CVE-2021-3729 (PHP, published 2021-08-23T13:15Z)
Description: value: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/firefly-iii/firefly-iii
Files changed:
app/Http/Controllers/CurrencyController.php
public/v1/js/ff/currencies/index.js
resources/views/v1/currencies/index.twig
routes/web.php
Commit message: Fix https://huntr.dev/bounties/d32f3d5a-0738-41ba-89de-34f2a772de76/


Vulnerable code:
    protected UserRepositoryInterface $userRepository;
                app('view')->share('title', (string) trans('firefly.currencies'));
            $request->session()->flash('error', (string) trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
        $subTitle     = (string) trans('firefly.create_currency');
    public function defaultCurrency(Request $request, TransactionCurrency $currency)
        app('preferences')->set('currencyPreference', $currency->code);
        app('preferences')->mark();

        Log::channel('audit')->info(sprintf('Make %s the default currency.', $currency->code));

        $this->repository->enable($currency);
        $request->session()->flash('success', (string) trans('firefly.new_default_currency', ['name' => $currency->name]));
            $request->session()->flash('error', (string) trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
            $message  = (string) trans(sprintf('firefly.cannot_disable_currency_%s', $location), ['name' => e($currency->name)]);
        $subTitle = (string) trans('form.delete_currency', ['name' => $currency->name]);
            $request->session()->flash('error', (string) trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
            $request->session()->flash('error', (string) trans('firefly.cannot_delete_currency', ['name' => e($currency->name)]));
            $request->session()->flash('error', (string) trans('firefly.cannot_delete_fallback_currency', ['name' => e($currency->name)]));
        $request->session()->flash('success', (string) trans('firefly.deleted_currency', ['name' => $currency->name]));
     * @throws FireflyException
            $request->session()->flash('error', (string) trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
            $message  = (string) trans(sprintf('firefly.cannot_disable_currency_%s', $location), ['name' => e($currency->name)]);
            session()->flash('warning', (string) trans('firefly.disable_EUR_side_effects'));
        session()->flash('success', (string) trans('firefly.currency_is_now_disabled', ['name' => $currency->name]));
            $request->session()->flash('error', (string) trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
        $subTitle         = (string) trans('breadcrumbs.edit_currency', ['name' => $currency->name]);
            'enabled' => $hasOldInput ? (bool) $request->old('enabled') : $currency->enabled,
        session()->flash('success', (string) trans('firefly.currency_is_now_enabled', ['name' => $currency->name]));
        $page       = 0 === (int) $request->get('page') ? 1 : (int) $request->get('page');
        $pageSize   = (int) app('preferences')->get('listPageSize', 50)->data;
            $request->session()->flash('info', (string) trans('firefly.ask_site_owner', ['owner' => config('firefly.site_owner')]));
            $request->session()->flash('error', (string) trans('firefly.could_not_store_currency'));
            $request->session()->flash('success', (string) trans('firefly.created_currency', ['name' => $currency->name]));
            if (1 === (int) $request->get('create_another')) {
            $request->session()->flash('error', (string) trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
        $request->session()->flash('success', (string) trans('firefly.updated_currency', ['name' => $currency->name]));
        if (1 === (int) $request->get('return_to_edit')) {
                        <a class="btn btn-success pull-right" href="{{ route('currencies.create') }}">{{ 'create_currency'|_ }}</a>
                                                <a class="btn btn-default" href="{{ route('currencies.edit',currency.id) }}"><span class="fa fa-fw fa-pencil"></span></a>
                                                <a class="btn btn-danger" href="{{ route('currencies.delete',currency.id) }}"><span class="fa fa-fw fa-trash"></span></a>
                                            <span class="text-muted">
                                        {{ currency.name }} ({{ currency.code }}) ({{ currency.symbol|raw }})
                                        <span class="label label-success" id="default-currency">{{ 'default_currency'|_ }}</span>
                                        {% if currency.enabled == false %}
                                        <br><small class="text-danger">{{ 'currency_is_disabled'|_ }}</small>
                                        {% if currency.id != defaultCurrency.id %}
                                            <a class="btn btn-default"
                                               href="{{ route('currencies.default',currency.id) }}">
                                                <span class="fa fa-fw fa-star"></span>
                                                {{ 'make_default_currency'|_ }}</a>
                                        {% endif %}
                                        {% if currency.enabled %}
                                            <a class="btn btn-default"
                                               href="{{ route('currencies.disable',currency.id) }}">
                                                <span class="fa fa-fw fa-square-o"></span>
                                                {{ 'disable_currency'|_ }}</a>
                                        {% endif %}
                                        {% if not currency.enabled %}
                                            <a class="btn btn-default"
                                               href="{{ route('currencies.enable',currency.id) }}">
                                                <span class="fa fa-fw fa-check-square-o"></span>
                                                {{ 'enable_currency'|_ }}</a>
                                        {% endif %}
        Route::get('default/{currency}', ['uses' => 'CurrencyController@defaultCurrency', 'as' => 'default']);

Fixed code:

    protected UserRepositoryInterface     $userRepository;
                app('view')->share('title', (string)trans('firefly.currencies'));

            $request->session()->flash('error', (string)trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
        $subTitle     = (string)trans('firefly.create_currency');
    public function defaultCurrency(Request $request)
        $currencyId = (int)$request->get('id');
        if ($currencyId > 0) {
            // valid currency?
            $currency = $this->repository->find($currencyId);
            if (null !== $currency) {
                app('preferences')->set('currencyPreference', $currency->code);
                app('preferences')->mark();
                Log::channel('audit')->info(sprintf('Make %s the default currency.', $currency->code));

                $this->repository->enable($currency);
                $request->session()->flash('success', (string)trans('firefly.new_default_currency', ['name' => $currency->name]));

                return redirect(route('currencies.index'));
            }
        }
            $request->session()->flash('error', (string)trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
            $message  = (string)trans(sprintf('firefly.cannot_disable_currency_%s', $location), ['name' => e($currency->name)]);
        $subTitle = (string)trans('form.delete_currency', ['name' => $currency->name]);
            $request->session()->flash('error', (string)trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
            $request->session()->flash('error', (string)trans('firefly.cannot_delete_currency', ['name' => e($currency->name)]));
            $request->session()->flash('error', (string)trans('firefly.cannot_delete_fallback_currency', ['name' => e($currency->name)]));
        $request->session()->flash('success', (string)trans('firefly.deleted_currency', ['name' => $currency->name]));
     * @throws FireflyException
            $request->session()->flash('error', (string)trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
            $message  = (string)trans(sprintf('firefly.cannot_disable_currency_%s', $location), ['name' => e($currency->name)]);
            session()->flash('warning', (string)trans('firefly.disable_EUR_side_effects'));
        session()->flash('success', (string)trans('firefly.currency_is_now_disabled', ['name' => $currency->name]));
            $request->session()->flash('error', (string)trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
        $subTitle         = (string)trans('breadcrumbs.edit_currency', ['name' => $currency->name]);
            'enabled' => $hasOldInput ? (bool)$request->old('enabled') : $currency->enabled,
        session()->flash('success', (string)trans('firefly.currency_is_now_enabled', ['name' => $currency->name]));
        $page       = 0 === (int)$request->get('page') ? 1 : (int)$request->get('page');
        $pageSize   = (int)app('preferences')->get('listPageSize', 50)->data;
            $request->session()->flash('info', (string)trans('firefly.ask_site_owner', ['owner' => config('firefly.site_owner')]));

            $request->session()->flash('error', (string)trans('firefly.could_not_store_currency'));
            $request->session()->flash('success', (string)trans('firefly.created_currency', ['name' => $currency->name]));
            if (1 === (int)$request->get('create_another')) {

            $request->session()->flash('error', (string)trans('firefly.ask_site_owner', ['owner' => e(config('firefly.site_owner'))]));
        $request->session()->flash('success', (string)trans('firefly.updated_currency', ['name' => $currency->name]));
        if (1 === (int)$request->get('return_to_edit')) {
/*
 * index.js
 * Copyright (c) 2019 james@firefly-iii.org
 *
 * This file is part of Firefly III (https://github.com/firefly-iii).
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as
 * published by the Free Software Foundation, either version 3 of the
 * License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Affero General Public License for more details.
 *
 * You should have received a copy of the GNU Affero General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */

/**
 *
 */
$(function () {
    "use strict";
    $('.make_default').on('click', setDefaultCurrency);

});

function setDefaultCurrency(e) {
    var button = $(e.currentTarget);
    var currencyId = parseInt(button.data('id'));

    $.post(makeDefaultUrl, {
        _token: token,
        id: currencyId
    }).done(function (data) {
        // lame but it works
        location.reload();
    }).fail(function () {
        console.error('I failed :(');
    });
}
                    <a class="btn btn-success pull-right" href="{{ route('currencies.create') }}">{{ 'create_currency'|_ }}</a>
                                                <a class="btn btn-default" href="{{ route('currencies.edit',currency.id) }}"><span
                                                            class="fa fa-fw fa-pencil"></span></a>
                                                <a class="btn btn-danger" href="{{ route('currencies.delete',currency.id) }}"><span
                                                            class="fa fa-fw fa-trash"></span></a>
                                        <span class="text-muted">
                                            {{ currency.name }} ({{ currency.code }}) ({{ currency.symbol|raw }})
                                            <span class="label label-success" id="default-currency">{{ 'default_currency'|_ }}</span>
                                            {% if currency.enabled == false %}
                                    <br><small class="text-danger">{{ 'currency_is_disabled'|_ }}</small>
                                            {% if currency.id != defaultCurrency.id %}
                                                <button data-id="{{ currency.id }}" class="make_default btn btn-default"><span
                                                            class="fa fa-fw fa-star"></span> {{ 'make_default_currency'|_ }}</button>
                                            {% endif %}
                                            {% if currency.enabled %}
                                                <a class="btn btn-default"
                                                   href="{{ route('currencies.disable',currency.id) }}">
                                                    <span class="fa fa-fw fa-square-o"></span>
                                                    {{ 'disable_currency'|_ }}</a>
                                            {% endif %}
                                            {% if not currency.enabled %}
                                                <a class="btn btn-default"
                                                   href="{{ route('currencies.enable',currency.id) }}">
                                                    <span class="fa fa-fw fa-check-square-o"></span>
                                                    {{ 'enable_currency'|_ }}</a>
                                            {% endif %}
{% block scripts %}
    <script type="text/javascript" nonce="{{ JS_NONCE }}">
        var makeDefaultUrl = "{{ route('currencies.default') }}";
    </script>
    <script type="text/javascript" src="v1/js/ff/currencies/index.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
{% endblock %}
        Route::post('default', ['uses' => 'CurrencyController@defaultCurrency', 'as' => 'default']);