Merge branch 'hotfix/5.5.12' into main

changelog.md

@@ -2,6 +2,14 @@
 All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](http://semver.org/).
 
+## 5.5.12 - 2021-06-03
+
+⚠️ On July 1st 2021 the Docker tag will change to `fireflyiii/core`. You can already start using the new tag.
+
+### Security
+
+- This version of Firefly III fixes a security vulnerability in the export routine. You are advised to upgrade as soon as possible. All credits to the excellent @oomb.
+
 ## 5.5.11 - 2021-05-08
 
 ⚠️ On July 1st 2021 the Docker tag will change to `fireflyiii/core`. You can already start using the new tag.

config/firefly.php

@@ -100,7 +100,7 @@ return [
         'handle_debts' => true,
     ],
 
-    'version'                      => '5.5.11',
+    'version'                      => '5.5.12',
     'api_version'                  => '1.5.2',
     'db_version'                   => 16,
     'maxUploadSize'                => 1073741824, // 1 GB

resources/views/v1/export/index.twig

@@ -15,9 +15,10 @@
                     <p>
                         {{ 'export_data_expl'|_ }}
                     </p>
-                    <ul>
+                    <form action="{{ route('export.export') }}" method="post">
-                        <li><i class="fa fa-fw fa-download"></i> <a href="{{ route('export.export') }}" title="{{ 'export_data_all_transactions'|_ }}">{{ 'export_data_all_transactions'|_ }}</a></li>
+                        <input type="hidden" name="_token" value="{{ csrf_token() }}"/>
-                    </ul>
+                        <button type="submit"><i class="fa fa-fw fa-download"></i> {{ 'export_data_all_transactions'|_ }}</button>
+                    </form>
                     <p>
                         {{ 'export_data_advanced_expl'|_ }}
                     </p>

routes/web.php

@@ -538,7 +538,7 @@ Route::group(
 
     // index
         Route::get('', ['uses' => 'Export\IndexController@index', 'as' => 'index']);
-        Route::get('export', ['uses' => 'Export\IndexController@export', 'as' => 'export']);
+        Route::post('export', ['uses' => 'Export\IndexController@export', 'as' => 'export']);
     }
 );
 /**