moksha/middleware/csrf.py | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
New commits:
commit 58f4e470eb01bead9092f728fc42cf3cbbac6c2c
Author: John (J5) Palmieri <johnp(a)redhat.com>
Date: Wed Apr 15 10:54:13 2009 -0400
strip the SCRIPT_NAME ennviron from the path when comparing
diff --git a/moksha/middleware/csrf.py b/moksha/middleware/csrf.py
index 956d306..2b87d58 100644
--- a/moksha/middleware/csrf.py
+++ b/moksha/middleware/csrf.py
@@ -80,7 +80,7 @@ class CSRFProtectionMiddleware(object):
URLs can then be re-written using the ``moksha.csrf_rewrite_url`` function
that is in the ``moksha.js`` library, which is automatically pulled in by
the MokshaGlobals widget. Here is an example of adding the CSRF token to
- an ajax. This example also utilizes the ``moksha.filter_resources``
+ an ajax. This example also utilizes the ``moksha.filter_resources``
function to strip out any duplicate javascript files.
.. code-block:: javascript
@@ -211,6 +211,19 @@ class CSRFMetadataProvider(object):
self.auth_session_id = auth_session_id
self.auth_state = auth_state
+ def strip_script(self, environ, path):
+ # Strips the script portion of a url path so the middleware works even
+ # when mounted under a path other than root
+ if path.startswith('/') and 'SCRIPT_NAME' in environ:
+ prefix = environ.get('SCRIPT_NAME')
+ if prefix.endswith('/'):
+ prefix = prefix[:-1]
+
+ if path.startswith(prefix):
+ path = path[len(prefix):]
+
+ return path
+
def add_metadata(self, environ, identity):
request = Request(environ)
log.debug("CSRFMetadataProvider.add_metadata(%s)" % request.path)
@@ -224,7 +237,8 @@ class CSRFMetadataProvider(object):
token = sha1(session_id).hexdigest()
identity.update({self.csrf_token_id: token})
log.debug("Identity updated with CSRF token")
- if request.path == self.login_handler:
+ path = self.strip_script(environ, request.path)
+ if path == self.login_handler:
log.debug('Setting CSRF_AUTH_STATE')
environ[self.auth_state] = True
environ[self.token_env] = token
Show replies by date