Also ensure that updates etc cannot be done via get only via post as per APIv3

diff --git a/CRM/Api4/Page/AJAX.php b/CRM/Api4/Page/AJAX.php
index 5ec8c567733cdfb7d1ac5b3a95db879a15842738..f40d0dbd58476d7542f49b7c636c6260710c2465 100644 (file)
--- a/CRM/Api4/Page/AJAX.php
+++ b/CRM/Api4/Page/AJAX.php
@@ -32,7 +32,7 @@ class CRM_Api4_Page_AJAX extends CRM_Core_Page {
         'error_code' => 401,
         'error_message' => "SECURITY ALERT: Ajax requests can only be issued by javascript clients, eg. CRM.api4().",
       ];
-      Civi::log()->debug( "SECURITY ALERT: Ajax requests can only be issued by javascript clients, eg. CRM.api4().",
+      Civi::log()->debug("SECURITY ALERT: Ajax requests can only be issued by javascript clients, eg. CRM.api4().",
         [
           'IP' => $_SERVER['REMOTE_ADDR'],
           'level' => 'security',
@@ -44,6 +44,25 @@ class CRM_Api4_Page_AJAX extends CRM_Core_Page {
       echo json_encode($response);
       CRM_Utils_System::civiExit();
     }
+    if ($_SERVER['REQUEST_METHOD'] == 'GET' &&
+      strtolower(substr($this->urlPath[4], 0, 3)) != 'get' &&
+      strtolower($this->urlPath[4] != 'check')) {
+      $response = [
+        'error_code' => 400,
+        'error_message' => "SECURITY: All requests that modify the database must be http POST, not GET.",
+      ];
+      Civi::log()->debug("SECURITY: All requests that modify the database must be http POST, not GET.",
+        [
+          'IP' => $_SERVER['REMOTE_ADDR'],
+          'level' => 'security',
+          'referer' => $_SERVER['HTTP_REFERER'],
+          'reason' => 'Destructive HTTP GET',
+        ]
+      );
+      CRM_Utils_System::setHttpHeader('Content-Type', 'application/json');
+      echo json_encode($response);
+      CRM_Utils_System::civiExit();
+    }
     try {
       // Call multiple
       if (empty($this->urlPath[3])) {

diff --git a/ang/api4Explorer/Explorer.js b/ang/api4Explorer/Explorer.js
index a626e572dca9cb6160d5d4ad1bdf675c6df6ae3c..15245f4a2cb4105eb507e44f0db668feb60752c0 100644 (file)
--- a/ang/api4Explorer/Explorer.js
+++ b/ang/api4Explorer/Explorer.js
@@ -472,10 +472,10 @@
     $scope.execute = function() {
       $scope.status = 'warning';
       $scope.loading = true;
-      $http.get(CRM.url('civicrm/ajax/api4/' + $scope.entity + '/' + $scope.action, {
+      $http.post(CRM.url('civicrm/ajax/api4/' + $scope.entity + '/' + $scope.action, {
         params: angular.toJson(getParams()),
         index: $scope.index
-      }), {
+      }), null, {
         headers: {
           'X-Requested-With': 'XMLHttpRequest'
         }