Merge pull request #24024 from opf/vulnerability/sc-269-csrf-through-admin-import-jira-2-run-new-via-http-method-import-jira-id-run-new

[SC-269] Backport #23993 to v17.6

Author: as-op

app/controllers/admin/import/jira/import_runs_controller.rb

@@ -51,7 +51,7 @@ class ImportRunsController < ApplicationController
 
     def show; end
 
-    def new
+    def create
       jira = Import::Jira.find(params[:jira_id])
       jira_import = Import::JiraImport.create!(author_id: current_user.id, jira_id: jira.id)
       redirect_to(admin_import_jira_run_path(jira_id: jira.id, id: jira_import.id))

app/views/admin/import/jira/instances/show.html.erb

@@ -60,7 +60,8 @@ See COPYRIGHT and LICENSE files for more details.
           scheme: :primary,
           tag: :a,
           size: :medium,
-          href: new_admin_import_jira_run_path(jira_id: @jira.id)
+          href: admin_import_jira_run_index_path(jira_id: @jira.id),
+          data: { turbo_method: :post }
         )
       ) do |button|
         button.with_leading_visual_icon(icon: :plus)

config/routes.rb

@@ -798,7 +798,7 @@
         member do
           delete :delete_token
         end
-        resources :run, controller: "/admin/import/jira/import_runs", module: :jiras do
+        resources :run, controller: "/admin/import/jira/import_runs", module: :jiras, except: [:new] do
           member do
             get :continue
             post :continue

spec/controllers/admin/import/jira/import_runs_controller_spec.rb

@@ -87,8 +87,8 @@ def transition_to_state(jira_import, target_state)
       expect(response).to have_http_status(:forbidden)
     end
 
-    it "returns forbidden for GET #new" do
-      get :new, params: { jira_id: jira.id }
+    it "returns forbidden for POST #create" do
+      post :create, params: { jira_id: jira.id }
       expect(response).to have_http_status(:forbidden)
     end
 
@@ -132,10 +132,10 @@ def transition_to_state(jira_import, target_state)
     end
   end
 
-  describe "GET #new" do
+  describe "POST #create" do
     it "creates a new jira import and redirects to show" do
       expect do
-        get :new, params: { jira_id: jira.id }
+        post :create, params: { jira_id: jira.id }
       end.to change(Import::JiraImport, :count).by(1)
 
       new_import = Import::JiraImport.last