Fix hardcoded to adjust new version ResourceBundle

src/Sylius/Bundle/AdminBundle/Action/RemoveAvatarAction.php

@@ -29,6 +29,7 @@ final class RemoveAvatarAction
         private AvatarImageRepositoryInterface $avatarRepository,
         private RouterInterface $router,
         private ?CsrfTokenManagerInterface $csrfTokenManager,
+        private readonly string $csrfParameter = '_csrf_token',
     ) {
     }
 
@@ -37,7 +38,7 @@ final class RemoveAvatarAction
         $userId = $request->attributes->get('id', '');
 
         if ($this->csrfTokenManager && !$this->csrfTokenManager->isTokenValid(
-            new CsrfToken($userId, (string) $request->query->get('_csrf_token', '')),
+            new CsrfToken($userId, (string) $request->query->get($this->csrfParameter, '')),
         )) {
             throw new HttpException(Response::HTTP_FORBIDDEN, 'Invalid csrf token.');
         }

src/Sylius/Bundle/AdminBundle/Action/ResendOrderConfirmationEmailAction.php

@@ -35,6 +35,7 @@ final readonly class ResendOrderConfirmationEmailAction
         private ?CsrfTokenManagerInterface $csrfTokenManager,
         private RequestStack $requestStack,
         private RouterInterface $router,
+        private string $csrfParameter = '_csrf_token',
     ) {
     }
 
@@ -43,7 +44,7 @@ final readonly class ResendOrderConfirmationEmailAction
         $orderId = $request->attributes->get('id', '');
 
         if ($this->csrfTokenManager && !$this->csrfTokenManager->isTokenValid(
-            new CsrfToken($orderId, (string) $request->query->get('_csrf_token', '')),
+            new CsrfToken($orderId, (string) $request->query->get($this->csrfParameter, '')),
         )) {
             throw new HttpException(Response::HTTP_FORBIDDEN, 'Invalid csrf token.');
         }

src/Sylius/Bundle/AdminBundle/Action/ResendShipmentConfirmationEmailAction.php

@@ -33,6 +33,7 @@ final readonly class ResendShipmentConfirmationEmailAction
         private ResendShipmentConfirmationEmailDispatcherInterface $resendShipmentConfirmationDispatcher,
         private ?CsrfTokenManagerInterface $csrfTokenManager,
         private RequestStack $requestStack,
+        private string $csrfParameter = '_csrf_token',
     ) {
     }
 
@@ -41,7 +42,7 @@ final readonly class ResendShipmentConfirmationEmailAction
         $shipmentId = $request->attributes->get('id', '');
 
         if ($this->csrfTokenManager && !$this->csrfTokenManager->isTokenValid(
-            new CsrfToken($shipmentId, (string) $request->query->get('_csrf_token', '')),
+            new CsrfToken($shipmentId, (string) $request->query->get($this->csrfParameter, '')),
         )) {
             throw new HttpException(Response::HTTP_FORBIDDEN, 'Invalid csrf token.');
         }

src/Sylius/Bundle/AdminBundle/Resources/config/services/controller.php

@@ -62,6 +62,7 @@ return static function (ContainerConfigurator $container) {
             service('sylius.repository.avatar_image'),
             service('router'),
             service('security.csrf.token_manager')->nullOnInvalid(),
+            param('sylius.resource.csrf_parameter'),
         ])
     ;
 
@@ -73,6 +74,7 @@ return static function (ContainerConfigurator $container) {
             service('security.csrf.token_manager')->nullOnInvalid(),
             service('request_stack'),
             service('router'),
+            param('sylius.resource.csrf_parameter'),
         ])
     ;
 
@@ -83,6 +85,7 @@ return static function (ContainerConfigurator $container) {
             service('sylius.command_dispatcher.resend_shipment_confirmation_email'),
             service('security.csrf.token_manager')->nullOnInvalid(),
             service('request_stack'),
+            param('sylius.resource.csrf_parameter'),
         ])
     ;
 

src/Sylius/Bundle/AdminBundle/templates/admin_user/form/sections/personal_information/avatar.html.twig

@@ -18,7 +18,7 @@
         {{ form_widget(hookable_metadata.context.form.avatar) }}
         {% if admin_user.id is not null and admin_user.avatar is not null and admin_user.avatar.path is not empty %}
             <button
-                formaction="{{ path('sylius_admin_admin_user_remove_avatar', {'id': admin_user.id, '_csrf_token': sylius_csrf_protection_enabled() ? csrf_token(admin_user.id) : null}) }}"
+                formaction="{{ path('sylius_admin_admin_user_remove_avatar', {'id': admin_user.id, (sylius_resource_csrf_parameter()): sylius_csrf_protection_enabled() ? csrf_token(admin_user.id) : null}) }}"
                 type="submit"
                 class="btn btn-danger"
                 {{ sylius_test_html_attribute('delete-avatar-button') }}

src/Sylius/Bundle/AdminBundle/templates/customer/show/content/header/title_block/actions/delete.html.twig

@@ -5,7 +5,7 @@
     <form action="{{ path('sylius_admin_shop_user_delete', {'id': user.id, 'customerId': customer.id}) }}" method="POST">
         <input type="hidden" name="_method" value="DELETE" />
         {% if sylius_csrf_protection_enabled() %}
-            <input type="hidden" name="_csrf_token" value="{{ csrf_token(user.id) }}" />
+            <input type="hidden" name="{{ sylius_resource_csrf_parameter() }}" value="{{ csrf_token(user.id) }}" />
         {% endif %}
         <button type="submit" class="dropdown-item" {{ sylius_test_html_attribute('customer-actions-delete') }}>
             {{ ux_icon('tabler:trash-x', {'class': 'icon dropdown-item-icon'}) }}

src/Sylius/Bundle/AdminBundle/templates/order/show/content/header/title_block/actions/cancel.html.twig

@@ -6,7 +6,7 @@
     <form action="{{ path('sylius_admin_order_cancel', {'id': order.id}) }}" method="POST" novalidate>
         <input type="hidden" name="_method" value="PUT">
         {% if sylius_csrf_protection_enabled() %}
-            <input type="hidden" name="_csrf_token" value="{{ csrf_token(order.id) }}" />
+            <input type="hidden" name="{{ sylius_resource_csrf_parameter() }}" value="{{ csrf_token(order.id) }}" />
         {% endif %}
         <button type="submit" class="dropdown-item" {{ sylius_test_html_attribute('cancel-order') }}>
             {{ ux_icon('tabler:circle-check', {'class': 'icon dropdown-item-icon'}) }}

src/Sylius/Bundle/AdminBundle/templates/order/show/content/header/title_block/actions/list/cancel.html.twig

@@ -4,7 +4,7 @@
     <form action="{{ path('sylius_admin_order_cancel', {'id': order.id}) }}" method="POST" novalidate>
         <input type="hidden" name="_method" value="PUT">
         {% if sylius_csrf_protection_enabled() %}
-            <input type="hidden" name="_csrf_token" value="{{ csrf_token(order.id) }}" />
+            <input type="hidden" name="{{ sylius_resource_csrf_parameter() }}" value="{{ csrf_token(order.id) }}" />
         {% endif %}
         <button type="submit" class="dropdown-item" {{ sylius_test_html_attribute('cancel-order') }}>
             {{ ux_icon('tabler:circle-check', {'class': 'icon dropdown-item-icon'}) }}

src/Sylius/Bundle/AdminBundle/templates/order/show/content/header/title_block/actions/list/resend_confirmation_email.html.twig

@@ -1,7 +1,7 @@
 {% set order = hookable_metadata.context.resource %}
 
 {% if order.state in sylius_order_states_that_allows_to_resend_order_confirmation_email %}
-    {% set path = path('sylius_admin_order_resend_confirmation_email', {'id': order.id, '_csrf_token': sylius_csrf_protection_enabled() ? csrf_token(order.id) : null}) %}
+    {% set path = path('sylius_admin_order_resend_confirmation_email', {'id': order.id, (sylius_resource_csrf_parameter()): sylius_csrf_protection_enabled() ? csrf_token(order.id) : null}) %}
     <a class="dropdown-item" href="{{ path }}" {{ sylius_test_html_attribute('resend-order-confirmation-email') }}>
         {{ ux_icon('tabler:send', {'class': 'icon dropdown-item-icon flex-shrink-0'}) }}
         <div class="pe-6">{{ 'sylius.ui.resend_the_order_confirmation_email'|trans }}</div>

src/Sylius/Bundle/AdminBundle/templates/order/show/content/header/title_block/actions/resend_confirmation_email.html.twig

@@ -3,7 +3,7 @@
 {% set order = hookable_metadata.context.resource %}
 
 {% if order.state in sylius_order_states_that_allows_to_resend_order_confirmation_email %}
-    {% set path = path('sylius_admin_order_resend_confirmation_email', {'id': order.id, '_csrf_token': sylius_csrf_protection_enabled() ? csrf_token(order.id) : null}) %}
+    {% set path = path('sylius_admin_order_resend_confirmation_email', {'id': order.id, (sylius_resource_csrf_parameter()): sylius_csrf_protection_enabled() ? csrf_token(order.id) : null}) %}
     <a class="dropdown-item" href="{{ path }}" {{ sylius_test_html_attribute('resend-order-confirmation-email') }}>
         {{ ux_icon('tabler:send', {'class': 'icon dropdown-item-icon flex-shrink-0'}) }}
         <div class="pe-6">{{ 'sylius.ui.resend_the_order_confirmation_email'|trans }}</div>

src/Sylius/Bundle/AdminBundle/templates/order/show/content/sections/payments/item/actions/complete.html.twig

@@ -5,7 +5,7 @@
     <form action="{{ path('sylius_admin_order_payment_complete', {'orderId': order.id, 'id': payment.id}) }}" method="POST" novalidate>
         <input type="hidden" name="_method" value="PUT">
         {% if sylius_csrf_protection_enabled() %}
-            <input type="hidden" name="_csrf_token" value="{{ csrf_token(payment.id) }}" />
+            <input type="hidden" name="{{ sylius_resource_csrf_parameter() }}" value="{{ csrf_token(payment.id) }}" />
         {% endif %}
         <button type="submit" class="btn" {{ sylius_test_html_attribute('complete-payment', payment.id) }}>
             {{ ux_icon('tabler:check') }} {{ 'sylius.ui.complete'|trans }}

src/Sylius/Bundle/AdminBundle/templates/order/show/content/sections/payments/item/actions/refund.html.twig

@@ -5,7 +5,7 @@
     <form action="{{ path('sylius_admin_order_payment_refund', {'orderId': order.id, 'id': payment.id}) }}" method="POST" novalidate>
         <input type="hidden" name="_method" value="PUT">
         {% if sylius_csrf_protection_enabled() %}
-            <input type="hidden" name="_csrf_token" value="{{ csrf_token(payment.id) }}" />
+            <input type="hidden" name="{{ sylius_resource_csrf_parameter() }}" value="{{ csrf_token(payment.id) }}" />
         {% endif %}
         <button type="submit" class="btn" {{ sylius_test_html_attribute('refund-payment', payment.id) }}>
             {{ ux_icon('tabler:arrow-back-up-double') }} {{ 'sylius.ui.refund'|trans }}

src/Sylius/Bundle/AdminBundle/templates/order/show/content/sections/shipments/item/actions/resend_confirmation.html.twig

@@ -1,7 +1,7 @@
 {% set shipment = hookable_metadata.context.shipment %}
 
 {% if shipment.state == 'shipped' %}
-    {% set resend_path = path('sylius_admin_shipment_resend_confirmation_email', {'id': shipment.id, '_csrf_token': sylius_csrf_protection_enabled () ? csrf_token(shipment.id) : null}) %}
+    {% set resend_path = path('sylius_admin_shipment_resend_confirmation_email', {'id': shipment.id, (sylius_resource_csrf_parameter()): sylius_csrf_protection_enabled() ? csrf_token(shipment.id) : null}) %}
     <a href="{{ resend_path }}" class="btn btn-icon" data-bs-toggle="tooltip" data-bs-title="{{ 'sylius.ui.resend_the_shipment_confirmation_email'|trans }}" {{ sylius_test_html_attribute('resend-shipment-confirmation-email') }}>
         {{ ux_icon('tabler:send') }}
     </a>

src/Sylius/Bundle/AdminBundle/templates/shared/components/delete_modal.html.twig

@@ -14,7 +14,7 @@
     <form action="{{ path }}" method="post" {{ form_attr }}>
         <input type="hidden" name="_method" value="DELETE">
         {% if sylius_csrf_protection_enabled() %}
-            <input type="hidden" name="_csrf_token" value="{{ csrf_token(id) }}" />
+            <input type="hidden" name="{{ sylius_resource_csrf_parameter() }}" value="{{ csrf_token(id) }}" />
         {% endif %}
 
         {{ button.default({ text: 'sylius.ui.cancel'|trans, attr: 'data-bs-dismiss=modal' }) }}

src/Sylius/Bundle/AdminBundle/templates/shared/grid/action/apply_transition.html.twig

@@ -4,7 +4,7 @@
 {% if sylius_sm_can(data, options.graph, options.transition) %}
     <form action="{{ path(options.link.route, options.link.parameters) }}" method="post" {{ sylius_test_html_attribute('action', action.name) }}>
         {% if sylius_csrf_protection_enabled() %}
-            <input type="hidden" name="_csrf_token" value="{{ csrf_token(data.id) }}">
+            <input type="hidden" name="{{ sylius_resource_csrf_parameter() }}" value="{{ csrf_token(data.id) }}">
         {% endif %}
         <input type="hidden" name="_method" value="PUT">
         <button class="btn {{ options.class|default }}" {% if labeled and 'btn-icon' in options.class|default %}data-bs-toggle="tooltip" data-bs-title="{{ action.label|trans }}"{% endif %}>

src/Sylius/Bundle/AdminBundle/templates/taxon/sections/tree/actions/dropdown/delete.html.twig

@@ -25,7 +25,7 @@
                     <div class="modal-footer">
                         <form action="{{ path('sylius_admin_taxon_delete', {id: id}) }}" method="post">
                             <input type="hidden" name="_method" value="DELETE">
-                            <input type="hidden" name="_csrf_token" {{ stimulus_target('@sylius/admin-bundle/delete-taxon', 'csrfToken') }}/>
+                            <input type="hidden" name="{{ sylius_resource_csrf_parameter() }}" {{ stimulus_target('@sylius/admin-bundle/delete-taxon', 'csrfToken') }}/>
 
                             {{ button.default({ text: 'sylius.ui.cancel'|trans, attr: 'data-bs-dismiss=modal' }) }}
                             {{ button.default({ text: 'sylius.ui.delete'|trans, type: 'submit', class: 'btn-danger', attr: sylius_test_html_attribute('confirm-button') }) }}

src/Sylius/Bundle/ShopBundle/templates/shared/buttons.html.twig

@@ -58,7 +58,7 @@
             {{ ux_icon('tabler:trash', {'class': 'icon icon-xs'})}} {{ ((message is empty and labeled) ? 'sylius.ui.delete' : message)|trans }}
         </button>
         {% if sylius_csrf_protection_enabled() %}
-            <input type="hidden" name="_csrf_token" value="{{ csrf_token(resourceId) }}" />
+            <input type="hidden" name="{{ sylius_resource_csrf_parameter() }}" value="{{ csrf_token(resourceId) }}" />
         {% endif %}
     </form>
 {% endmacro %}

src/Sylius/Bundle/ShopBundle/templates/shared/components/delete_modal.html.twig

@@ -14,7 +14,7 @@
     <form action="{{ path }}" method="post" {{ form_attr }}>
         <input type="hidden" name="_method" value="DELETE">
         {% if sylius_csrf_protection_enabled() %}
-            <input type="hidden" name="_csrf_token" value="{{ csrf_token(id) }}" />
+            <input type="hidden" name="{{ sylius_resource_csrf_parameter() }}" value="{{ csrf_token(id) }}" />
         {% endif %}
 
         <button type="button" class="btn btn-sm" data-bs-dismiss="modal">