engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

pyramid: if possible fetch csrf tokens from pyramid session.

Browse source 
- we need to explicitly pass in requests into secure forms
- allows to not use pylons global session for fetching csrf tokens
This commit is contained in:
Marcin Kuzminski 2017-07-13 12:35:42 +02:00
parent ea17d0aac2
commit c650cdddcc
24 changed files with 43 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

8
rhodecode/templates/admin/repos/repo_edit_advanced.mako
View file

@ -24,7 +24,7 @@
<h3 class="panel-title">${_('Fork Reference')} <a class="permalink" href="#advanced-fork"> ¶</a></h3>
</div>
<div class="panel-body">
${h.secure_form(h.route_path('edit_repo_advanced_fork', repo_name=c.repo_info.repo_name), method='POST')}
${h.secure_form(h.route_path('edit_repo_advanced_fork', repo_name=c.repo_info.repo_name), method='POST', request=request)}
% if c.repo_info.fork:
<div class="panel-body-title-text">${h.literal(_('This repository is a fork of %(repo_link)s') % {'repo_link': h.link_to_if(c.has_origin_repo_read_perm,c.repo_info.fork.repo_name, h.route_path('repo_summary', repo_name=c.repo_info.fork.repo_name))})}
@ -48,7 +48,7 @@
<h3 class="panel-title">${_('Public Journal Visibility')} <a class="permalink" href="#advanced-journal"> ¶</a></h3>
</div>
<div class="panel-body">
${h.secure_form(h.route_path('edit_repo_advanced_journal', repo_name=c.repo_info.repo_name), method='POST')}
${h.secure_form(h.route_path('edit_repo_advanced_journal', repo_name=c.repo_info.repo_name), method='POST', request=request)}
<div class="field">
%if c.in_public_journal:
<button class="btn btn-small" type="submit">
@ -73,7 +73,7 @@
<h3 class="panel-title">${_('Locking state')} <a class="permalink" href="#advanced-locking"> ¶</a></h3>
</div>
<div class="panel-body">
${h.secure_form(h.route_path('edit_repo_advanced_locking', repo_name=c.repo_info.repo_name), method='POST')}
${h.secure_form(h.route_path('edit_repo_advanced_locking', repo_name=c.repo_info.repo_name), method='POST', request=request)}
%if c.repo_info.locked[0]:
<div class="panel-body-title-text">${'Locked by %s on %s. Lock reason: %s' % (h.person_by_id(c.repo_info.locked[0]),
@ -113,7 +113,7 @@
<h3 class="panel-title">${_('Delete repository')} <a class="permalink" href="#advanced-delete"> ¶</a></h3>
</div>
<div class="panel-body">
${h.secure_form(h.route_path('edit_repo_advanced_delete', repo_name=c.repo_name), method='POST')}
${h.secure_form(h.route_path('edit_repo_advanced_delete', repo_name=c.repo_name), method='POST', request=request)}
<table class="display">
<tr>
<td>