Fix https://huntr.dev/bounties/d32f3d5a-0738-41ba-89de-34f2a772de76/

app/Http/Controllers/CurrencyController.php

@@ -21,6 +21,7 @@
 declare(strict_types=1);
 
 namespace FireflyIII\Http\Controllers;
+
 use FireflyIII\Exceptions\FireflyException;
 use FireflyIII\Http\Requests\CurrencyFormRequest;
 use FireflyIII\Models\TransactionCurrency;
@@ -63,6 +64,7 @@ class CurrencyController extends Controller
             }
         );
     }
+
     /**
      * Create a currency.
      *
@@ -102,11 +104,15 @@ class CurrencyController extends Controller
      *
      * @return RedirectResponse|Redirector
      */
-    public function defaultCurrency(Request $request, TransactionCurrency $currency)
+    public function defaultCurrency(Request $request)
     {
+        $currencyId = (int)$request->get('id');
+        if ($currencyId > 0) {
+            // valid currency?
+            $currency = $this->repository->find($currencyId);
+            if (null !== $currency) {
                 app('preferences')->set('currencyPreference', $currency->code);
                 app('preferences')->mark();
-
                 Log::channel('audit')->info(sprintf('Make %s the default currency.', $currency->code));
 
                 $this->repository->enable($currency);
@@ -114,6 +120,10 @@ class CurrencyController extends Controller
 
                 return redirect(route('currencies.index'));
             }
+        }
+
+        return redirect(route('currencies.index'));
+    }
 
     /**
      * Deletes a currency.
@@ -200,8 +210,8 @@ class CurrencyController extends Controller
      * @param Request             $request
      * @param TransactionCurrency $currency
      *
-     * @throws FireflyException
      * @return RedirectResponse|Redirector
+     * @throws FireflyException
      */
     public function disableCurrency(Request $request, TransactionCurrency $currency)
     {
@@ -340,6 +350,7 @@ class CurrencyController extends Controller
 
         return prefixView('currencies.index', compact('currencies', 'defaultCurrency', 'isOwner'));
     }
+
     /**
      * Store new currency.
      *
@@ -386,6 +397,7 @@ class CurrencyController extends Controller
 
         return $redirect;
     }
+
     /**
      * Updates a currency.
      *

public/v1/js/ff/currencies/index.js

@@ -0,0 +1,43 @@
+/*
+ * index.js
+ * Copyright (c) 2019 james@firefly-iii.org
+ *
+ * This file is part of Firefly III (https://github.com/firefly-iii).
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/**
+ *
+ */
+$(function () {
+    "use strict";
+    $('.make_default').on('click', setDefaultCurrency);
+
+});
+
+function setDefaultCurrency(e) {
+    var button = $(e.currentTarget);
+    var currencyId = parseInt(button.data('id'));
+
+    $.post(makeDefaultUrl, {
+        _token: token,
+        id: currencyId
+    }).done(function (data) {
+        // lame but it works
+        location.reload();
+    }).fail(function () {
+        console.error('I failed :(');
+    });
+}

resources/views/v1/currencies/index.twig

@@ -40,8 +40,10 @@
                                     {% if isOwner %}
                                         <td>
                                             <div class="btn-group btn-group-xs">
-                                                <a class="btn btn-default" href="{{ route('currencies.edit',currency.id) }}"><span class="fa fa-fw fa-pencil"></span></a>
+                                                <a class="btn btn-default" href="{{ route('currencies.edit',currency.id) }}"><span
-                                                <a class="btn btn-danger" href="{{ route('currencies.delete',currency.id) }}"><span class="fa fa-fw fa-trash"></span></a>
+                                                            class="fa fa-fw fa-pencil"></span></a>
+                                                <a class="btn btn-danger" href="{{ route('currencies.delete',currency.id) }}"><span
+                                                            class="fa fa-fw fa-trash"></span></a>
                                             </div>
                                         </td>
                                     {% endif %}
@@ -63,10 +65,8 @@
                                     <td class="buttons">
                                         <div class="btn-group">
                                             {% if currency.id != defaultCurrency.id %}
-                                            <a class="btn btn-default"
+                                                <button data-id="{{ currency.id }}" class="make_default btn btn-default"><span
-                                               href="{{ route('currencies.default',currency.id) }}">
+                                                            class="fa fa-fw fa-star"></span> {{ 'make_default_currency'|_ }}</button>
-                                                <span class="fa fa-fw fa-star"></span>
-                                                {{ 'make_default_currency'|_ }}</a>
                                             {% endif %}
                                             {% if currency.enabled %}
                                                 <a class="btn btn-default"
@@ -98,3 +98,9 @@
         </div>
     </div>
 {% endblock %}
+{% block scripts %}
+    <script type="text/javascript" nonce="{{ JS_NONCE }}">
+        var makeDefaultUrl = "{{ route('currencies.default') }}";
+    </script>
+    <script type="text/javascript" src="v1/js/ff/currencies/index.js?v={{ FF_VERSION }}" nonce="{{ JS_NONCE }}"></script>
+{% endblock %}

routes/web.php

@@ -330,7 +330,7 @@ Route::group(
         Route::get('create', ['uses' => 'CurrencyController@create', 'as' => 'create']);
         Route::get('edit/{currency}', ['uses' => 'CurrencyController@edit', 'as' => 'edit']);
         Route::get('delete/{currency}', ['uses' => 'CurrencyController@delete', 'as' => 'delete']);
-        Route::get('default/{currency}', ['uses' => 'CurrencyController@defaultCurrency', 'as' => 'default']);
+        Route::post('default', ['uses' => 'CurrencyController@defaultCurrency', 'as' => 'default']);
         Route::get('enable/{currency}', ['uses' => 'CurrencyController@enableCurrency', 'as' => 'enable']);
         Route::get('disable/{currency}', ['uses' => 'CurrencyController@disableCurrency', 'as' => 'disable']);