Skip to content

Commit

Permalink
fix(per): Ensure form-wizard journey is unique for each PER
Browse files Browse the repository at this point in the history
Currently we use a generic session key for the form wizard and its
journeys. This means that the session is shared for all Person Escort
Records. This leads to an occurrance of CSRF resets and clashes when
opening an old record to compare against a new record.

To prevent this, each form-wizard and journey is given a unique name
using the ID of the record.
  • Loading branch information
teneightfive committed Oct 30, 2020
1 parent be2fc31 commit 0dca482
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 4 deletions.
7 changes: 5 additions & 2 deletions app/person-escort-record/router.js
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ const FrameworkStepController = require('./controllers/framework-step')

function defineFormWizard(req, res, next) {
const { key, steps } = req.frameworkSection
const { id: personEscortRecordId } = req.personEscortRecord
const firstStep = Object.values(steps)[0]
const wizardFields = req.framework.questions
const wizardSteps = {
Expand All @@ -25,9 +26,11 @@ function defineFormWizard(req, res, next) {
const wizardConfig = {
controller: FrameworkStepController,
entryPoint: true,
journeyName: `person-escort-record-${key}`,
// Unique for each Person Escort Record and section
journeyName: `person-escort-record-${personEscortRecordId}-${key}`,
journeyPageTitle: 'Person escort record',
name: `person-escort-record-${key}`,
// Unique for each Person Escort Record
name: `person-escort-record-${personEscortRecordId}`,
template: 'framework-step',
templatePath: 'person-escort-record/views/',
defaultFormatters: ['trim', 'singlespaces', 'apostrophes', 'quotes'],
Expand Down
7 changes: 5 additions & 2 deletions app/person-escort-record/router.test.js
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,9 @@ describe('Person Escort Record router', function () {

beforeEach(function () {
req = {
personEscortRecord: {
id: '12345',
},
framework: mockFramework,
frameworkSection: {
key: 'section-one',
Expand Down Expand Up @@ -95,9 +98,9 @@ describe('Person Escort Record router', function () {
const config = {
controller: FrameworkStepController,
entryPoint: true,
journeyName: `person-escort-record-${req.frameworkSection.key}`,
journeyName: `person-escort-record-${req.personEscortRecord.id}-${req.frameworkSection.key}`,
journeyPageTitle: 'Person escort record',
name: `person-escort-record-${req.frameworkSection.key}`,
name: `person-escort-record-${req.personEscortRecord.id}`,
template: 'framework-step',
templatePath: 'person-escort-record/views/',
defaultFormatters: ['trim', 'singlespaces', 'apostrophes', 'quotes'],
Expand Down

0 comments on commit 0dca482

Please sign in to comment.