CVE-2023-49076 (published 2023-11-30T06:15Z)

Customer-data-framework allows management of customer data within Pimcore. There are no tokens or headers to prevent CSRF attacks from occurring, therefore an attacker could abuse this vulnerability to create new customers. This issue has been patched in version 4.0.5.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/pimcore/customer-data-framework
commit_details: repo_url: https://github.com/pimcore/customer-data-framework
author: jiajia
author_date: 2023-11-02 11:59:48+01:00
msg: fix add customer to post and csrf
repository: repo_url: https://github.com/pimcore/customer-data-framework
repo_name: pimcore/customer-data-framework
description: Customer Data Framework community bundle adds capability for management of customer data to Pimcore.
repo_language: PHP
owner: pimcore
file_changes: filename: functions.js
change_type: ModificationType.MODIFY
diff: @@ -98,7 +98,11 @@
                     return false;
                 }
                 $.ajax({
+                    method : 'POST',
                     url: '/admin/customermanagementframework/customers/new',
+                    headers: {
+                        'X-Pimcore-Csrf-Token': $newCustomerButton.data('token')
+                    },
                     success: function (data) {
                         var objectId = data.id;
                         if ('undefined' !== typeof window.top.pimcore) {

programming_language: JavaScript
filename: CustomersController.php
change_type: ModificationType.MODIFY
diff: @@ -305,7 +305,7 @@ class CustomersController extends Admin
     /**
      * Create new customer action
      *
-     * @Route("/new")
+     * @Route("/new", methods={"POST"})
      *
      * @throws ValidationException
      */

programming_language: PHP
filename: cmf.js
change_type: ModificationType.MODIFY
diff: @@ -803,7 +803,11 @@ app.SearchFilter.DateRangePicker = (function () {
                     return false;
                 }
                 $.ajax({
+                    method : 'POST',
                     url: '/admin/customermanagementframework/customers/new',
+                    headers: {
+                        'X-Pimcore-Csrf-Token': $newCustomerButton.data('token')
+                    },
                     success: function (data) {
                         var objectId = data.id;
                         if ('undefined' !== typeof window.top.pimcore) {

programming_language: JavaScript
filename: cmf.min.js
change_type: ModificationType.MODIFY
diff: @@ -1 +1 @@
-var _cfg=_config||{},cls={log:function(t){app.debug&&console.log(t)}},app={debug:_cfg.debug||!1,timeoutHandler:[],DEVICE:""};window.app=app||{},app.Util=function(){"use strict";return{getOrCreateInstance:function(t,e,n){return t.data(e)||t.data(e,n(t)),t.data(e)},featureDetect:function(){var t={},e={localStorage:function(){try{return localStorage.setItem("test","test"),localStorage.removeItem("test"),!0}catch(t){return!1}},json:function(){return"JSON"in window&&"parse"in JSON&&"stringify"in JSON}};return function(n){if(void 0===e[n])throw new Error("Test "+n+" is not defined");return void 0===t[n]&&(t[n]=e[n].call()),t[n]}}()}}(),app.Logger=function(){var t={forceLog:!1},e=function(){return!!window.console&&(!!t.forceLog||!!app.debug)};return t.canLog=e,$.each(["error","warn","info","debug","log"],function(n,i){t[i]=function(n){return function(){e()&&window.console[n].apply(t,Array.prototype.slice.call(arguments))}}(i)}),t}(),app.PimcoreLinks=function(){"use strict";return{initialize:function(t){var e=this;t.find(".js-pimcore-link").on("click",function(t){var n=$(this).data("pimcore-id");e.isPimcoreAvailable()?window.top.pimcore.helpers.openObject(n,"object"):app.Logger.error("Pimcore is not available (e.g. backend opened outside iframe) - can't load object with ID",n)})},isPimcoreAvailable:function(){return void 0!==window.top.pimcore}}}(),app.ToggleGroup={initialize:function(t){t.find("[data-toggle-group-trigger]").each(function(){var t=$(this),e=t.data("toggle-group-trigger"),n=t.closest(".js-toggle-group-container").find('[data-toggle-group="'+e+'"]');n.hide().removeClass("hide"),n.first().show(),t.on("click",function(t){t.preventDefault(),n.toggle()})})}},void 0===app.Box&&(app.Box={}),app.Box.CollapseHandler=function(){"use strict";return function(t){var e="collapsed-box",n=t.data("identifier"),i=t.find('[data-widget="collapse"]'),a=t.find('[data-widget="collapse"] i'),o=function(){if(!n)return!1;var t=!0;return $.each(["localStorage","json"],function(e,n){app.Util.featureDetect(n)||(t=!1)}),t}(),r=function(){var t=localStorage.getItem("collapseState");return t=null!==t?JSON.parse(t):{}},c=function(t){localStorage.setItem("collapseState",JSON.stringify(t))},s={isCollapsed:function(){return t.hasClass(e)},collapse:function(n){n?t.addClass(e):t.removeClass(e),s.updateCollapseIcon(n)},updateCollapseIcon:function(t){var e;e=t?"fa-plus":"fa-minus",a.attr("class","fa "+e)},handleState:function(){this.loadState()&&!this.isCollapsed()&&this.collapse(!0)},loadState:function(){if(o){var t=r(),e=!1;return void 0!==t[n]&&t[n]&&(e=!0),e}},saveState:function(t){if(t=!!t,o){var e=r();void 0===e[n]&&(e[n]={}),e[n]=t,c(e)}}};return o&&i.on("click",function(t){s.saveState(!s.isCollapsed()),s.updateCollapseIcon(!s.isCollapsed())}),t.find('[data-widget="collapse-trigger"]').on("click",function(t){t.preventDefault(),i.trigger("click")}),s.handleState(),s}}(),void 0===app.SearchFilter&&(app.SearchFilter={}),app.SearchFilter.Form=function(){"use strict";var t=function(t){this.$form=t,this.setupFormSubmitHandler(),this.setupDateRangePickers()};return t.prototype.setupFormSubmitHandler=function(){var t=this;this.$form.on("submit",function(e){t.prepareFormSubmit(),0===t.$form.serializeArray().length&&(e.preventDefault(),window.location=window.location.href.split("?")[0])})},t.prototype.setupDateRangePickers=function(){var t=this;this.dateRangePickers=[],this.$form.find(":input.plugin-daterangepicker").each(function(){var e=$(this);e.on("update.DateRangePicker",function(n,i){var a=e.attr("name").match(/^filter\[(.+)\]$/);null!==a?(a=a[1],$.each(["from","to"],function(e,n){var o="";i[n]&&(o=i[n].format("DD.MM.YYYY"));var r=a+n.charAt(0).toUpperCase()+n.slice(1);t.updateHiddenField("filter["+r+"]",o)})):app.Logger.error("Could not resolve base name for date range input",e.attr("name"))});var n=app.Util.getOrCreateInstance($(this),"SearchFilter.DateRangePicker",function(t){return new app.SearchFilter.DateRangePicker(t)});t.dateRangePickers.push(n)})},t.prototype.updateHiddenField=function(t,e){var n=this.$form.find(':input[type="hidden"][name="'+t+'"]');e=$.trim(e),0===n.length&&e.length>0&&(n=$("<input />").attr("type","hidden").attr("name",t)).appendTo(this.$form),1===n.length&&0===e.length?n.remove():n.val(e)},t.prototype.prepareFormSubmit=function(){this.$form.find(":input").each(function(){var t=$(this);!t.hasClass("form-submit-disabled")&&$.trim(t.val())||function(t){t.data("before-form-prepare-state",t.prop("disabled")),t.prop("disabled",!0)}(t)})},t.prototype.restoreFormFieldStates=function(){this.$form.find(":input").each(function(){var t=$(this),e=!!t.data("before-form-prepare-state");t.prop("disabled")&&t.prop("disabled",e)})},t}(),app.SearchFilter.DateRangePicker=function(){"use strict";var t=function(t){this.$input=t,t.addClass("form-submit-disabled"),this.initDateRangePicker()};return t.prototype.triggerUpdate=function(){var t=this.$input.data("daterangepicker");this.$input.trigger("update.DateRangePicker",{from:t.startDate,to:t.endDate})},t.prototype.initDateRangePicker=function(){var t=this.buildInitialDates(),e=this.buildRanges();this.$input.daterangepicker({autoUpdateInput:!0,autoApply:!0,alwaysShowCalendars:!0,showWeekNumbers:!0,startDate:t.startDate,endDate:t.endDate,locale:{format:"DD.MM.YYYY"},ranges:e}),this.$input.on("apply.daterangepicker",$.proxy(this.triggerUpdate,this)),this.triggerUpdate()},t.prototype.buildRanges=function(){var t={Today:[moment(),moment()],Yesterday:[moment().subtract(1,"days"),moment().subtract(1,"days")],"This Month":[moment().startOf("month"),moment().endOf("month")],"Last Month":[moment().subtract(1,"month").startOf("month"),moment().subtract(1,"month").endOf("month")]},e=this.$input.data("date-ranges");return e&&"object"==typeof e&&$.each(e,function(e,n){t[e]=[moment(n.startDate,"DD.MM.YYYY"),moment(n.endDate,"DD.MM.YYYY")]}),t},t.prototype.buildInitialDates=function(){var t;t=this.$input.data("date-from")?moment(this.$input.data("date-from"),"DD.MM.YYYY"):moment().startOf("month");var e;return e=this.$input.data("date-to")?moment(this.$input.data("date-to"),"DD.MM.YYYY"):t?t.clone().endOf("month"):moment().startOf("month"),{startDate:t,endDate:e}},t}(),function(t){"use strict";t.extend(window.app,{_init:function(t){matchMedia("(max-width:767px)").matches&&(app.DEVICE="mobile")},formAutoSubmit:function(e){e.find(".js-form-auto-submit").on("change",function(){t(this).closest("form").submit()})},select2:function(e){e.find(":input.plugin-select2").each(function(){var e=t(this),n="";e.data("placeholder")&&(n=e.data("placeholder"));var i=e.data("select2-options")||{};i=t.extend(!0,{},{width:"100%",allowClear:!0,placeholder:n},i),e.select2(i).focus(function(){t(this).select2("open")})})},iCheck:function(t){t.find(".plugin-icheck :input").iCheck({checkboxClass:"icheckbox_flat-blue",radioClass:"iradio_flat-blue"})},tooltip:function(t){t.find(".tooltip-trigger").tooltip()},searchFilter:function(e){e.find(".search-filters").each(function(){var e=t(this);app.Util.getOrCreateInstance(e,"SearchFilter.Form",function(t){return new app.SearchFilter.Form(t)})})},collapsibleStateBox:function(e){e.find(".box-collapsible-state").each(function(){var e=t(this);e.data("identifier")&&app.Util.getOrCreateInstance(e,"Box.CollapseHandler",function(t){return app.Box.CollapseHandler(t)})})},paginationFooterCount:function(e){e.find(".pagination-footer__count-selector-form").find("select").on("change",function(e){var n=t(this).find("option:selected");n.data("url")&&(window.location=n.data("url"))})},tableCollapse:function(e){e.find(".table-collapsible").each(function(){var e=t(this),n=e.find("caption");t('<span class="collapse-indicator" />').append('<span class="collapse-indicator-icon fa fa-chevron-down" />').prependTo(n),n.on("click",function(t){e.toggleClass("table-collapsible--collapsed")})})},urlSelect:function(e){e.find("select.url-select").on("change",function(e){e.preventDefault();var n=t(this).find("option:selected");1===n.length&&(window.location.href=n.data("url"))})},modal:function(e){e.on("hidden.bs.modal",".modal",function(){t(this).removeData("bs.modal")})},pimcoreLink:function(t){app.PimcoreLinks.initialize(t)},toggleGroup:function(t){app.ToggleGroup.initialize(t)}})}(jQuery),function(t){"use strict";t.extend(window.app,{declineDuplicates:function(e){0!==e.find(".js-decline-duplicate").length&&e.on("click",".js-decline-duplicate",function(){var e=t(this).closest(".js-duplicates-item");e.css("opacity",.5),t.ajax({url:"/admin/customermanagementframework/duplicates/decline/"+t(this).data("id"),success:function(t){t.success?e.remove():e.css("opacity",1)}})})},registerSaveFilterDefinition:function(){t("#save-filter-definition").on("click",function(e){e.preventDefault();var n=t('input[name="filterDefinition[name]"]'),i=t("#name-required-message");if(t(n).val().length<1)return n.focus(),i.slideDown(),void setTimeout(function(){i.slideUp()},3e3);i.hide();var a=t(this).closest("form"),o=a.attr("action"),r=a.find("select:disabled");r.each(function(){t(this).prop("disabled",!1)}),a.attr("action","/admin/customermanagementframework/customers/filter-definition/save").submit(),a.attr("action",o),r.each(function(){t(this).prop("disabled",!0)})})},registerUpdateFilterDefinition:function(){t("#update-filter-definition").on("click",function(e){e.preventDefault();var n=t('input[name="filterDefinition[name]"]'),i=t("#name-required-message");if(t(n).val().length<1)return n.focus(),i.slideDown(),void setTimeout(function(){i.slideUp()},3e3);i.hide();var a=t(this).closest("form"),o=a.attr("action"),r=a.find("select:disabled");r.each(function(){t(this).prop("disabled",!1)}),a.attr("action","/admin/customermanagementframework/customers/filter-definition/update").submit(),a.attr("action",o),r.each(function(){t(this).prop("disabled",!0)})})},registerShareFilterDefinition:function(){t("#share-filter-definition").on("click",function(e){e.preventDefault();var n=t(this).closest("form"),i=n.attr("action");n.attr("action","/admin/customermanagementframework/customers/filter-definition/share").submit(),n.attr("action",i)})},registerNewCustomerAction:function(){var e=t("#add-new-customer"),n=void 0!==window.top.pimcore;n||e.hide(),e.on("click",function(e){if(!n)return app.Logger.error("Pimcore is not available (e.g. backend opened outside iframe) - can't load object with ID",objectId),!1;t.ajax({url:"/admin/customermanagementframework/customers/new",success:function(t){var e=t.id;void 0!==window.top.pimcore?window.top.pimcore.helpers.openObject(e,"object"):app.Logger.error("Pimcore is not available (e.g. backend opened outside iframe) - can't load object with ID",e)}})})}})}(jQuery),function(t){"use strict";window.app.init=function(e){_cfg._preload&&t.each(_cfg._preload,function(t,n){"boolean"==typeof n&&"function"==typeof window.app[t]&&window.app[t](e)}),t.each(_cfg,function(t,n){"boolean"==typeof n&&"function"==typeof window.app[t]&&"_reload"!=t&&"_preload"!=t&&window.app[t](e)}),_cfg._reload&&t.each(_cfg._reload,function(t,n){"boolean"==typeof n&&"function"==typeof window.app[t]&&window.app[t](e)})},t(document).ready(function(){window.app.init(t("body"))})}(jQuery);
\ No newline at end of file
+var _cfg=_config||{},cls={log:function(t){app.debug&&console.log(t)}},app={debug:_cfg.debug||!1,timeoutHandler:[],DEVICE:""};window.app=app||{},app.Util=function(){"use strict";return{getOrCreateInstance:function(t,e,n){return t.data(e)||t.data(e,n(t)),t.data(e)},featureDetect:function(){var t={},e={localStorage:function(){try{return localStorage.setItem("test","test"),localStorage.removeItem("test"),!0}catch(t){return!1}},json:function(){return"JSON"in window&&"parse"in JSON&&"stringify"in JSON}};return function(n){if(void 0===e[n])throw new Error("Test "+n+" is not defined");return void 0===t[n]&&(t[n]=e[n].call()),t[n]}}()}}(),app.Logger=function(){var t={forceLog:!1},e=function(){return!!window.console&&(!!t.forceLog||!!app.debug)};return t.canLog=e,$.each(["error","warn","info","debug","log"],function(n,i){t[i]=function(n){return function(){e()&&window.console[n].apply(t,Array.prototype.slice.call(arguments))}}(i)}),t}(),app.PimcoreLinks=function(){"use strict";return{initialize:function(t){var e=this;t.find(".js-pimcore-link").on("click",function(t){var n=$(this).data("pimcore-id");e.isPimcoreAvailable()?window.top.pimcore.helpers.openObject(n,"object"):app.Logger.error("Pimcore is not available (e.g. backend opened outside iframe) - can't load object with ID",n)})},isPimcoreAvailable:function(){return void 0!==window.top.pimcore}}}(),app.ToggleGroup={initialize:function(t){t.find("[data-toggle-group-trigger]").each(function(){var t=$(this),e=t.data("toggle-group-trigger"),n=t.closest(".js-toggle-group-container").find('[data-toggle-group="'+e+'"]');n.hide().removeClass("hide"),n.first().show(),t.on("click",function(t){t.preventDefault(),n.toggle()})})}},void 0===app.Box&&(app.Box={}),app.Box.CollapseHandler=function(){"use strict";return function(t){var e="collapsed-box",n=t.data("identifier"),i=t.find('[data-widget="collapse"]'),a=t.find('[data-widget="collapse"] i'),o=function(){if(!n)return!1;var t=!0;return $.each(["localStorage","json"],function(e,n){app.Util.featureDetect(n)||(t=!1)}),t}(),r=function(){var t=localStorage.getItem("collapseState");return t=null!==t?JSON.parse(t):{}},c=function(t){localStorage.setItem("collapseState",JSON.stringify(t))},s={isCollapsed:function(){return t.hasClass(e)},collapse:function(n){n?t.addClass(e):t.removeClass(e),s.updateCollapseIcon(n)},updateCollapseIcon:function(t){var e;e=t?"fa-plus":"fa-minus",a.attr("class","fa "+e)},handleState:function(){this.loadState()&&!this.isCollapsed()&&this.collapse(!0)},loadState:function(){if(o){var t=r(),e=!1;return void 0!==t[n]&&t[n]&&(e=!0),e}},saveState:function(t){if(t=!!t,o){var e=r();void 0===e[n]&&(e[n]={}),e[n]=t,c(e)}}};return o&&i.on("click",function(t){s.saveState(!s.isCollapsed()),s.updateCollapseIcon(!s.isCollapsed())}),t.find('[data-widget="collapse-trigger"]').on("click",function(t){t.preventDefault(),i.trigger("click")}),s.handleState(),s}}(),void 0===app.SearchFilter&&(app.SearchFilter={}),app.SearchFilter.Form=function(){"use strict";var t=function(t){this.$form=t,this.setupFormSubmitHandler(),this.setupDateRangePickers()};return t.prototype.setupFormSubmitHandler=function(){var t=this;this.$form.on("submit",function(e){t.prepareFormSubmit(),0===t.$form.serializeArray().length&&(e.preventDefault(),window.location=window.location.href.split("?")[0])})},t.prototype.setupDateRangePickers=function(){var t=this;this.dateRangePickers=[],this.$form.find(":input.plugin-daterangepicker").each(function(){var e=$(this);e.on("update.DateRangePicker",function(n,i){var a=e.attr("name").match(/^filter\[(.+)\]$/);null!==a?(a=a[1],$.each(["from","to"],function(e,n){var o="";i[n]&&(o=i[n].format("DD.MM.YYYY"));var r=a+n.charAt(0).toUpperCase()+n.slice(1);t.updateHiddenField("filter["+r+"]",o)})):app.Logger.error("Could not resolve base name for date range input",e.attr("name"))});var n=app.Util.getOrCreateInstance($(this),"SearchFilter.DateRangePicker",function(t){return new app.SearchFilter.DateRangePicker(t)});t.dateRangePickers.push(n)})},t.prototype.updateHiddenField=function(t,e){var n=this.$form.find(':input[type="hidden"][name="'+t+'"]');e=$.trim(e),0===n.length&&e.length>0&&(n=$("<input />").attr("type","hidden").attr("name",t)).appendTo(this.$form),1===n.length&&0===e.length?n.remove():n.val(e)},t.prototype.prepareFormSubmit=function(){this.$form.find(":input").each(function(){var t=$(this);!t.hasClass("form-submit-disabled")&&$.trim(t.val())||function(t){t.data("before-form-prepare-state",t.prop("disabled")),t.prop("disabled",!0)}(t)})},t.prototype.restoreFormFieldStates=function(){this.$form.find(":input").each(function(){var t=$(this),e=!!t.data("before-form-prepare-state");t.prop("disabled")&&t.prop("disabled",e)})},t}(),app.SearchFilter.DateRangePicker=function(){"use strict";var t=function(t){this.$input=t,t.addClass("form-submit-disabled"),this.initDateRangePicker()};return t.prototype.triggerUpdate=function(){var t=this.$input.data("daterangepicker");this.$input.trigger("update.DateRangePicker",{from:t.startDate,to:t.endDate})},t.prototype.initDateRangePicker=function(){var t=this.buildInitialDates(),e=this.buildRanges();this.$input.daterangepicker({autoUpdateInput:!0,autoApply:!0,alwaysShowCalendars:!0,showWeekNumbers:!0,startDate:t.startDate,endDate:t.endDate,locale:{format:"DD.MM.YYYY"},ranges:e}),this.$input.on("apply.daterangepicker",$.proxy(this.triggerUpdate,this)),this.triggerUpdate()},t.prototype.buildRanges=function(){var t={Today:[moment(),moment()],Yesterday:[moment().subtract(1,"days"),moment().subtract(1,"days")],"This Month":[moment().startOf("month"),moment().endOf("month")],"Last Month":[moment().subtract(1,"month").startOf("month"),moment().subtract(1,"month").endOf("month")]},e=this.$input.data("date-ranges");return e&&"object"==typeof e&&$.each(e,function(e,n){t[e]=[moment(n.startDate,"DD.MM.YYYY"),moment(n.endDate,"DD.MM.YYYY")]}),t},t.prototype.buildInitialDates=function(){var t;t=this.$input.data("date-from")?moment(this.$input.data("date-from"),"DD.MM.YYYY"):moment().startOf("month");var e;return e=this.$input.data("date-to")?moment(this.$input.data("date-to"),"DD.MM.YYYY"):t?t.clone().endOf("month"):moment().startOf("month"),{startDate:t,endDate:e}},t}(),function(t){"use strict";t.extend(window.app,{_init:function(t){matchMedia("(max-width:767px)").matches&&(app.DEVICE="mobile")},formAutoSubmit:function(e){e.find(".js-form-auto-submit").on("change",function(){t(this).closest("form").submit()})},select2:function(e){e.find(":input.plugin-select2").each(function(){var e=t(this),n="";e.data("placeholder")&&(n=e.data("placeholder"));var i=e.data("select2-options")||{};i=t.extend(!0,{},{width:"100%",allowClear:!0,placeholder:n},i),e.select2(i).focus(function(){t(this).select2("open")})})},iCheck:function(t){t.find(".plugin-icheck :input").iCheck({checkboxClass:"icheckbox_flat-blue",radioClass:"iradio_flat-blue"})},tooltip:function(t){t.find(".tooltip-trigger").tooltip()},searchFilter:function(e){e.find(".search-filters").each(function(){var e=t(this);app.Util.getOrCreateInstance(e,"SearchFilter.Form",function(t){return new app.SearchFilter.Form(t)})})},collapsibleStateBox:function(e){e.find(".box-collapsible-state").each(function(){var e=t(this);e.data("identifier")&&app.Util.getOrCreateInstance(e,"Box.CollapseHandler",function(t){return app.Box.CollapseHandler(t)})})},paginationFooterCount:function(e){e.find(".pagination-footer__count-selector-form").find("select").on("change",function(e){var n=t(this).find("option:selected");n.data("url")&&(window.location=n.data("url"))})},tableCollapse:function(e){e.find(".table-collapsible").each(function(){var e=t(this),n=e.find("caption");t('<span class="collapse-indicator" />').append('<span class="collapse-indicator-icon fa fa-chevron-down" />').prependTo(n),n.on("click",function(t){e.toggleClass("table-collapsible--collapsed")})})},urlSelect:function(e){e.find("select.url-select").on("change",function(e){e.preventDefault();var n=t(this).find("option:selected");1===n.length&&(window.location.href=n.data("url"))})},modal:function(e){e.on("hidden.bs.modal",".modal",function(){t(this).removeData("bs.modal")})},pimcoreLink:function(t){app.PimcoreLinks.initialize(t)},toggleGroup:function(t){app.ToggleGroup.initialize(t)}})}(jQuery),function(t){"use strict";t.extend(window.app,{declineDuplicates:function(e){0!==e.find(".js-decline-duplicate").length&&e.on("click",".js-decline-duplicate",function(){var e=t(this).closest(".js-duplicates-item");e.css("opacity",.5),t.ajax({url:"/admin/customermanagementframework/duplicates/decline/"+t(this).data("id"),success:function(t){t.success?e.remove():e.css("opacity",1)}})})},registerSaveFilterDefinition:function(){t("#save-filter-definition").on("click",function(e){e.preventDefault();var n=t('input[name="filterDefinition[name]"]'),i=t("#name-required-message");if(t(n).val().length<1)return n.focus(),i.slideDown(),void setTimeout(function(){i.slideUp()},3e3);i.hide();var a=t(this).closest("form"),o=a.attr("action"),r=a.find("select:disabled");r.each(function(){t(this).prop("disabled",!1)}),a.attr("action","/admin/customermanagementframework/customers/filter-definition/save").submit(),a.attr("action",o),r.each(function(){t(this).prop("disabled",!0)})})},registerUpdateFilterDefinition:function(){t("#update-filter-definition").on("click",function(e){e.preventDefault();var n=t('input[name="filterDefinition[name]"]'),i=t("#name-required-message");if(t(n).val().length<1)return n.focus(),i.slideDown(),void setTimeout(function(){i.slideUp()},3e3);i.hide();var a=t(this).closest("form"),o=a.attr("action"),r=a.find("select:disabled");r.each(function(){t(this).prop("disabled",!1)}),a.attr("action","/admin/customermanagementframework/customers/filter-definition/update").submit(),a.attr("action",o),r.each(function(){t(this).prop("disabled",!0)})})},registerShareFilterDefinition:function(){t("#share-filter-definition").on("click",function(e){e.preventDefault();var n=t(this).closest("form"),i=n.attr("action");n.attr("action","/admin/customermanagementframework/customers/filter-definition/share").submit(),n.attr("action",i)})},registerNewCustomerAction:function(){var e=t("#add-new-customer"),n=void 0!==window.top.pimcore;n||e.hide(),e.on("click",function(e){if(!n)return app.Logger.error("Pimcore is not available (e.g. backend opened outside iframe) - can't load object with ID",objectId),!1;t.ajax({method:"POST",url:"/admin/customermanagementframework/customers/new",headers:{"X-Pimcore-Csrf-Token":t("#add-new-customer").data("token")},success:function(t){var e=t.id;void 0!==window.top.pimcore?window.top.pimcore.helpers.openObject(e,"object"):app.Logger.error("Pimcore is not available (e.g. backend opened outside iframe) - can't load object with ID",e)}})})}})}(jQuery),function(t){"use strict";window.app.init=function(e){_cfg._preload&&t.each(_cfg._preload,function(t,n){"boolean"==typeof n&&"function"==typeof window.app[t]&&window.app[t](e)}),t.each(_cfg,function(t,n){"boolean"==typeof n&&"function"==typeof window.app[t]&&"_reload"!=t&&"_preload"!=t&&window.app[t](e)}),_cfg._reload&&t.each(_cfg._reload,function(t,n){"boolean"==typeof n&&"function"==typeof window.app[t]&&window.app[t](e)})},t(document).ready(function(){window.app.init(t("body"))})}(jQuery);
\ No newline at end of file

programming_language: JavaScript
filename: header.html.twig
change_type: ModificationType.MODIFY
diff: @@ -18,7 +18,7 @@
         {% if not hideAdvancedFilterSettings %}
             <div class="col-sm-9 col-md-6 text-right">
                 {% if accessToTempCustomerFolder %}
-                    <button type="button" class="btn btn-primary" id="add-new-customer"
+                    <button data-token="{{ pimcore_csrf.getCsrfToken(app.request.session) }}" type="button" class="btn btn-primary" id="add-new-customer"
                             name="add-new-customer">{{ 'cmf_filters_new_customer'| trans({}, 'admin') }}</button>
                 {% endif %}
                 <!--suppress HtmlFormInputWithoutLabel -->

programming_language: HTML