This question already has an answer here:

I ran CheckMarx security code scanner and found this 1 security risk issue for a Button on Opportunity that opens a VF page (generates pdf).

From the code report, here is the issue mentioned. Can someone explain in detail? It highlighted the 2 lines below.

XSRF result path 1

Object: createquote in file: /pages/Print_Contract.page

L 4: showHeader="false" action="{!createQuote}">

Object: insert in file: /classes/ContractController.cls

L 93: insert quotelineItems;

Is this related to running DMLs on action method of the page? If yes, then what are the alternatives? I don't want users to do an additional manual step after clicking the button.

marked as duplicate by eyescream, Raul, glls, battery.cord, Mohith Shrivastava Oct 2 '17 at 13:54

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


I would redeclare createQuote method as webservice, returning the id of the inserted record,

then tranform the button so that it executes javascript

finally, on click on the button, execute createQuote in ajax and then redirect to the visualforce page. It probably would be nice to add a confirm message to alert the user he's gonna insert records, but it's up to you.

in the class :

Static webservice String createQuote(...) { 
    insert quotelineItems;
    return quote.Id;

in the button :

/* if (confirm("you're going to insert an quote... u sure ?") { */
  var qId = sforce.apex.execute("yourClass", "createQuote", arguments);
    // check qId consistency here...
  self.location = '/apex/yourVfPage?id=' + qId;
/* } */

you didn't provide much code so you'd probably have to adapt this to your code.

Not the answer you're looking for? Browse other questions tagged or ask your own question.