mirror of
https://github.com/MarijnDoeve/TijdVoorDeTest.git
synced 2026-07-14 05:45:18 +02:00
Marijn
b290620cf9
* Declare ext-intl and ext-zip as explicit composer requirements DataExportService uses ZipArchive directly and the Dutch-locale format_datetime Twig filter needs real ext-intl (the polyfill only supports en), but composer.json only declared ext-ctype/ext-iconv. Adding them lets `composer check-platform-reqs` catch a missing extension before a runtime crash. * Add authorization checks to PrepareEliminationController index and viewElimination had no IsGranted guard, unlike every other backoffice/elimination controller, so any authenticated user could prepare or overwrite another season's elimination screens. * Prevent formula injection in spreadsheet exports Answer/candidate text starting with =, +, -, or @ was written to XLSX exports as a live formula rather than plain text. Since seasons can have multiple owners, a co-owner could plant a formula that runs (and can exfiltrate data) when another owner opens the export in Excel. * Add rate limiting to login and season-code entry points Neither /login nor the public season-code guess form (POST /) had any throttling, making both an unlimited brute-force/enumeration oracle. Adds symfony/rate-limiter and enables login_throttling on the main firewall, plus a dedicated per-IP rate limiter on the season-code form. * Add unique constraint to prevent double-submit score inflation A candidate could submit two concurrent POSTs for the same question before either committed, since GivenAnswer had no unique constraint and the "next question" check was subject to a TOCTOU race — each insert was then counted as a correct answer. * Address CodeRabbit review findings Include a Retry-After header on the season-code rate limit, correct stale line references in the security audit doc, and fix a stray comma in the reset-password email.
71 lines
2.6 KiB
PHP
71 lines
2.6 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace Tvdt\Controller\Backoffice;
|
|
|
|
use Doctrine\ORM\EntityManagerInterface;
|
|
use Symfony\Component\HttpFoundation\RedirectResponse;
|
|
use Symfony\Component\HttpFoundation\Request;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
use Symfony\Component\Routing\Attribute\Route;
|
|
use Symfony\Component\Routing\Requirement\Requirement;
|
|
use Symfony\Component\Security\Http\Attribute\IsCsrfTokenValid;
|
|
use Symfony\Component\Security\Http\Attribute\IsGranted;
|
|
use Tvdt\Controller\AbstractController;
|
|
use Tvdt\Entity\Elimination;
|
|
use Tvdt\Entity\Quiz;
|
|
use Tvdt\Entity\Season;
|
|
use Tvdt\Enum\FlashType;
|
|
use Tvdt\Factory\EliminationFactory;
|
|
use Tvdt\Security\Voter\SeasonVoter;
|
|
|
|
final class PrepareEliminationController extends AbstractController
|
|
{
|
|
public function __construct(private readonly EliminationFactory $eliminationFactory, private readonly EntityManagerInterface $em) {}
|
|
|
|
#[IsCsrfTokenValid('prepare_elimination')]
|
|
#[IsGranted(SeasonVoter::ELIMINATION, 'quiz')]
|
|
#[Route(
|
|
'/backoffice/season/{seasonCode:season}/quiz/{quiz}/elimination/prepare',
|
|
name: 'tvdt_prepare_elimination',
|
|
requirements: ['seasonCode' => self::SEASON_CODE_REGEX, 'quiz' => Requirement::UUID],
|
|
methods: ['POST'],
|
|
)]
|
|
public function index(Season $season, Quiz $quiz): RedirectResponse
|
|
{
|
|
$elimination = $this->eliminationFactory->createEliminationFromQuiz($quiz);
|
|
|
|
return $this->redirectToRoute('tvdt_prepare_elimination_view', ['elimination' => $elimination->id]);
|
|
}
|
|
|
|
#[IsCsrfTokenValid('prepare_elimination', methods: ['POST'])]
|
|
#[IsGranted(SeasonVoter::ELIMINATION, 'elimination')]
|
|
#[Route(
|
|
'/backoffice/elimination/{elimination}',
|
|
name: 'tvdt_prepare_elimination_view',
|
|
requirements: ['elimination' => Requirement::UUID],
|
|
methods: ['GET', 'POST'],
|
|
)]
|
|
public function viewElimination(Elimination $elimination, Request $request): Response
|
|
{
|
|
if ($request->isMethod('POST')) {
|
|
$elimination->updateFromInputBag($request->request);
|
|
$this->em->flush();
|
|
|
|
if ($request->request->getBoolean('start')) {
|
|
return $this->redirectToRoute('tvdt_elimination', ['elimination' => $elimination->id]);
|
|
}
|
|
|
|
$this->addFlash(FlashType::Success, 'Elimination updated');
|
|
|
|
return $this->redirectToRoute('tvdt_prepare_elimination_view', ['elimination' => $elimination->id]);
|
|
}
|
|
|
|
return $this->render('backoffice/prepare_elimination/index.html.twig', [
|
|
'controller_name' => 'PrepareEliminationController',
|
|
'elimination' => $elimination,
|
|
]);
|
|
}
|
|
}
|