haiwen/seahub
1
0
Fork 0
mirror of https://github.com/haiwen/seahub.git synced 2025-04-27 19:05:16 +00:00
Code Issues Releases Wiki Activity

Merge pull request #2317 from haiwen/6.3-csrf_cookie

Browse Source 
Use custom csrf cookie name to avoid name conflict
This commit is contained in:
zheng xie 2018-08-30 18:52:24 +08:00 committed by GitHub
commit e68193c965
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
9 changed files with 24 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
media/js/base.js
View File

@ -103,7 +103,7 @@ function addConfirmTo(op_ele, popup) {
$('<form>', {
"method": 'POST',
"action": $(this).data('url'),
"html": '<input name="csrfmiddlewaretoken" value="' + getCookie('csrftoken') + '" type="hidden">'
"html": '<input name="csrfmiddlewaretoken" value="' + getCookie(SEAFILE_GLOBAL.csrfCookieName) + '" type="hidden">'
}).appendTo(document.body).trigger('submit');
} else { // default
location.href = $(this).data('url');
@ -130,7 +130,7 @@ function addFormPost(op_ele) {
$('<form>', {
"method": 'POST',
"action": $(this).data('url'),
"html": '<input name="csrfmiddlewaretoken" value="' + getCookie('csrftoken') + '" type="hidden">'
"html": '<input name="csrfmiddlewaretoken" value="' + getCookie(SEAFILE_GLOBAL.csrfCookieName) + '" type="hidden">'
}).appendTo(document.body).trigger('submit');
return false;
});
@ -223,7 +223,7 @@ function getCookie(name) {
function prepareCSRFToken(xhr, settings) {
if (!(/^http:.*/.test(settings.url) || /^https:.*/.test(settings.url))) {
// Only send the token to relative URLs i.e. locally.
xhr.setRequestHeader("X-CSRFToken", getCookie('csrftoken'));
xhr.setRequestHeader("X-CSRFToken", getCookie(SEAFILE_GLOBAL.csrfCookieName));
}
}

1
seahub/base/context_processors.py
View File

@ -108,6 +108,7 @@ def base(request):
'multi_institution': getattr(dj_settings, 'MULTI_INSTITUTION', False),
'search_repo_id': search_repo_id,
'SITE_ROOT': SITE_ROOT,
'CSRF_COOKIE_NAME': dj_settings.CSRF_COOKIE_NAME,
'constance_enabled': dj_settings.CONSTANCE_ENABLED,
'FILE_SERVER_ROOT': file_server_root,
'LOGIN_URL': dj_settings.LOGIN_URL,

1
seahub/settings.py
View File

@ -130,6 +130,7 @@ MIDDLEWARE_CLASSES = (
SITE_ROOT_URLCONF = 'seahub.urls'
ROOT_URLCONF = 'seahub.utils.rooturl'
SITE_ROOT = '/'
CSRF_COOKIE_NAME = 'sfcsrftoken'
# Python dotted path to the WSGI application used by Django's runserver.
WSGI_APPLICATION = 'seahub.wsgi.application'

6
seahub/templates/base.html
View File

@ -128,7 +128,11 @@
<button class="simplemodal-close">{% trans "No" %}</button>
</div>
</div><!-- wrapper -->
<script type="text/javascript">
var SEAFILE_GLOBAL = {
csrfCookieName: '{{ CSRF_COOKIE_NAME }}'
};
</script>
<script type="text/javascript" src="{% static "scripts/lib/jquery.min.js" %}" id="jquery"></script>{# 'id="jquery"' is for pdf file view with pdf2html #}
<script type="text/javascript" src="{% static "scripts/lib/jquery.simplemodal.js" %}"></script>
<script type="text/javascript" src="{% static "scripts/lib/jstree.min.js" %}"></script>

1
seahub/templates/base_for_backbone.html
View File

@ -120,6 +120,7 @@ var app = {
mediaUrl: '{{ MEDIA_URL }}',
siteRoot: '{{ SITE_ROOT }}',
loginUrl: '{{ LOGIN_URL }}',
csrfCookieName: '{{ CSRF_COOKIE_NAME }}',
fileServerRoot: '{{ FILE_SERVER_ROOT }}'
}
};

3
seahub/templates/sysadmin/sysadmin_backbone.html
View File

@ -79,7 +79,8 @@ var app = {
config: {
mediaUrl: '{{ MEDIA_URL }}',
siteRoot: '{{ SITE_ROOT }}',
loginUrl: '{{ LOGIN_URL }}'
loginUrl: '{{ LOGIN_URL }}',
csrfCookieName: '{{ CSRF_COOKIE_NAME }}'
}
};
app["pageOptions"] = {

5
seahub/templates/view_file_onlyoffice.html
View File

@ -15,6 +15,11 @@ html, body { padding:0; margin:0; height:100%; }
<div id="placeholder"></div>
{% get_current_language as LANGUAGE_CODE %}
<script type="text/javascript">
var SEAFILE_GLOBAL = {
csrfCookieName: '{{ CSRF_COOKIE_NAME }}'
};
</script>
<script type="text/javascript" src="{% static "scripts/lib/jquery.min.js" %}"></script>
<script type="text/javascript" src="{{ MEDIA_URL }}js/jq.min.js"></script>
<script type="text/javascript" src="{{ MEDIA_URL }}js/base.js"></script>

5
seahub/templates/view_file_wopi.html
View File

@ -38,6 +38,11 @@
<iframe id="office_frame" name="office_frame" class="hide" allowfullscreen ></iframe>
<script type="text/javascript">
var SEAFILE_GLOBAL = {
csrfCookieName: '{{ CSRF_COOKIE_NAME }}'
};
</script>
<script type="text/javascript" src="{% static "scripts/lib/jquery.min.js" %}"></script>
<script type="text/javascript" src="{{ MEDIA_URL }}js/jq.min.js"></script>
<script type="text/javascript" src="{{ MEDIA_URL }}js/base.js"></script>

2
static/scripts/common.js
View File

@ -530,7 +530,7 @@ define([
}
if (!(/^http:.*/.test(settings.url) || /^https:.*/.test(settings.url))) {
// Only send the token to relative URLs i.e. locally.
xhr.setRequestHeader("X-CSRFToken", getCookie('csrftoken'));
xhr.setRequestHeader("X-CSRFToken", getCookie(app.config.csrfCookieName));
}
},