All download endpoints -> POST

Signed-off-by: Walker Crouse <walkercrouse@hotmail.com>
SpongePowered · Feb 6, 2017 · 061dd20 · 061dd20
1 parent 0f7861d
commit 061dd20
Show file tree

Hide file tree

Showing 8 changed files with 50 additions and 33 deletions.
diff --git a/app/controllers/project/Versions.scala b/app/controllers/project/Versions.scala
@@ -374,9 +374,7 @@ class Versions @Inject()(stats: StatTracker,
       val dlType = downloadType.flatMap(i => DownloadTypes.values.find(_.id == i)).getOrElse(DownloadTypes.UploadedFile)
       implicit val project = request.project
       withVersion(target) { version =>
-        if (version.isReviewed)
-          Redirect(self.download(author, slug, target))
-        else if (origin.isDefined && !isValidRedirect(origin.get))
+        if (version.isReviewed || (origin.isDefined && !isValidRedirect(origin.get)))
           Redirect(ShowProject(author, slug))
         else {
           val userAgent = request.headers.get("User-Agent")
@@ -444,9 +442,7 @@ class Versions @Inject()(stats: StatTracker,
     val author = project.ownerName
     val slug = project.slug
     val target = version.name
-    if (version.isReviewed)
-      Redirect(self.download(author, slug, target))
-    else if (origin.isDefined && !isValidRedirect(origin.get))
+    if (version.isReviewed || (origin.isDefined && !isValidRedirect(origin.get)))
       Redirect(ShowProject(author, slug))
     else if (token.isEmpty && request.cookies.get(DownloadWarning.COOKIE).isEmpty)
       Redirect(CSRF(self.showDownloadConfirm(author, slug, target, origin, Some(downloadType.id))))

diff --git a/app/views/projects/versions/list.scala.html b/app/views/projects/versions/list.scala.html
@@ -7,6 +7,7 @@
 @import ore.OreConfig
 @import ore.permission.{EditChannels, EditVersions}
 @import util.StringUtils._
+@import views.html.helper.CSRF
 @(model: Project,
   channels: Seq[Channel],
   versions: Seq[Version],
@@ -78,10 +79,16 @@ <h2 class="versions-header">Versions</h2>
                                                     <div class="pull-right">
                                                         <span class="date">@prettifyDate(version.createdAt.get)</span>
                                                         <span class="date">@version.humanFileSize</span>
-                                                        <a href="@versionRoutes.download(
-                                                            model.ownerName, model.slug, version.versionString)">
+                                                        <a href="#" class="a-download"
+                                                           data-form="form-download-@version.id.get">
                                                             <i title="Download" class="fa fa-download"></i>
                                                         </a>
+                                                        <form action="@versionRoutes.download(
+                                                            model.ownerName, model.slug, version.versionString)"
+                                                              method="post" style="display: none;"
+                                                              id="form-download-@version.id.get">
+                                                            @CSRF.formField
+                                                        </form>
                                                     </div>
                                                 </td>
                                             </tr>

diff --git a/app/views/projects/versions/unsafeDownload.scala.html b/app/views/projects/versions/unsafeDownload.scala.html
@@ -4,6 +4,7 @@
 @import models.project.Version
 @import models.project.Project
 @import ore.project.io.DownloadTypes.DownloadType
+@import views.html.helper.CSRF
 @(project: Project,
   target: Version,
   origin: Option[String],
@@ -29,11 +30,14 @@ <h4 class="panel-title">
                            class="pull-left unsafe-dl-back">
                             <i class="fa fa-arrow-left"></i> @messages("project.back")
                         </a>
-                        <a href="@versionRoutes.downloadUnsafely(
-                            project.ownerName, project.slug, target.name, origin, Some(downloadType.id), None)"
-                           class="pull-right btn btn-primary">
+                        <button type="submit" form="form-download" class="pull-right btn btn-primary">
                             @messages("general.continue")
-                        </a>
+                        </button>
+                        <form action="@versionRoutes.downloadUnsafely(
+                            project.ownerName, project.slug, target.name, origin, Some(downloadType.id), None)"
+                              method="post" style="display: none;" id="form-download">
+                            @CSRF.formField
+                        </form>
                     </div>
                 </div>
             </div>

diff --git a/app/views/projects/versions/view.scala.html b/app/views/projects/versions/view.scala.html
@@ -108,11 +108,14 @@ <h1 class="pull-left">@version.versionString</h1>
                                 }
                             }
 
-                            <a class="btn btn-primary"
-                               href="@versionRoutes.download(
-                                   project.ownerName, project.slug, version.versionString)">
+                            <button type="submit" form="form-download" class="btn btn-primary">
                                 <i class="fa fa-download"></i> @messages("general.download")
-                            </a>
+                            </button>
+                            <form action="@versionRoutes.download(
+                                project.ownerName, project.slug, version.versionString)"
+                                  method="post" style="display: none;" id="form-download">
+                                @CSRF.formField
+                            </form>
 
                         </div>
                     </div>

diff --git a/app/views/projects/view.scala.html b/app/views/projects/view.scala.html
@@ -193,13 +193,14 @@ <h4 class="modal-title" id="label-flag">Flag project</h4>
                             }
 
                             <!-- Download button -->
-                            <a href="@versionRoutes.downloadRecommended(project.ownerName, project.slug)"
-                               title="@messages("project.download.recommend")"
-                               data-toggle="tooltip"
-                               data-placement="bottom"
-                               class="btn btn-primary">
+                            <button form="form-download" type="submit" title="@messages("project.download.recommend")"
+                                    data-toggle="tooltip" data-placement="bottom" class="btn btn-primary">
                                 <i class="fa fa-download"></i> @messages("general.download")
-                            </a>
+                            </button>
+                            <form action="@versionRoutes.downloadRecommended(project.ownerName, project.slug)"
+                                  method="post" style="display: none;" id="form-download">
+                                @CSRF.formField
+                            </form>
                         </div>
                     }
                 </div>

diff --git a/build.sbt b/build.sbt
@@ -1,6 +1,6 @@
 name := "ore"
 
-version := "1.2.1"
+version := "1.2.2"
 
 lazy val `ore` = (project in file(".")).enablePlugins(PlayScala)
 

diff --git a/conf/routes b/conf/routes
@@ -24,10 +24,10 @@ GET     /api/projects/:pluginId                                     @controllers
 GET     /api/projects/:pluginId/versions                            @controllers.ApiController.listVersions(version = "v1", pluginId, channels: Option[String], limit: Option[Int], offset: Option[Int])
 GET     /api/projects/:pluginId/versions/:name                      @controllers.ApiController.showVersion(version = "v1", pluginId, name)
 
-GET     /api/projects/:pluginId/versions/recommended/download       @controllers.project.Versions.downloadRecommendedJarById(pluginId)
-GET     /api/projects/:pluginId/versions/recommended/signature      @controllers.project.Versions.downloadRecommendedSignatureById(pluginId)
-GET     /api/projects/:pluginId/versions/:name/download             @controllers.project.Versions.downloadJarById(pluginId, name)
-GET     /api/projects/:pluginId/versions/:name/signature            @controllers.project.Versions.downloadSignatureById(pluginId, name)
+POST    /api/projects/:pluginId/versions/recommended/download       @controllers.project.Versions.downloadRecommendedJarById(pluginId)
+POST    /api/projects/:pluginId/versions/recommended/signature      @controllers.project.Versions.downloadRecommendedSignatureById(pluginId)
+POST    /api/projects/:pluginId/versions/:name/download             @controllers.project.Versions.downloadJarById(pluginId, name)
+POST    /api/projects/:pluginId/versions/:name/signature            @controllers.project.Versions.downloadSignatureById(pluginId, name)
 
 GET     /api/users                                                  @controllers.ApiController.listUsers(version = "v1", limit: Option[Int], offset: Option[Int])
 GET     /api/users/:user                                            @controllers.ApiController.showUser(version = "v1", user)
@@ -140,15 +140,15 @@ POST    /:author/:slug/versions/:version/approve                    @controllers
 POST    /:author/:slug/versions/:version/delete                     @controllers.project.Versions.delete(author, slug, version)
 
 GET     /:author/:slug/versions/:version/confirm                    @controllers.project.Versions.showDownloadConfirm(author, slug, version, origin: Option[String], downloadType: Option[Int])
-GET     /:author/:slug/versions/:version/unsafe                     @controllers.project.Versions.downloadUnsafely(author, slug, version, origin: Option[String], downloadType: Option[Int], token: Option[String])
+POST    /:author/:slug/versions/:version/unsafe                     @controllers.project.Versions.downloadUnsafely(author, slug, version, origin: Option[String], downloadType: Option[Int], token: Option[String])
 
-GET     /:author/:slug/versions/recommended/download                @controllers.project.Versions.downloadRecommended(author, slug)
-GET     /:author/:slug/versions/recommended/signature               @controllers.project.Versions.downloadRecommendedSignature(author, slug)
-GET     /:author/:slug/versions/:version/download                   @controllers.project.Versions.download(author, slug, version)
+POST    /:author/:slug/versions/recommended/download                @controllers.project.Versions.downloadRecommended(author, slug)
+POST    /:author/:slug/versions/recommended/signature               @controllers.project.Versions.downloadRecommendedSignature(author, slug)
+POST    /:author/:slug/versions/:version/download                   @controllers.project.Versions.download(author, slug, version)
 GET     /:author/:slug/versions/:version/signature                  @controllers.project.Versions.downloadSignature(author, slug, version)
 
-GET     /:author/:slug/versions/recommended/jar                     @controllers.project.Versions.downloadRecommendedJar(author, slug)
-GET     /:author/:slug/versions/:version/jar                        @controllers.project.Versions.downloadJar(author, slug, version)
+POST    /:author/:slug/versions/recommended/jar                     @controllers.project.Versions.downloadRecommendedJar(author, slug)
+POST    /:author/:slug/versions/:version/jar                        @controllers.project.Versions.downloadJar(author, slug, version)
 
 GET     /:author/:slug/versions/new                                 @controllers.project.Versions.showCreator(author, slug)
 POST    /:author/:slug/versions/new/upload                          @controllers.project.Versions.upload(author, slug)

diff --git a/public/javascripts/versionList.js b/public/javascripts/versionList.js
@@ -141,4 +141,10 @@ $(function() {
         if (e.target == this)
             window.location.href = $(this).find('td:first-child').find('a').prop('href');
     });
+
+    $('.a-download').click(function(e) {
+        e.preventDefault();
+        var form = $('#' + $(this).data('form'));
+        form.submit();
+    })
 });