learn

Taking a dish off the menu

Exercise 5 of 6 in chapter 3 · 180 XP · 5 objectives checked by tests

Topics covered: DeletionCSRFremove

The “Wayfarer Bread” hasn't sold since Legolas told everyone it put him to sleep for three days. Bruna wants to take it off the menu.

Deleting means changing data: never with a simple link (a robot crawling the site, or a booby-trapped image on another site, would be enough to wipe everything). You go through a POST form, protected by a CSRF token.

Your mission

  1. Add a supprimerPlat() (delete dish) action to CuisineController on /kitchen/dish/{slug}/delete (route app_supprimer_plat), POST only:
    • check the CSRF token sent in the _token field; if it is invalid, refuse with a 403 error;
    • delete the dish, add the flash message “"Dish name" is off the menu.”, then redirect to the menu.
  2. On the dish page, add a small POST form to this action, with the token in a hidden field and a “Remove from the menu” button.

The token must be specific to the dish: use a token id that contains the dish's id ('supprimer-plat-' ~ plat.id).

The dish's reviews go with it: that's configured in the mapping (cascade: ['remove']).

Reminder

Symfony forms handle CSRF on their own. For a hand-written form, you use csrf_token() in Twig and isCsrfTokenValid() in the controller.