From 2b85f8cd1a26d641c6ff68765bc810b1ed662b67 Mon Sep 17 00:00:00 2001
From: hufangzhou <hufangzhou@easycorp.ltd>
Date: Thu, 22 Sep 2022 09:41:53 +0800
Subject: [PATCH] * Use the php to operate cookie for safe.

---
 config/filter.php                     |  2 ++
 module/execution/control.php          |  4 ++++
 module/execution/view/kanban.html.php | 10 ++++------
 module/task/control.php               |  2 +-
 4 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/config/filter.php b/config/filter.php
index 39b722daec..d54e28622e 100755
--- a/config/filter.php
+++ b/config/filter.php
@@ -169,6 +169,7 @@ $filter->execution->export        = new stdclass();
 $filter->tree->browse             = new stdclass();
 $filter->productplan->browse      = new stdclass();
 $filter->kanban->space            = new stdclass();
+$filter->execution->kanban        = new stdclass();
 
 $filter->index->index->get['open'] = 'reg::base64';
 
@@ -300,6 +301,7 @@ $filter->execution->story->cookie['storyProductParam']   = 'int';
 $filter->execution->story->cookie['storyBranchParam']    = 'int';
 $filter->execution->story->cookie['executionStoryOrder'] = 'code';
 $filter->execution->export->cookie['checkedItem']        = 'reg::checked';
+$filter->execution->kanban->cookie['taskToOpen']         = 'int';
 
 $filter->testcase->browse->cookie['caseModule']     = 'int';
 $filter->testcase->browse->cookie['caseSuite']      = 'int';
diff --git a/module/execution/control.php b/module/execution/control.php
index ee320585e2..560ed521d5 100644
--- a/module/execution/control.php
+++ b/module/execution/control.php
@@ -2429,6 +2429,9 @@ class execution extends control
             foreach($plans as $plan) $allPlans += $plan;
         }
 
+        $taskToOpen = !empty($_COOKIE['taskToOpen']) ? $_COOKIE['taskToOpen'] : 0;
+        setcookie('taskToOpen', 0, time() - 3600, $this->config->webRoot, '', $this->config->cookieSecure, true);
+
         $this->view->title            = $this->lang->kanban->view;
         $this->view->users            = $users;
         $this->view->regions          = $kanbanData;
@@ -2447,6 +2450,7 @@ class execution extends control
         $this->view->kanbanData       = $kanbanData;
         $this->view->executionActions = $executionActions;
         $this->view->kanban           = $this->lang->execution->kanban;
+        $this->view->taskToOpen       = $taskToOpen;
         $this->display();
     }
 
diff --git a/module/execution/view/kanban.html.php b/module/execution/view/kanban.html.php
index 0867c2aeb0..ec60e53c33 100644
--- a/module/execution/view/kanban.html.php
+++ b/module/execution/view/kanban.html.php
@@ -304,23 +304,21 @@ js::set('priv',
     </div>
   </div>
 </div>
+<?php js::set('taskToOpen', $taskToOpen);?>
 <script>
 $(function() {
     /* Open the task details popup from dynamic. */
-    var taskID = $.cookie('taskID');
-    if(taskID)
+    if(taskToOpen)
     {
-        $.cookie('taskID', null, { path: '/'});
-
         var kanban = document.querySelector('#kanban');
         var observer = new MutationObserver(function (mutationsList, observer)
         {
             for(var mutation of mutationsList)
             {
                 var target = mutation.target;
-                if (mutation.type == 'childList' && target.tagName.toLowerCase() == 'a' && target.classList.contains('title') && target.parentElement.parentElement.dataset.id == taskID  && target.parentElement.className.includes('kanban-item-task'))
+                if (mutation.type == 'childList' && target.tagName.toLowerCase() == 'a' && target.classList.contains('title') && target.parentElement.parentElement.dataset.id == taskToOpen  && target.parentElement.className.includes('kanban-item-task'))
                 {
-                    var a = document.querySelector('[data-id="' + taskID +'"] a.title');
+                    var a = document.querySelector('[data-id="' + taskToOpen +'"] a.title');
                     if (a)
                     {
                         observer.disconnect();
diff --git a/module/task/control.php b/module/task/control.php
index aa492230fe..2f077c93b0 100755
--- a/module/task/control.php
+++ b/module/task/control.php
@@ -943,7 +943,7 @@ class task extends control
         $execution = $this->execution->getById($task->execution);
         if(!isonlybody() and $execution->type == 'kanban')
         {
-            setcookie('taskID', $taskID, 0, $this->config->webRoot, '', false, false);
+            setcookie('taskToOpen', $taskID, 0, $this->config->webRoot, '', false, true);
             return print(js::locate($this->createLink('execution', 'kanban', "executionID=$execution->id")));
         }