Mercurial > kallithea
view MANIFEST.in @ 7703:5c5f0eb45681
auth: move CSRF checks from the optional LoginRequired to the more basic BaseController._before
_before is not called for the CSRF-immune JSON-API controller and is thus a
good place to check CSRF. This also apply CSRF protection to the login
controller.
The flag for needing CSRF checking is stored in the thread global request
object when passed from __call__ to _before for regular controllers. It is thus
also set for requests to the JSON-RPC controller, but not used.
author | Mads Kiilerich <mads@kiilerich.com> |
---|---|
date | Fri, 04 Jan 2019 03:51:38 +0100 |
parents | 19a9f02443c8 |
children | ddfecf9fe7f2 |
line wrap: on
line source
include .coveragerc include Apache-License-2.0.txt include CONTRIBUTORS include COPYING include Jenkinsfile include LICENSE-MERGELY.html include LICENSE.md include MIT-Permissive-License.txt include README.rst include dev_requirements.txt include development.ini include pytest.ini include requirements.txt include tox.ini recursive-include docs * recursive-include init.d * recursive-include kallithea/alembic * include kallithea/bin/ldap_sync.conf include kallithea/lib/paster_commands/template.ini.mako recursive-include kallithea/front-end * recursive-include kallithea/i18n * recursive-include kallithea/public * recursive-include kallithea/templates * recursive-include kallithea/tests/fixtures * recursive-include kallithea/tests/scripts * include kallithea/tests/models/test_dump_html_mails.ref.html include kallithea/tests/performance/test_vcs.py include kallithea/tests/vcs/aconfig recursive-include scripts *