moksha/api/widgets/global_resources/widget.py | 5 ++++-
moksha/public/javascript/moksha.js | 3 +++
2 files changed, 7 insertions(+), 1 deletion(-)
New commits:
commit a1a52d3f04bcd9bb0bffc63c46dea244e79b10e8
Author: John (J5) Palmieri <johnp(a)redhat.com>
Date: Mon Jul 13 15:56:21 2009 -0400
allow csrf tokens to be attached to trusted domain urls
* the service's .ini file must define a comma seperated list of trusted
domain names e.g. moksha.csrf.trusted_domains =
mydomain.com
* all links that need to be transformed with the csrf token must either
declare the moksha_url attribute on the anchor tag in the template or
run moksha.url on the URL in javascript
diff --git a/moksha/api/widgets/global_resources/widget.py
b/moksha/api/widgets/global_resources/widget.py
index 5faef64..862e30b 100644
--- a/moksha/api/widgets/global_resources/widget.py
+++ b/moksha/api/widgets/global_resources/widget.py
@@ -53,6 +53,7 @@ class GlobalResourceInjectionWidget(Widget):
<script type="text/javascript">
moksha_base_url = "${base_url}";
moksha_csrf_token = "${csrf_token}";
+ moksha_csrf_trusted_domains = ${csrf_trusted_domains};
moksha_userid = "${user_id}";
moksha_debug = ${debug};
moksha_profile = ${profile};
@@ -60,7 +61,7 @@ class GlobalResourceInjectionWidget(Widget):
"""
engine_name = 'mako'
- params = ['base_url', 'csrf_token', 'user_id',
'debug', 'profile']
+ params = ['base_url', 'csrf_token', 'user_id',
'debug', 'profile', 'csrf_trusted_domains']
base_url = '/'
csrf_token = ''
user_id = ''
@@ -99,6 +100,8 @@ class GlobalResourceInjectionWidget(Widget):
if asbool(config['global_conf'].get('profile')):
d['profile'] = 'true'
+ d['csrf_trusted_domains'] =
config.get('moksha.csrf.trusted_domains', '').split(',')
+
identity = request.environ.get('repoze.who.identity')
if identity:
d['csrf_token'] = identity.get(self.csrf_token_id, '')
diff --git a/moksha/public/javascript/moksha.js b/moksha/public/javascript/moksha.js
index fe4582c..f4ef52b 100644
--- a/moksha/public/javascript/moksha.js
+++ b/moksha/public/javascript/moksha.js
@@ -686,6 +686,9 @@ moksha = {
purl.update_query_string(params);
moksha.csrf_rewrite_uri(purl);
+ } else {
+ if (moksha_csrf_trusted_domains.indexOf(purl.host) != -1)
+ moksha.csrf_rewrite_uri(purl);
}
return purl.toString();