Add CSRF check for task and project files upload

3 files changed, 9 insertions, 0 deletions

diff --git a/app/Controller/BaseController.php b/app/Controller/BaseController.php
index 43ecfaab..1433ec14 100644
--- a/app/Controller/BaseController.php
+++ b/app/Controller/BaseController.php
@@ -26,6 +26,13 @@ abstract class BaseController extends Base
         }
     }
 
+    protected function checkReusableCSRFParam()
+    {
+        if (! $this->token->validateReusableCSRFToken($this->request->getRawValue('csrf_token'))) {
+            throw new AccessForbiddenException();
+        }
+    }
+
     /**
      * Check webhook token
      *
diff --git a/app/Controller/ProjectFileController.php b/app/Controller/ProjectFileController.php
index 83c7779f..a3e23f04 100644
--- a/app/Controller/ProjectFileController.php
+++ b/app/Controller/ProjectFileController.php
@@ -32,6 +32,7 @@ class ProjectFileController extends BaseController
      */
     public function save()
     {
+        $this->checkReusableCSRFParam();
         $project = $this->getProject();
         $result = $this->projectFileModel->uploadFiles($project['id'], $this->request->getFileInfo('files'));
 
diff --git a/app/Controller/TaskFileController.php b/app/Controller/TaskFileController.php
index ff0c299e..4c489238 100644
--- a/app/Controller/TaskFileController.php
+++ b/app/Controller/TaskFileController.php
@@ -51,6 +51,7 @@ class TaskFileController extends BaseController
      */
     public function save()
     {
+        $this->checkReusableCSRFParam();
         $task = $this->getTask();
         $result = $this->taskFileModel->uploadFiles($task['id'], $this->request->getFileInfo('files'));