From fa3a86bbcb1faac30a8fb93da60ea0ff8143e2cd Mon Sep 17 00:00:00 2001 From: Marcin Kuzminski Date: Tue, 12 Sep 2017 22:49:26 +0200 Subject: [PATCH] helpers: make sure request parameter is not rendered inside secure form. --- rhodecode/lib/helpers.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/rhodecode/lib/helpers.py b/rhodecode/lib/helpers.py index 01b39c59..c0f1cea4 100644 --- a/rhodecode/lib/helpers.py +++ b/rhodecode/lib/helpers.py @@ -1890,7 +1890,7 @@ def form(url, method='post', needs_csrf_token=True, **attrs): return wh_form(url, method=method, **attrs) -def secure_form(url, method="POST", multipart=False, **attrs): +def secure_form(form_url, method="POST", multipart=False, **attrs): """Start a form tag that points the action to an url. This form tag will also include the hidden field containing the auth token. @@ -1910,13 +1910,15 @@ def secure_form(url, method="POST", multipart=False, **attrs): """ from webhelpers.pylonslib.secure_form import insecure_form - form = insecure_form(url, method, multipart, **attrs) session = None + # TODO(marcink): after pyramid migration require request variable ALWAYS if 'request' in attrs: session = attrs['request'].session + del attrs['request'] + form = insecure_form(form_url, method, multipart, **attrs) token = literal( ''.format( csrf_token_key, csrf_token_key, get_csrf_token(session)))