From 3e564e921988c7017435ab4edc905f72dfcb5fd4 Mon Sep 17 00:00:00 2001
From: Nicolas <nicolas@eoxia.com>
Date: Fri, 29 Apr 2022 10:05:26 +0200
Subject: [PATCH] [JS] add: signature action missing token

---
 core/tpl/digiriskdolibarr_signature_view.tpl.php |  1 +
 js/digiriskdolibarr.js.php                       | 11 +++++++----
 public/signature/add_signature.php               |  1 +
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/core/tpl/digiriskdolibarr_signature_view.tpl.php b/core/tpl/digiriskdolibarr_signature_view.tpl.php
index 600d2e1c9..19dde1a17 100644
--- a/core/tpl/digiriskdolibarr_signature_view.tpl.php
+++ b/core/tpl/digiriskdolibarr_signature_view.tpl.php
@@ -7,6 +7,7 @@
 <?php endif; ?>
 
 <div class="modal-signature" value="<?php echo $element->id ?>">
+	<input type="hidden" name="token" value="<?php echo newToken(); ?>">
 	<div class="wpeo-modal modal-signature" id="modal-signature<?php echo $element->id ?>">
 		<div class="modal-container wpeo-modal-event">
 			<!-- Modal-Header-->
diff --git a/js/digiriskdolibarr.js.php b/js/digiriskdolibarr.js.php
index 8b6ba8b61..95df25b6a 100644
--- a/js/digiriskdolibarr.js.php
+++ b/js/digiriskdolibarr.js.php
@@ -1023,13 +1023,15 @@
 		var signature = $(this).closest( '.wpeo-modal' ).find( 'canvas' )[0].toDataURL();
 	}
 
+	let token = $('.modal-signature').find('input[name="token"]').val();
+
 	var url = '';
 	var type = '';
 	if (elementZone == "private") {
-		url = document.URL + '&action=addSignature' + signatoryIDPost;
+		url = document.URL + '&action=addSignature' + signatoryIDPost + '&token=' + token;
 		type = "POST"
 	} else {
-		url = document.URL + '&action=addSignature' + signatoryIDPost;
+		url = document.URL + '&action=addSignature' + signatoryIDPost + '&token=' + token;
 		type = "POST";
 	}
 
@@ -1094,7 +1096,8 @@
  */
 window.eoxiaJS.signature.autoDownloadSpecimen = function( event ) {
 	let element = $(this).closest('.file-generation')
-	let url = document.URL + '&action=builddoc'
+	let token = $('.digirisk-signature-container').find('input[name="token"]').val();
+	let url = document.URL + '&action=builddoc&token=' + token
 	$.ajax({
 		url: url,
 		type: "POST",
@@ -1104,7 +1107,7 @@
 
 			window.eoxiaJS.signature.download(path + filename, filename);
 			$.ajax({
-				url: document.URL + '&action=remove_file',
+				url: document.URL + '&action=remove_file&token=' + token,
 				type: "POST",
 				success: function ( ) {
 				},
diff --git a/public/signature/add_signature.php b/public/signature/add_signature.php
index aa2acb9c6..d6c808b78 100644
--- a/public/signature/add_signature.php
+++ b/public/signature/add_signature.php
@@ -214,6 +214,7 @@
 }
 ?>
 <div class="digirisk-signature-container">
+	<input type="hidden" name="token" value="<?php echo newToken(); ?>">
 	<div class="wpeo-gridlayout grid-2">
 		<div class="informations">
 			<input type="hidden" id="confCAPTCHA" value="<?php echo $conf->global->DIGIRISKDOLIBARR_USE_CAPTCHA ?>"/>