Sign Up ›
  • azaam ali 1
  • NEWBIE
  • 0 Points
  • Member since 2020
  • Chatter
    Feed
  • 0
    Best Answers
  • 0
    Likes Received
  • 1
    Likes Given
  • 0
    Questions
  • 1
    Replies
SOLVED
4 replies

Unable to complete Trailhead challenge: "Prevent Cross-Site Request Forgery (CSRF)"

Hi all

I am unable to complete this challenge because whenever I am clicking check button, I receive the error message.
User-added image
"Challenge Not yet complete... here's what's wrong: 
It doesn't appear that you've added protection against CSRF. Make sure you re-write the outputlink to a commandlink that is not vulnerable to CSRF, that the action is no longer in the on-load method and the correct method is referenced by the command link"

I don't understand what is wrong. I removed the action handler from the apex:page tag and below the comment "<!-- complete challenge here -->" added command link. 
  
<apex:page controller="CSRF_Challenge" sidebar="false" tabStyle="CSRF_Challenge__tab" > <!-- action="{!approveReq}" -->
<apex:sectionHeader title="CSRF Challenge" />
<apex:form >
    <apex:pageBlock >
        <apex:pageMessages />      
        <apex:pageBlockSection title="Demo" columns="1" id="tableBlock">

            <apex:pageBlockTable value="{!Requisitions }" var="req">
                
                <!-- skipped -->    
                                             
                <apex:column headervalue="Approval Action">
                    <apex:outputLink target="_new" value="/apex/CSRF_Challenge?approve={!req.id}">Approve This Requisition</apex:outputLink>
                </apex:column>
                <apex:column headervalue="Approval Action (NO CSRF)">
                    TBD
                    <!-- complete challenge here -->
                    <apex:commandLink value="Approve This Requisition" action="{!approveReqNOCSRF}"> 
                        <apex:param name="reqId" value="{!req.id}" assignTo="{!approve}"/> 
                    </apex:commandLink>
                </apex:column>                                                                                               
            </apex:pageBlockTable>
       
        </apex:pageBlockSection>
        
        <!-- skipped -->
         
</apex:form>              
</apex:page>



Any advice?

Thanks,
Alex
5 replies

Use Apex Metadata API to add a custom metadata type to an org

public class MetadataExample {
    
    public void updateMetadata() {
        Metadata.CustomMetadata customMetaData = new Metadata.CustomMetadata();
        customMetaData.fullName = 'MyNamespace__MyMetadataTypeName.MyMetadataRecordName';
        
        Metadata.CustomMetadataValue customField = new Metadata.CustomMetadataValue();
         customField.field = 'customField__c';
        customField.value = 'New value';
        
        customMetadata.values.add(customField);
        Metadata.DeployContainer deployContainer = new Metadata.DeployContainer();
        deployContainer.addMetadata(customMetadata);
        
        Id asyncResultId = Metadata.Operations.enqueueDeployment(deployContainer,null);
    }
}

Courtsey: https://www.youtube.com/watch?v=4U2M75X5M8Q