engineering/logs.unturf.com
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CSRF for loutout route switch from GET to POST.

Browse source 
modified:   app.py
	modified:   openapi.yaml
	modified:   templates/base.html.j2
This commit is contained in:
Russell Ballestrini 2025-01-12 10:02:07 -05:00
parent eb0933b46a
commit 1d6bf3c9d0
3 changed files with 82 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
app.py
View file

@ -601,7 +601,7 @@ def verify_post_view(request):
return HTTPFound(location=request.route_url("home"))
@view_config(route_name="logout")
@view_config(route_name="logout", request_method="POST", require_csrf=True)
def logout_view(request):
request.session.invalidate()
return HTTPFound(location=request.route_url("home"))

55
openapi.yaml
View file

@ -57,6 +57,11 @@ paths:
responses:
'302':
description: Redirects to the verification page
headers:
Location:
description: URL of the verification page
schema:
type: string
'400':
description: Bad Request (e.g., email missing)
'500':
@ -90,18 +95,32 @@ paths:
responses:
'302':
description: Redirects to the home page upon successful verification
headers:
Location:
description: URL of the home page
schema:
type: string
'400':
description: Bad Request (e.g., invalid code)
'500':
description: Internal Server Error
/auth/logout:
get:
post:
summary: Logout User
description: Logs out the current user.
security:
- sessionAuth: []
responses:
'302':
description: Redirects to the home page
headers:
Location:
description: URL of the home page
schema:
type: string
'403':
description: Unauthorized (user not logged in)
/auth/profile:
get:
@ -138,6 +157,11 @@ paths:
responses:
'302':
description: Redirects to the profile page
headers:
Location:
description: URL of the profile page
schema:
type: string
'400':
description: Bad Request (e.g., username already in use)
'403':
@ -180,6 +204,11 @@ paths:
responses:
'302':
description: Redirects to the namespace management page
headers:
Location:
description: URL of the namespace management page
schema:
type: string
'400':
description: Bad Request (e.g., namespace name already exists)
'403':
@ -236,6 +265,11 @@ paths:
responses:
'302':
description: Redirects to the namespace management page
headers:
Location:
description: URL of the namespace management page
schema:
type: string
'403':
description: Forbidden (not owner or not logged in)
'404':
@ -273,6 +307,11 @@ paths:
responses:
'302':
description: Redirects to the namespace management page
headers:
Location:
description: URL of the namespace management page
schema:
type: string
'400':
description: Bad Request (e.g., invalid role)
'403':
@ -345,6 +384,11 @@ paths:
responses:
'302':
description: Redirects to the namespace management page
headers:
Location:
description: URL of the namespace management page
schema:
type: string
'400':
description: Bad Request (e.g., agent ID missing)
'403':
@ -365,6 +409,11 @@ paths:
schema:
type: string
description: The short ID of the namespace
- in: query
name: q
schema:
type: string
description: Search query to filter logs
responses:
'200':
description: Logs page rendered
@ -392,10 +441,14 @@ paths:
properties:
message:
type: string
description: The log message
level:
type: string
description: Log level (e.g., INFO, ERROR)
default: INFO
metadata:
type: object
description: Additional metadata for the log entry
required:
- message
responses:

29
templates/base.html.j2
View file

@ -44,6 +44,21 @@
color: black;
}
.logout-link-button {
background: none;
border: none;
padding: 0;
margin: 0;
color: var(--pico-primary);
text-decoration: none;
cursor: pointer;
}
.logout-link-button:hover {
text-decoration: underline;
}
/* Hamburger Menu Button */
#mobile-menu-button {
display: none;
@ -113,7 +128,12 @@
{% if request.user and request.user.is_verified %}
<li><a href="{{ request.route_url('create_namespace') }}">Create Namespace</a></li>
<li><a href="{{ request.route_url('profile') }}">Profile</a></li>
<li><a href="{{ request.route_url('logout') }}">Logout</a></li>
<li>
<form action="{{ request.route_url('logout') }}" method="post" style="display: inline;">
<input type="hidden" name="csrf_token" value="{{ request.session.get_csrf_token() }}">
<button type="submit" class="logout-link-button">Logout</button>
</form>
</li>
{% else %}
<li><a href="{{ request.route_url('login') }}">Login</a></li>
{% endif %}
@ -130,7 +150,12 @@
{% if request.user and request.user.is_verified %}
<li><a href="{{ request.route_url('create_namespace') }}">Create Namespace</a></li>
<li><a href="{{ request.route_url('profile') }}">Profile</a></li>
<li><a href="{{ request.route_url('logout') }}">Logout</a></li>
<li>
<form action="{{ request.route_url('logout') }}" method="post" style="display: inline;">
<input type="hidden" name="csrf_token" value="{{ request.session.get_csrf_token() }}">
<button type="submit" class="logout-link-button">Logout</button>
</form>
</li>
{% else %}
<li><a href="{{ request.route_url('login') }}">Login</a></li>
{% endif %}