vbatts/quay
Archived
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Make the CSRF checks mandatory.

Browse source
This commit is contained in:
jakedt 2014-03-25 14:35:19 -04:00
parent f060fd6ae0
commit 219fbd6950
1 changed files with 1 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

7
endpoints/csrf.py
View file

@ -26,16 +26,11 @@ def csrf_protect(func):
token = session.get('_csrf_token', None) token = session.get('_csrf_token', None)
found_token = request.values.get('_csrf_token', None) found_token = request.values.get('_csrf_token', None)
# TODO: add if not token here, once we are sure all sessions have a token. if not token or token != found_token:
if token != found_token:
msg = 'CSRF Failure. Session token was %s and request token was %s' msg = 'CSRF Failure. Session token was %s and request token was %s'
logger.error(msg, token, found_token) logger.error(msg, token, found_token)
abort(403, message='CSRF token was invalid or missing.') abort(403, message='CSRF token was invalid or missing.')
if not token:
logger.warning('No CSRF token in session.')
else:
logger.debug('Found and validated CSRF token.')
return func(*args, **kwargs) return func(*args, **kwargs)
return wrapper return wrapper