Add CSRF protection to all POSTable views in Djblets.

 






 

 


  Review Request #5571
  —
  Created March 2, 2014 and submitted 

 


















 

  

   Information

  





 
 

  chipx86
 









 
 

  Djblets
 









 
 

  master
 









 
 

  
 









 
 

  
 









 
 

  72bcc4e...
 






 




 

  

   Reviewers

  





 
 

  djblets
 









 
 

  
 






 








 





  


 
 

  
All views in Djblets that handle HTTP POST requests are now decorated

with a @csrf_protect decorator, and have matching {% csrf_token %} tags

in the templates. This adds a layer of protection we didn't have before.


The API is unaffected, as adding CSRF protection to APIs sort of defeats

the purpose of APIs. There are other protections we may want to make

here, but that's a separate task.

 








  


 
 

  
Tested each view in Review Board, with the {% csrf_token %} tags removed.

Saw the CSRF validation failures. Added back the tags, and was able to POST.

 







 









 





  








 






 
 
 

  

   

    

     
    

    
    
     
  • 
      
     
    • 
     
  • 
      
     
    • 
     
  • 
      
     
    • 
     
  • 
      
     
    • 
     
  • 
      
     
    • 
    

   

   

    
     

      Description
      From
      Last Updated
     

    
    



     

      
       
       
This should be left-aligned, no?

      		
      
       daviddavid
      
      
       
      
     


    
   

  

 







 






  

 








 














 





 

  

   




david




   

   







  

 



 

  


   

   

    
 
david


    
   


  

  

  



    




  1. 
 
    
  
    
   
    
  
    
 
    

 
    
  


    
 
    
 
      

  

 
    


    

 
    

    2. 

















  2. 
 
    
  
  
    
  
 

   
    
    
    




    
 
    
  
  
  

  
  
   Show all issues
  
 
    

    



    
    This should be left-aligned, no?
    
  
    
 
    

 
    
  


    
 
    
 
      

  


    1. 
 
 
      
 
      
  
 
      
 
      
  
      It's basically a variable for generating a <input/>, as opposed to any flow control or any block-generating statements, so it seemed appropriate to place it where I wanted the <input/>.
      
 
      

      2. 



    2. 
 
 
      
 
      
  
 
      
 
      
  
      Hmm, ok.
      
 
      

      3. 


 
    


    

 
    

    3. 




  3. 
 
    
  
    
   
    
  
    
 
    

 
    
  


    
 
    
 
      

  

 
    


    

 
    

    4. 




  

 
















 





 

  

   




david




   

   







  

 



 

  


   

   

    
 
david


    
   


  

  

  



    




  1. 
 
    
  
    
   
    Ship It!
    
  
    
 
    

 
    
  


    
 
    
 
      

  

 
    


    

 
    

    2. 















  2. 
 
    
  
    
   
    
  
    
 
    

 
    
  


    
 
    
 
      

  

 
    


    

 
    

    3. 




  

 
















 



 

  

   




chipx86




   

   

  

 



 

  


   

   

    
 Review request changed

    
   


  

  

  






 

  Status:
  

  Closed (submitted)

  
 







 


 










  

 









     

    

   

  

  

   
   Loading...