engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

helpers: make sure request parameter is not rendered inside secure form.

Browse source
This commit is contained in:
Marcin Kuzminski 2017-09-12 22:49:26 +02:00
parent f42a5ca66b
commit fa3a86bbcb
1 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
rhodecode/lib/helpers.py
View file

@ -1890,7 +1890,7 @@ def form(url, method='post', needs_csrf_token=True, **attrs):
return wh_form(url, method=method, **attrs)
def secure_form(url, method="POST", multipart=False, **attrs):
def secure_form(form_url, method="POST", multipart=False, **attrs):
"""Start a form tag that points the action to an url. This
form tag will also include the hidden field containing
the auth token.
@ -1910,13 +1910,15 @@ def secure_form(url, method="POST", multipart=False, **attrs):
"""
from webhelpers.pylonslib.secure_form import insecure_form
form = insecure_form(url, method, multipart, **attrs)
session = None
# TODO(marcink): after pyramid migration require request variable ALWAYS
if 'request' in attrs:
session = attrs['request'].session
del attrs['request']
form = insecure_form(form_url, method, multipart, **attrs)
token = literal(
'<input type="hidden" id="{}" name="{}" value="{}">'.format(
csrf_token_key, csrf_token_key, get_csrf_token(session)))