide();var a=t(this).closest("form"),o=a.attr("action"),r=a.find("select:disabled");r.each(function(){t(this).prop("disabled",!1)}),a.attr("action","/admin/customermanagementframework/customers/filter-definition/save").submit(),a.attr("action",o),r.each(function(){t(this).prop("disabled",!0)})})},registerUpdateFilterDefinition:function(){t("#update-filter-definition").on("click",function(e){e.preventDefault();var n=t('input[name="filterDefinition[name]"]'),i=t("#name-required-message");if(t(n).val().length<1)return n.focus(),i.slideDown(),void setTimeout(function(){i.slideUp()},3e3);i.hide();var a=t(this).closest("form"),o=a.attr("action"),r=a.find("select:disabled");r.each(function(){t(this).prop("disabled",!1)}),a.attr("action","/admin/customermanagementframework/customers/filter-definition/update").submit(),a.attr("action",o),r.each(function(){t(this).prop("disabled",!0)})})},registerShareFilterDefinition:function(){t("#share-filter-definition").on("click",function(e){e.preventDefault();var n=t(this).closest("form"),i=n.attr("action");n.attr("action","/admin/customermanagementframework/customers/filter-definition/share").submit(),n.attr("action",i)})},registerNewCustomerAction:function(){var e=t("#add-new-customer"),n=void 0!==window.top.pimcore;n||e.hide(),e.on("click",function(e){if(!n)return app.Logger.error("Pimcore is not available (e.g. backend opened outside iframe) - can't load object with ID",objectId),!1;t.ajax({method:"POST",url:"/admin/customermanagementframework/customers/new",headers:{"X-Pimcore-Csrf-Token":t("#add-new-customer").data("token")},success:function(t){var e=t.id;void 0!==window.top.pimcore?window.top.pimcore.helpers.openObject(e,"object"):app.Logger.error("Pimcore is not available (e.g. backend opened outside iframe) - can't load object with ID",e)}})})}})}(jQuery),function(t){"use strict";window.app.init=function(e){_cfg._preload&&t.each(_cfg._preload,function(t,n){"boolean"==typeof n&&"function"==typeof window.app[t]&&window.app[t](e)}),t.each(_cfg,function(t,n){"boolean"==typeof n&&"function"==typeof window.app[t]&&"_reload"!=t&&"_preload"!=t&&window.app[t](e)}),_cfg._reload&&t.each(_cfg._reload,function(t,n){"boolean"==typeof n&&"function"==typeof window.app[t]&&window.app[t](e)})},t(document).ready(function(){window.app.init(t("body"))})}(jQuery);
\ No newline at end of file
diff --git a/src/Resources/views/admin/customers/partials/list_filter/box/header.html.twig b/src/Resources/views/admin/customers/partials/list_filter/box/header.html.twig
index a61e51e08..0ffeccb40 100644
--- a/src/Resources/views/admin/customers/partials/list_filter/box/header.html.twig
+++ b/src/Resources/views/admin/customers/partials/list_filter/box/header.html.twig
@@ -16,11 +16,11 @@
         </div>
 
         {% if not hideAdvancedFilterSettings %}
             <div class="col-sm-9 col-md-6 text-right">
                 {% if accessToTempCustomerFolder %}
-                    <button type="button" class="btn btn-primary" id="add-new-customer"
+                    <button data-token="{{ pimcore_csrf.getCsrfToken(app.request.session) }}" type="button" class="btn btn-primary" id="add-new-customer"
                             name="add-new-customer">{{ 'cmf_filters_new_customer'| trans({}, 'admin') }}</button>
                 {% endif %}
                 <!--suppress HtmlFormInputWithoutLabel -->
                 <select
                     id="filterDefinition-id"

Vulnerable code:      * @Route("/new")
var _cfg=_config||{},cls={log:function(t){app.debug&&console.log(t)}},app={debug:_cfg.debug||!1,timeoutHandler:[],DEVICE:""};window.app=app||{},app.Util=function(){"use strict";return{getOrCreateInstance:function(t,e,n){return t.data(e)||t.data(e,n(t)),t.data(e)},featureDetect:function(){var t={},e={localStorage:function(){try{return localStorage.setItem("test","test"),localStorage.removeItem("test"),!0}catch(t){return!1}},json:function(){return"JSON"in window&&"parse"in JSON&&"stringify"in JSON}};return function(n){if(void 0===e[n])throw new Error("Test "+n+" is not defined");return void 0===t[n]&&(t[n]=e[n].call()),t[n]}}()}}(),app.Logger=function(){var t={forceLog:!1},e=function(){return!!window.console&&(!!t.forceLog||!!app.debug)};return t.canLog=e,$.each(["error","warn","info","debug","log"],function(n,i){t[i]=function(n){return function(){e()&&window.console[n].apply(t,Array.prototype.slice.call(arguments))}}(i)}),t}(),app.PimcoreLinks=function(){"use strict";return{initialize:function(t){var e=this;t.find(".js-pimcore-link").on("click",function(t){var n=$(this).data("pimcore-id");e.isPimcoreAvailable()?window.top.pimcore.helpers.openObject(n,"object"):app.Logger.error("Pimcore is not available (e.g. backend opened outside iframe) - can't load object with ID",n)})},isPimcoreAvailable:function(){return void 0!==window.top.pimcore}}}(),app.ToggleGroup={initialize:function(t){t.find("[data-toggle-group-trigger]").each(function(){var t=$(this),e=t.data("toggle-group-trigger"),n=t.closest(".js-toggle-group-container").find('[data-toggle-group="'+e+'"]');n.hide().removeClass("hide"),n.first().show(),t.on("click",function(t){t.preventDefault(),n.toggle()})})}},void 0===app.Box&&(app.Box={}),app.Box.CollapseHandler=function(){"use strict";return function(t){var e="collapsed-box",n=t.data("identifier"),i=t.find('[data-widget="collapse"]'),a=t.find('[data-widget="collapse"] i'),o=function(){if(!n)return!1;var t=!0;return $.each(["localStorage","json"],function(e,n){app.Util.featureDetect(n)||(t=!1)}),t}(),r=function(){var t=localStorage.getItem("collapseState");return t=null!==t?JSON.parse(t):{}},c=function(t){localStorage.setItem("collapseState",JSON.stringify(t))},s={isCollapsed:function(){return t.hasClass(e)},collapse:function(n){n?t.addClass(e):t.removeClass(e),s.updateCollapseIcon(n)},updateCollapseIcon:function(t){var e;e=t?"fa-plus":"fa-minus",a.attr("class","fa "+e)},handleState:function(){this.loadState()&&!this.isCollapsed()&&this.collapse(!0)},loadState:function(){if(o){var t=r(),e=!1;return void 0!==t[n]&&t[n]&&(e=!0),e}},saveState:function(t){if(t=!!t,o){var e=r();void 0===e[n]&&(e[n]={}),e[n]=t,c(e)}}};return o&&i.on("click",function(t){s.saveState(!s.isCollapsed()),s.updateCollapseIcon(!s.isCollapsed())}),t.find('[data-widget="collapse-trigger"]').on("click",function(t){t.preventDefault(),i.trigger("click")}),s.handleState(),s}}(),void 0===app.SearchFilter&&(app.SearchFilter={}),app.SearchFilter.Form=function(){"use strict";var t=function(t){this.$form=t,this.setupFormSubmitHandler(),this.setupDateRangePickers()};return t.prototype.setupFormSubmitHandler=function(){var t=this;this.$form.on("submit",function(e){t.prepareFormSubmit(),0===t.$form.serializeArray().length&&(e.preventDefault(),window.location=window.location.href.split("?")[0])})},t.prototype.setupDateRangePickers=function(){var t=this;this.dateRangePickers=[],this.$form.find(":input.plugin-daterangepicker").each(function(){var e=$(this);e.on("update.DateRangePicker",function(n,i){var a=e.attr("name").match(/^filter\[(.+)\]$/);null!==a?(a=a[1],$.each(["from","to"],function(e,n){var o="";i[n]&&(o=i[n].format("DD.MM.YYYY"));var r=a+n.charAt(0).toUpperCase()+n.slice(1);t.updateHiddenField("filter["+r+"]",o)})):app.Logger.error("Could not resolve base name for date range input",e.attr("name"))});var n=app.Util.getOrCreateInstance($(this),"SearchFilter.DateRangePicker",function(t){return new app.SearchFilter.DateRangePicker(t)});t.dateRangePickers.push(n)})},t.prototype.updateHiddenField=function(t,e){var n=this.$form.find(':input[type="hidden"][name="'+t+'"]');e=$.trim(e),0===n.length&&e.length>0&&(n=$("<input />").attr("type","hidden").attr("name",t)).appendTo(this.$form),1===n.length&&0===e.length?n.remove():n.val(e)},t.prototype.prepareFormSubmit=function(){this.$form.find(":input").each(function(){var t=$(this);!t.hasClass("form-submit-disabled")&&$.trim(t.val())||function(t){t.data("before-form-prepare-state",t.prop("disabled")),t.prop("disabled",!0)}(t)})},t.prototype.restoreFormFieldStates=function(){this.$form.find(":input").each(function(){var t=$(this),e=!!t.data("before-form-prepare-state");t.prop("disabled")&&t.prop("disabled",e)})},t}(),app.SearchFilter.DateRangePicker=function(){"use strict";var t=function(t){this.$input=t,t.addClass("form-submit-disabled"),this.initDateRangePicker()};return t.prototype.triggerUpdate=function(){var t=this.$input.data("daterangepicker");this.$input.trigger("update.DateRangePicker",{from:t.startDate,to:t.endDate})},t.prototype.initDateRangePicker=function(){var t=this.buildInitialDates(),e=this.buildRanges();this.$input.daterangepicker({autoUpdateInput:!0,autoApply:!0,alwaysShowCalendars:!0,showWeekNumbers:!0,startDate:t.startDate,endDate:t.endDate,locale:{format:"DD.MM.YYYY"},ranges:e}),this.$input.on("apply.daterangepicker",$.proxy(this.triggerUpdate,this)),this.triggerUpdate()},t.prototype.buildRanges=function(){var t={Today:[moment(),moment()],Yesterday:[moment().subtract(1,"days"),moment().subtract(1,"days")],"This Month":[moment().startOf("month"),moment().endOf("month")],"Last Month":[moment().subtract(1,"month").startOf("month"),moment().subtract(1,"month").endOf("month")]},e=this.$input.data("date-ranges");return e&&"object"==typeof e&&$.each(e,function(e,n){t[e]=[moment(n.startDate,"DD.MM.YYYY"),moment(n.endDate,"DD.MM.YYYY")]}),t},t.prototype.buildInitialDates=function(){var t;t=this.$input.data("date-from")?moment(this.$input.data("date-from"),"DD.MM.YYYY"):moment().startOf("month");var e;return e=this.$input.data("date-to")?moment(this.$input.data("date-to"),"DD.MM.YYYY"):t?t.clone().endOf("month"):moment().startOf("month"),{startDate:t,endDate:e}},t}(),function(t){"use strict";t.extend(window.app,{_init:function(t){matchMedia("(max-width:767px)").matches&&(app.DEVICE="mobile")},formAutoSubmit:function(e){e.find(".js-form-auto-submit").on("change",function(){t(this).closest("form").submit()})},select2:function(e){e.find(":input.plugin-select2").each(function(){var e=t(this),n="";e.data("placeholder")&&(n=e.data("placeholder"));var i=e.data("select2-options")||{};i=t.extend(!0,{},{width:"100%",allowClear:!0,placeholder:n},i),e.select2(i).focus(function(){t(this).select2("open")})})},iCheck:function(t){t.find(".plugin-icheck :input").iCheck({checkboxClass:"icheckbox_flat-blue",radioClass:"iradio_flat-blue"})},tooltip:function(t){t.find(".tooltip-trigger").tooltip()},searchFilter:function(e){e.find(".search-filters").each(function(){var e=t(this);app.Util.getOrCreateInstance(e,"SearchFilter.Form",function(t){return new app.SearchFilter.Form(t)})})},collapsibleStateBox:function(e){e.find(".box-collapsible-state").each(function(){var e=t(this);e.data("identifier")&&app.Util.getOrCreateInstance(e,"Box.CollapseHandler",function(t){return app.Box.CollapseHandler(t)})})},paginationFooterCount:function(e){e.find(".pagination-footer__count-selector-form").find("select").on("change",function(e){var n=t(this).find("option:selected");n.data("url")&&(window.location=n.data("url"))})},tableCollapse:function(e){e.find(".table-collapsible").each(function(){var e=t(this),n=e.find("caption");t('<span class="collapse-indicator" />').append('<span class="collapse-indicator-icon fa fa-chevron-down" />').prependTo(n),n.on("click",function(t){e.toggleClass("table-collapsible--collapsed")})})},urlSelect:function(e){e.find("select.url-select").on("change",function(e){e.preventDefault();var n=t(this).find("option:selected");1===n.length&&(window.location.href=n.data("url"))})},modal:function(e){e.on("hidden.bs.modal",".modal",function(){t(this).removeData("bs.modal")})},pimcoreLink:function(t){app.PimcoreLinks.initialize(t)},toggleGroup:function(t){app.ToggleGroup.initialize(t)}})}(jQuery),function(t){"use strict";t.extend(window.app,{declineDuplicates:function(e){0!==e.find(".js-decline-duplicate").length&&e.on("click",".js-decline-duplicate",function(){var e=t(this).closest(".js-duplicates-item");e.css("opacity",.5),t.ajax({url:"/admin/customermanagementframework/duplicates/decline/"+t(this).data("id"),success:function(t){t.success?e.remove():e.css("opacity",1)}})})},registerSaveFilterDefinition:function(){t("#save-filter-definition").on("click",function(e){e.preventDefault();var n=t('input[name="filterDefinition[name]"]'),i=t("#name-required-message");if(t(n).val().length<1)return n.focus(),i.slideDown(),void setTimeout(function(){i.slideUp()},3e3);i.hide();var a=t(this).closest("form"),o=a.attr("action"),r=a.find("select:disabled");r.each(function(){t(this).prop("disabled",!1)}),a.attr("action","/admin/customermanagementframework/customers/filter-definition/save").submit(),a.attr("action",o),r.each(function(){t(this).prop("disabled",!0)})})},registerUpdateFilterDefinition:function(){t("#update-filter-definition").on("click",function(e){e.preventDefault();var n=t('input[name="filterDefinition[name]"]'),i=t("#name-required-message");if(t(n).val().length<1)return n.focus(),i.slideDown(),void setTimeout(function(){i.slideUp()},3e3);i.hide();var a=t(this).closest("form"),o=a.attr("action"),r=a.find("select:disabled");r.each(function(){t(this).prop("disabled",!1)}),a.attr("action","/admin/customermanagementframework/customers/filter-definition/update").submit(),a.attr("action",o),r.each(function(){t(this).prop("disabled",!0)})})},registerShareFilterDefinition:function(){t("#share-filter-definition").on("click",function(e){e.preventDefault();var n=t(this).closest("form"),i=n.attr("action");n.attr("action","/admin/customermanagementframework/customers/filter-definition/share").submit(),n.attr("action",i)})},registerNewCustomerAction:function(){var e=t("#add-new-customer"),n=void 0!==window.top.pimcore;n||e.hide(),e.on("click",function(e){if(!n)return app.Logger.error("Pimcore is not available (e.g. backend opened outside iframe) - can't load object with ID",objectId),!1;t.ajax({url:"/admin/customermanagementframework/customers/new",success:function(t){var e=t.id;void 0!==window.top.pimcore?window.top.pimcore.helpers.openObject(e,"object"):app.Logger.error("Pimcore is not available (e.g. backend opened outside iframe) - can't load object with ID",e)}})})}})}(jQuery),function(t){"use strict";window.app.init=function(e){_cfg._preload&&t.each(_cfg._preload,function(t,n){"boolean"==typeof n&&"function"==typeof window.app[t]&&window.app[t](e)}),t.each(_cfg,function(t,n){"boolean"==typeof n&&"function"==typeof window.app[t]&&"_reload"!=t&&"_preload"!=t&&window.app[t](e)}),_cfg._reload&&t.each(_cfg._reload,function(t,n){"boolean"==typeof n&&"function"==typeof window.app[t]&&window.app[t](e)})},t(document).ready(function(){window.app.init(t("body"))})}(jQuery);
                    <button type="button" class="btn btn-primary" id="add-new-customer"
Fixed code:                     method : 'POST',
                    headers: {
                        'X-Pimcore-Csrf-Token': $newCustomerButton.data('token')
                    },
     * @Route("/new", methods={"POST"})
                    method : 'POST',
                    headers: {
                        'X-Pimcore-Csrf-Token': $newCustomerButton.data('token')
                    },
var _cfg=_config||{},cls={log:function(t){app.debug&&console.log(t)}},app={debug:_cfg.debug||!1,timeoutHandler:[],DEVICE:""};window.app=app||{},app.Util=function(){"use strict";return{getOrCreateInstance:function(t,e,n){return t.data(e)||t.data(e,n(t)),t.data(e)},featureDetect:function(){var t={},e={localStorage:function(){try{return localStorage.setItem("test","test"),localStorage.removeItem("test"),!0}catch(t){return!1}},json:function(){return"JSON"in window&&"parse"in JSON&&"stringify"in JSON}};return function(n){if(void 0===e[n])throw new Error("Test "+n+" is not defined");return void 0===t[n]&&(t[n]=e[n].call()),t[n]}}()}}(),app.Logger=function(){var t={forceLog:!1},e=function(){return!!window.console&&(!!t.forceLog||!!app.debug)};return t.canLog=e,$.each(["error","warn","info","debug","log"],function(n,i){t[i]=function(n){return function(){e()&&window.console[n].apply(t,Array.prototype.slice.call(arguments))}}(i)}),t}(),app.PimcoreLinks=function(){"use strict";return{initialize:function(t){var e=this;t.find(".js-pimcore-link").on("click",function(t){var n=$(this).data("pimcore-id");e.isPimcoreAvailable()?window.top.pimcore.helpers.openObject(n,"object"):app.Logger.error("Pimcore is not available (e.g. backend opened outside iframe) - can't load object with ID",n)})},isPimcoreAvailable:function(){return void 0!==window.top.pimcore}}}(),app.ToggleGroup={initialize:function(t){t.find("[data-toggle-group-trigger]").each(function(){var t=$(this),e=t.data("toggle-group-trigger"),n=t.closest(".js-toggle-group-container").find('[data-toggle-group="'+e+'"]');n.hide().removeClass("hide"),n.first().show(),t.on("click",function(t){t.preventDefault(),n.toggle()})})}},void 0===app.Box&&(app.Box={}),app.Box.CollapseHandler=function(){"use strict";return function(t){var e="collapsed-box",n=t.data("identifier"),i=t.find('[data-widget="collapse"]'),a=t.find('[data-widget="collapse"] i'),o=function(){if(!n)return!1;var t=!0;return $.each(["localStorage","json"],function(e,n){app.Util.featureDetect(n)||(t=!1)}),t}(),r=function(){var t=localStorage.getItem("collapseState");return t=null!==t?JSON.parse(t):{}},c=function(t){localStorage.setItem("collapseState",JSON.stringify(t))},s={isCollapsed:function(){return t.hasClass(e)},collapse:function(n){n?t.addClass(e):t.removeClass(e),s.updateCollapseIcon(n)},updateCollapseIcon:function(t){var e;e=t?"fa-plus":"fa-minus",a.attr("class","fa "+e)},handleState:function(){this.loadState()&&!this.isCollapsed()&&this.collapse(!0)},loadState:function(){if(o){var t=r(),e=!1;return void 0!==t[n]&&t[n]&&(e=!0),e}},saveState:function(t){if(t=!!t,o){var e=r();void 0===e[n]&&(e[n]={}),e[n]=t,c(e)}}};return o&&i.on("click",function(t){s.saveState(!s.isCollapsed()),s.updateCollapseIcon(!s.isCollapsed())}),t.find('[data-widget="collapse-trigger"]').on("click",function(t){t.preventDefault(),i.trigger("click")}),s.handleState(),s}}(),void 0===app.SearchFilter&&(app.SearchFilter={}),app.SearchFilter.Form=function(){"use strict";var t=function(t){this.$form=t,this.setupFormSubmitHandler(),this.setupDateRangePickers()};return t.prototype.setupFormSubmitHandler=function(){var t=this;this.$form.on("submit",function(e){t.prepareFormSubmit(),0===t.$form.serializeArray().length&&(e.preventDefault(),window.location=window.location.href.split("?")[0])})},t.prototype.setupDateRangePickers=function(){var t=this;this.dateRangePickers=[],this.$form.find(":input.plugin-daterangepicker").each(function(){var e=$(this);e.on("update.DateRangePicker",function(n,i){var a=e.attr("name").match(/^filter\[(.+)\]$/);null!==a?(a=a[1],$.each(["from","to"],function(e,n){var o="";i[n]&&(o=i[n].format("DD.MM.YYYY"));var r=a+n.charAt(0).toUpperCase()+n.slice(1);t.updateHiddenField("filter["+r+"]",o)})):app.Logger.error("Could not resolve base name for date range input",e.attr("name"))});var n=app.Util.getOrCreateInstance($(this),"SearchFilter.DateRangePicker",function(t){return new app.SearchFilter.DateRangePicker(t)});t.dateRangePickers.push(n)})},t.prototype.updateHiddenField=function(t,e){var n=this.$form.find(':input[type="hidden"][name="'+t+'"]');e=$.trim(e),0===n.length&&e.length>0&&(n=$("<input />").attr("type","hidden").attr("name",t)).appendTo(this.$form),1===n.length&&0===e.length?n.remove():n.val(e)},t.prototype.prepareFormSubmit=function(){this.$form.find(":input").each(function(){var t=$(this);!t.hasClass("form-submit-disabled")&&$.trim(t.val())||function(t){t.data("before-form-prepare-state",t.prop("disabled")),t.prop("disabled",!0)}(t)})},t.prototype.restoreFormFieldStates=function(){this.$form.find(":input").each(function(){var t=$(this),e=!!t.data("before-form-prepare-state");t.prop("disabled")&&t.prop("disabled",e)})},t}(),app.SearchFilter.DateRangePicker=function(){"use strict";var t=function(t){this.$input=t,t.addClass("form-submit-disabled"),this.initDateRangePicker()};return t.prototype.triggerUpdate=function(){var t=this.$input.data("daterangepicker");this.$input.trigger("update.DateRangePicker",{from:t.startDate,to:t.endDate})},t.prototype.initDateRangePicker=function(){var t=this.buildInitialDates(),e=this.buildRanges();this.$input.daterangepicker({autoUpdateInput:!0,autoApply:!0,alwaysShowCalendars:!0,showWeekNumbers:!0,startDate:t.startDate,endDate:t.endDate,locale:{format:"DD.MM.YYYY"},ranges:e}),this.$input.on("apply.daterangepicker",$.proxy(this.triggerUpdate,this)),this.triggerUpdate()},t.prototype.buildRanges=function(){var t={Today:[moment(),moment()],Yesterday:[moment().subtract(1,"days"),moment().subtract(1,"days")],"This Month":[moment().startOf("month"),moment().endOf("month")],"Last Month":[moment().subtract(1,"month").startOf("month"),moment().subtract(1,"month").endOf("month")]},e=this.$input.data("date-ranges");return e&&"object"==typeof e&&$.each(e,function(e,n){t[e]=[moment(n.startDate,"DD.MM.YYYY"),moment(n.endDate,"DD.MM.YYYY")]}),t},t.prototype.buildInitialDates=function(){var t;t=this.$input.data("date-from")?moment(this.$input.data("date-from"),"DD.MM.YYYY"):moment().startOf("month");var e;return e=this.$input.data("date-to")?moment(this.$input.data("date-to"),"DD.MM.YYYY"):t?t.clone().endOf("month"):moment().startOf("month"),{startDate:t,endDate:e}},t}(),function(t){"use strict";t.extend(window.app,{_init:function(t){matchMedia("(max-width:767px)").matches&&(app.DEVICE="mobile")},formAutoSubmit:function(e){e.find(".js-form-auto-submit").on("change",function(){t(this).closest("form").submit()})},select2:function(e){e.find(":input.plugin-select2").each(function(){var e=t(this),n="";e.data("placeholder")&&(n=e.data("placeholder"));var i=e.data("select2-options")||{};i=t.extend(!0,{},{width:"100%",allowClear:!0,placeholder:n},i),e.select2(i).focus(function(){t(this).select2("open")})})},iCheck:function(t){t.find(".plugin-icheck :input").iCheck({checkboxClass:"icheckbox_flat-blue",radioClass:"iradio_flat-blue"})},tooltip:function(t){t.find(".tooltip-trigger").tooltip()},searchFilter:function(e){e.find(".search-filters").each(function(){var e=t(this);app.Util.getOrCreateInstance(e,"SearchFilter.Form",function(t){return new app.SearchFilter.Form(t)})})},collapsibleStateBox:function(e){e.find(".box-collapsible-state").each(function(){var e=t(this);e.data("identifier")&&app.Util.getOrCreateInstance(e,"Box.CollapseHandler",function(t){return app.Box.CollapseHandler(t)})})},paginationFooterCount:function(e){e.find(".pagination-footer__count-selector-form").find("select").on("change",function(e){var n=t(this).find("option:selected");n.data("url")&&(window.location=n.data("url"))})},tableCollapse:function(e){e.find(".table-collapsible").each(function(){var e=t(this),n=e.find("caption");t('<span class="collapse-indicator" />').append('<span class="collapse-indicator-icon fa fa-chevron-down" />').prependTo(n),n.on("click",function(t){e.toggleClass("table-collapsible--collapsed")})})},urlSelect:function(e){e.find("select.url-select").on("change",function(e){e.preventDefault();var n=t(this).find("option:selected");1===n.length&&(window.location.href=n.data("url"))})},modal:function(e){e.on("hidden.bs.modal",".modal",function(){t(this).removeData("bs.modal")})},pimcoreLink:function(t){app.PimcoreLinks.initialize(t)},toggleGroup:function(t){app.ToggleGroup.initialize(t)}})}(jQuery),function(t){"use strict";t.extend(window.app,{declineDuplicates:function(e){0!==e.find(".js-decline-duplicate").length&&e.on("click",".js-decline-duplicate",function(){var e=t(this).closest(".js-duplicates-item");e.css("opacity",.5),t.ajax({url:"/admin/customermanagementframework/duplicates/decline/"+t(this).data("id"),success:function(t){t.success?e.remove():e.css("opacity",1)}})})},registerSaveFilterDefinition:function(){t("#save-filter-definition").on("click",function(e){e.preventDefault();var n=t('input[name="filterDefinition[name]"]'),i=t("#name-required-message");if(t(n).val().length<1)return n.focus(),i.slideDown(),void setTimeout(function(){i.slideUp()},3e3);i.hide();var a=t(this).closest("form"),o=a.attr("action"),r=a.find("select:disabled");r.each(function(){t(this).prop("disabled",!1)}),a.attr("action","/admin/customermanagementframework/customers/filter-definition/save").submit(),a.attr("action",o),r.each(function(){t(this).prop("disabled",!0)})})},registerUpdateFilterDefinition:function(){t("#update-filter-definition").on("click",function(e){e.preventDefault();var n=t('input[name="filterDefinition[name]"]'),i=t("#name-required-message");if(t(n).val().length<1)return n.focus(),i.slideDown(),void setTimeout(function(){i.slideUp()},3e3);i.hide();var a=t(this).closest("form"),o=a.attr("action"),r=a.find("select:disabled");r.each(function(){t(this).prop("disabled",!1)}),a.attr("action","/admin/customermanagementframework/customers/filter-definition/update").submit(),a.attr("action",o),r.each(function(){t(this).prop("disabled",!0)})})},registerShareFilterDefinition:function(){t("#share-filter-definition").on("click",function(e){e.preventDefault();var n=t(this).closest("form"),i=n.attr("action");n.attr("action","/admin/customermanagementframework/customers/filter-definition/share").submit(),n.attr("action",i)})},registerNewCustomerAction:function(){var e=t("#add-new-customer"),n=void 0!==window.top.pimcore;n||e.hide(),e.on("click",function(e){if(!n)return app.Logger.error("Pimcore is not available (e.g. backend opened outside iframe) - can't load object with ID",objectId),!1;t.ajax({method:"POST",url:"/admin/customermanagementframework/customers/new",headers:{"X-Pimcore-Csrf-Token":t("#add-new-customer").data("token")},success:function(t){var e=t.id;void 0!==window.top.pimcore?window.top.pimcore.helpers.openObject(e,"object"):app.Logger.error("Pimcore is not available (e.g. backend opened outside iframe) - can't load object with ID",e)}})})}})}(jQuery),function(t){"use strict";window.app.init=function(e){_cfg._preload&&t.each(_cfg._preload,function(t,n){"boolean"==typeof n&&"function"==typeof window.app[t]&&window.app[t](e)}),t.each(_cfg,function(t,n){"boolean"==typeof n&&"function"==typeof window.app[t]&&"_reload"!=t&&"_preload"!=t&&window.app[t](e)}),_cfg._reload&&t.each(_cfg._reload,function(t,n){"boolean"==typeof n&&"function"==typeof window.app[t]&&window.app[t](e)})},t(document).ready(function(){window.app.init(t("body"))})}(jQuery);
                    <button data-token="{{ pimcore_csrf.getCsrfToken(app.request.session) }}" type="button" class="btn btn-primary" id="add-new-customer"