fix(admin): send the CSRF token in the request body and drop the tables on delete

CHANGELOG.md

@@ -4,6 +4,13 @@ All notable changes to this module are documented here.
 
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the module adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.1.1] 2026-10-05
+
+### Fixed
+- The back-office pages of the module answered 500 on default-twig 1.2.0, which removed the `token_url()` Twig function: the rule and action forms now carry the CSRF token in a hidden field, never in the URL.
+- Uninstalling the module with its data now drops its three tables.
+- The back-office hook imported the parser resolver from a namespace the core does not ship.
+
 ## [2.1.0] 2026-10-02
 
 Product discounts served through the catalog price contract of the core. Requires Thelia 3.2.

Config/module.xml

@@ -15,7 +15,7 @@
         <language>en_US</language>
         <language>fr_FR</language>
     </languages>
-    <version>2.1.0</version>
+    <version>2.1.1</version>
     <authors>
         <author>
             <name>Samuel Diakité</name>

Controller/Back/ActionController.php

@@ -234,7 +234,7 @@ public function toggleAction(
             return $response;
         }
 
-        $tokenProvider->checkToken((string) $request->query->get('_token'));
+        $tokenProvider->checkRequestToken($request);
 
         $action = QueryBuilderActionQuery::create()->filterByRuleId($ruleId)->findOneById($actionId);
 
@@ -258,7 +258,7 @@ public function deleteAction(
             return $response;
         }
 
-        $tokenProvider->checkToken((string) $request->query->get('_token'));
+        $tokenProvider->checkRequestToken($request);
 
         $action = QueryBuilderActionQuery::create()->filterByRuleId($ruleId)->findOneById($actionId);
 

Controller/Back/RuleController.php

@@ -274,7 +274,7 @@ public function toggleRule(
             return $response;
         }
 
-        $tokenProvider->checkToken((string) $request->query->get('_token'));
+        $tokenProvider->checkRequestToken($request);
 
         $rule = QueryBuilderRuleQuery::create()->findOneById($ruleId);
 
@@ -297,7 +297,7 @@ public function deleteRule(
             return $response;
         }
 
-        $tokenProvider->checkToken((string) $request->query->get('_token'));
+        $tokenProvider->checkRequestToken($request);
 
         $rule = QueryBuilderRuleQuery::create()->findOneById($ruleId);
 

Hook/BackHook.php

@@ -11,7 +11,7 @@
 use Thelia\Core\Hook\BaseHook;
 use Thelia\Core\Security\AccessManager;
 use Thelia\Core\Security\SecurityContext;
-use Thelia\Core\Template\ParserResolver;
+use Thelia\Core\Template\Parser\ParserResolver;
 use Thelia\Tools\URL;
 
 /**

QueryBuilder.php

@@ -7,6 +7,7 @@
 use OpenStudio\QueryBuilderBundle\Form\QueryBuilderType;
 use OpenStudio\QueryBuilderBundle\Service\FormOptionsNormalizer;
 use Propel\Runtime\Connection\ConnectionInterface;
+use Propel\Runtime\Propel;
 use QueryBuilder\Service\DiscountCatalogPriceResolver;
 use Symfony\Component\DependencyInjection\Loader\Configurator\ServicesConfigurator;
 use Symfony\Component\Finder\Finder;
@@ -48,6 +49,20 @@ public function postActivation(?ConnectionInterface $con = null): void
         }
     }
 
+    public function destroy(?ConnectionInterface $con = null, $deleteModuleData = false): void
+    {
+        if (!$deleteModuleData) {
+            return;
+        }
+
+        $con ??= Propel::getConnection();
+
+        // Children first: the foreign keys would refuse the parent while they are there.
+        $con->exec('DROP TABLE IF EXISTS `query_builder_suggestion`');
+        $con->exec('DROP TABLE IF EXISTS `query_builder_action`');
+        $con->exec('DROP TABLE IF EXISTS `query_builder_rule`');
+    }
+
     public function update($currentVersion, $newVersion, ?ConnectionInterface $con = null): void
     {
         $updateDir = __DIR__ . DS . 'Config' . DS . 'update';

templates/backOffice/default-twig/QueryBuilder/rule-edit.html.twig

@@ -255,7 +255,8 @@
                                     <td><span class="badge text-bg-secondary">{{ action.type }}</span></td>
                                     <td class="text-center">
                                         {% if is_granted('UPDATE', { module: 'QueryBuilder' }) %}
-                                            <form method="post" action="{{ token_url('admin_query_builder_action_toggle', { ruleId: rule.id, actionId: action.id }) }}" class="d-inline">
+                                            <form method="post" action="{{ path('admin_query_builder_action_toggle', { ruleId: rule.id, actionId: action.id }) }}" class="d-inline">
+                                                <input type="hidden" name="_token" value="{{ assignToken() }}">
                                                 {% if action.activate %}
                                                     <button type="submit" class="btn btn-sm btn-success" title="{{ 'Click to deactivate'|trans({}, d) }}">{{ 'Active'|trans({}, d) }}</button>
                                                 {% else %}
@@ -277,7 +278,8 @@
                                             </a>
                                         {% endif %}
                                         {% if is_granted('DELETE', { module: 'QueryBuilder' }) %}
-                                            <form method="post" action="{{ token_url('admin_query_builder_action_delete', { ruleId: rule.id, actionId: action.id }) }}" class="d-inline" onsubmit="return confirm({{ 'Delete this action?'|trans({}, d)|json_encode|e('html_attr') }});">
+                                            <form method="post" action="{{ path('admin_query_builder_action_delete', { ruleId: rule.id, actionId: action.id }) }}" class="d-inline" onsubmit="return confirm({{ 'Delete this action?'|trans({}, d)|json_encode|e('html_attr') }});">
+                                                <input type="hidden" name="_token" value="{{ assignToken() }}">
                                                 <button type="submit" class="btn btn-sm btn-outline-danger" title="{{ 'Delete'|trans({}, d) }}">
                                                     <i class="bi bi-trash" aria-hidden="true"></i>
                                                 </button>

templates/backOffice/default-twig/QueryBuilder/rule-list.html.twig

@@ -82,7 +82,8 @@
                                 <td class="text-center">{{ rule.action_count }}</td>
                                 <td class="text-center">
                                     {% if is_granted('UPDATE', { module: 'QueryBuilder' }) %}
-                                        <form method="post" action="{{ token_url('admin_query_builder_rule_toggle', { ruleId: rule.id }) }}" class="d-inline">
+                                        <form method="post" action="{{ path('admin_query_builder_rule_toggle', { ruleId: rule.id }) }}" class="d-inline">
+                                            <input type="hidden" name="_token" value="{{ assignToken() }}">
                                             {% if rule.activate %}
                                                 <button type="submit" class="btn btn-sm btn-success" title="{{ 'Click to deactivate'|trans({}, d) }}">{{ 'Active'|trans({}, d) }}</button>
                                             {% else %}
@@ -104,7 +105,8 @@
                                         </a>
                                     {% endif %}
                                     {% if is_granted('DELETE', { module: 'QueryBuilder' }) %}
-                                        <form method="post" action="{{ token_url('admin_query_builder_rule_delete', { ruleId: rule.id }) }}" class="d-inline" onsubmit="return confirm({{ 'Delete this rule and its actions?'|trans({}, d)|json_encode|e('html_attr') }});">
+                                        <form method="post" action="{{ path('admin_query_builder_rule_delete', { ruleId: rule.id }) }}" class="d-inline" onsubmit="return confirm({{ 'Delete this rule and its actions?'|trans({}, d)|json_encode|e('html_attr') }});">
+                                            <input type="hidden" name="_token" value="{{ assignToken() }}">
                                             <button type="submit" class="btn btn-sm btn-outline-danger" title="{{ 'Delete'|trans({}, d) }}">
                                                 <i class="bi bi-trash" aria-hidden="true"></i>
                                             </button>