haiwen/seahub
1
0
Fork 0
mirror of https://github.com/haiwen/seahub.git synced 2025-09-01 15:09:14 +00:00
Code Issues Releases Wiki Activity

Use custom csrf cookie name to avoid name conflict

Browse Source
This commit is contained in:
zhengxie
2018-08-30 11:40:45 +08:00
parent 1faa061321
commit 0f59f84804
5 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
media/js/base.js
View File

@@ -103,7 +103,7 @@ function addConfirmTo(op_ele, popup) {
$('<form>', { $('<form>', {
"method": 'POST', "method": 'POST',
"action": $(this).data('url'), "action": $(this).data('url'),
"html": '<input name="csrfmiddlewaretoken" value="' + getCookie('csrftoken') + '" type="hidden">' "html": '<input name="csrfmiddlewaretoken" value="' + getCookie('sfcsrftoken') + '" type="hidden">'
}).appendTo(document.body).trigger('submit'); }).appendTo(document.body).trigger('submit');
} else { // default } else { // default
location.href = $(this).data('url'); location.href = $(this).data('url');
@@ -130,7 +130,7 @@ function addFormPost(op_ele) {
$('<form>', { $('<form>', {
"method": 'POST', "method": 'POST',
"action": $(this).data('url'), "action": $(this).data('url'),
"html": '<input name="csrfmiddlewaretoken" value="' + getCookie('csrftoken') + '" type="hidden">' "html": '<input name="csrfmiddlewaretoken" value="' + getCookie('sfcsrftoken') + '" type="hidden">'
}).appendTo(document.body).trigger('submit'); }).appendTo(document.body).trigger('submit');
return false; return false;
}); });
@@ -223,7 +223,7 @@ function getCookie(name) {
function prepareCSRFToken(xhr, settings) { function prepareCSRFToken(xhr, settings) {
if (!(/^http:.*/.test(settings.url) || /^https:.*/.test(settings.url))) { if (!(/^http:.*/.test(settings.url) || /^https:.*/.test(settings.url))) {
// Only send the token to relative URLs i.e. locally. // Only send the token to relative URLs i.e. locally.
xhr.setRequestHeader("X-CSRFToken", getCookie('csrftoken')); xhr.setRequestHeader("X-CSRFToken", getCookie('sfcsrftoken'));
} }
} }

1
seahub/base/context_processors.py
View File

@@ -108,6 +108,7 @@ def base(request):
'multi_institution': getattr(dj_settings, 'MULTI_INSTITUTION', False), 'multi_institution': getattr(dj_settings, 'MULTI_INSTITUTION', False),
'search_repo_id': search_repo_id, 'search_repo_id': search_repo_id,
'SITE_ROOT': SITE_ROOT, 'SITE_ROOT': SITE_ROOT,
'CSRF_COOKIE_NAME': dj_settings.CSRF_COOKIE_NAME,
'constance_enabled': dj_settings.CONSTANCE_ENABLED, 'constance_enabled': dj_settings.CONSTANCE_ENABLED,
'FILE_SERVER_ROOT': file_server_root, 'FILE_SERVER_ROOT': file_server_root,
'LOGIN_URL': dj_settings.LOGIN_URL, 'LOGIN_URL': dj_settings.LOGIN_URL,

1
seahub/settings.py
View File

@@ -130,6 +130,7 @@ MIDDLEWARE_CLASSES = (
SITE_ROOT_URLCONF = 'seahub.urls' SITE_ROOT_URLCONF = 'seahub.urls'
ROOT_URLCONF = 'seahub.utils.rooturl' ROOT_URLCONF = 'seahub.utils.rooturl'
SITE_ROOT = '/' SITE_ROOT = '/'
CSRF_COOKIE_NAME = 'sfcsrftoken'
# Python dotted path to the WSGI application used by Django's runserver. # Python dotted path to the WSGI application used by Django's runserver.
WSGI_APPLICATION = 'seahub.wsgi.application' WSGI_APPLICATION = 'seahub.wsgi.application'

1
seahub/templates/base_for_backbone.html
View File

@@ -120,6 +120,7 @@ var app = {
mediaUrl: '{{ MEDIA_URL }}', mediaUrl: '{{ MEDIA_URL }}',
siteRoot: '{{ SITE_ROOT }}', siteRoot: '{{ SITE_ROOT }}',
loginUrl: '{{ LOGIN_URL }}', loginUrl: '{{ LOGIN_URL }}',
csrfCookieName: '{{ CSRF_COOKIE_NAME }}',
fileServerRoot: '{{ FILE_SERVER_ROOT }}' fileServerRoot: '{{ FILE_SERVER_ROOT }}'
} }
}; };

2
static/scripts/common.js
View File

@@ -530,7 +530,7 @@ define([
} }
if (!(/^http:.*/.test(settings.url) || /^https:.*/.test(settings.url))) { if (!(/^http:.*/.test(settings.url) || /^https:.*/.test(settings.url))) {
// Only send the token to relative URLs i.e. locally. // Only send the token to relative URLs i.e. locally.
xhr.setRequestHeader("X-CSRFToken", getCookie('csrftoken')); xhr.setRequestHeader("X-CSRFToken", getCookie(app.config.csrfCookieName));
} }
}, },