From 5ddef6236b83082375d63728101b8fd0a4af52d4 Mon Sep 17 00:00:00 2001
From: Mathieu Ducrot <mathieu.ducrot@smartbooster.io>
Date: Tue, 4 Aug 2026 18:31:20 +0200
Subject: [PATCH 1/4] Add missing sec tok on login form pour fix CWE-352

---
 templates/security/login.html.twig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/templates/security/login.html.twig b/templates/security/login.html.twig
index 07ca66b..e0414ac 100644
--- a/templates/security/login.html.twig
+++ b/templates/security/login.html.twig
@@ -15,6 +15,7 @@
         <div class="login-box-body">
             {% block smartsonata_box_header %}<h1 class="text-center">SMART SONATA</h1>{% endblock %}
             <form action="{{ security_login_check_url }}" method="post">
+                <input type="hidden" name="_csrf_token" value="{{ csrf_token('authenticate') }}">
                 <div class="form-group has-feedback">
                     <input type="text" name="_username" class="form-control" autocomplete="off" placeholder="{{ 'login.label_username'|trans({}, 'security') }}" required />
                     <span class="glyphicon glyphicon-user form-control-feedback"></span>

From 9690b01a85065308c158d6f27dd1b7b0440dcc89 Mon Sep 17 00:00:00 2001
From: Mathieu Ducrot <mathieu.ducrot@smartbooster.io>
Date: Tue, 4 Aug 2026 18:32:03 +0200
Subject: [PATCH 2/4] Add missing integrity attribut on iconify to fix CWE-345

---
 templates/empty_layout.html.twig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/empty_layout.html.twig b/templates/empty_layout.html.twig
index 7e4ec58..56a29de 100644
--- a/templates/empty_layout.html.twig
+++ b/templates/empty_layout.html.twig
@@ -18,7 +18,7 @@
     {# no parent() to disable javascript on empty_layout to prevent loading jquery #}
 
     {# https://iconify.design/docs/iconify-icon/#registering-the-web-component #}
-    <script src="https://code.iconify.design/iconify-icon/2.1.0/iconify-icon.min.js"></script>
+    <script src="https://code.iconify.design/iconify-icon/2.1.0/iconify-icon.min.js" integrity="sha384-GPb5RlngihS9H0z1D137JsvzmeZ7tCpWEF4t5YDoTZyMsPP8S7h7vFDh4XhheU83" crossorigin="anonymous"></script>
 {% endblock %}
 
 {% block sonata_wrapper %}

From 5f229d6be4afad034a508be79fe001b15e03ab20 Mon Sep 17 00:00:00 2001
From: Mathieu Ducrot <mathieu.ducrot@smartbooster.io>
Date: Wed, 5 Aug 2026 16:03:27 +0200
Subject: [PATCH 3/4] Add integrity hash for marked js use on the markdown
 template

---
 templates/admin/documentation/markdown.html.twig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/admin/documentation/markdown.html.twig b/templates/admin/documentation/markdown.html.twig
index 0210fab..74df242 100644
--- a/templates/admin/documentation/markdown.html.twig
+++ b/templates/admin/documentation/markdown.html.twig
@@ -67,7 +67,7 @@
 
 {% block javascripts %}
     {{ parent() }}
-    <script src="https://cdn.jsdelivr.net/npm/marked/marked.min.js"></script>
+    <script src="https://cdn.jsdelivr.net/npm/marked@15.0.12/marked.min.js" integrity="sha384-948ahk4ZmxYVYOc+rxN1H2gM1EJ2Duhp7uHtZ4WSLkV4Vtx5MUqnV+l7u9B+jFv+" crossorigin="anonymous"></script>
     <script type="application/javascript">
       document.addEventListener('DOMContentLoaded', function() {
         const content = {{ markdown_content|json_encode|raw }}

From f7c861102f6378533c262213d28edb5916e817a3 Mon Sep 17 00:00:00 2001
From: Mathieu Ducrot <mathieu.ducrot@smartbooster.io>
Date: Wed, 5 Aug 2026 19:02:52 +0200
Subject: [PATCH 4/4] Update changelog v2.12.2 about recent fixed CWEs

---
 CHANGELOG.md | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index db13153..7af4974 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,14 @@
 CHANGELOG
 ===================
+## v2.12.2 - (2026-08-05)
+### BC BREAK
+- The login form now submits a CSRF token. You must enable `enable_csrf: true` on the `form_login` of the admin firewall in your `security.yaml` config, otherwise authentication will fail.
+
+### Fixed
+- `templates/security/login.html.twig` Add missing CSRF token on login form to fix CWE-352
+- `templates/empty_layout.html.twig` Add missing `integrity`/`crossorigin` attributes on the Iconify CDN script to fix CWE-345
+- `templates/admin/documentation/markdown.html.twig` Pin `marked` CDN script to a fixed version and add `integrity`/`crossorigin` attributes to fix CWE-345
+
 ## v2.12.1 - (2026-05-19)
 ### Removed
 - Removed redundant Composer dependencies duplicated from `smartbooster/core-bundle`