Skip to contentSkip to conversation

Call csrf function in all pages to ensure cookie is sent

PATCH In review brian avery 3 participants 5 messages Aug 18, 2015 – Aug 19, 2015

lore
Share & tools
lore
#0 lore raw

cover Call csrf function in all pages to ensure cookie is sent

Simple addition of cross site request forgery protection to base page so it is inherited everywhere.

The following changes since commit c348fa50186fb0796bc7b793c4b8d710419f2a0d:

bitbake: toaster: move code from setup_lv_tests to setUp (2015-08-17 14:41:45 +0100)

are available in the git repository at:

git://git.yoctoproject.org/poky-contrib bavery/submit/michaelw/20150817_csrf_added_base
http://git.yoctoproject.org/cgit.cgi/poky-contrib/log/?h=bavery/submit/michaelw/20150817_csrf_added_base

Michael Wood (1):
bitbake: toastergui: Call csrf function in all pages to ensure cookie
is sent

 lib/toaster/toastergui/templates/base.html | 1 +
 1 file changed, 1 insertion(+)
Signature · 1 line
1.9.1
#1 lore raw

PATCH 1/1 bitbake: toastergui: Call csrf function in all pages to ensure cookie is sent

From: Michael Wood <[email protected]>

Not all pages call the csrf token template function so django does not bother to send the cookike, this meant that all subsequent ajax calls fail. So add this to the base template.

[YOCTO #8175]

---
 lib/toaster/toastergui/templates/base.html | 1 +
 1 file changed, 1 insertion(+)
lib/toaster/toastergui/templates/base.html +1 -0
index d75bf16..f187100 100644
@@ -69,6 +69,7 @@
 
 <body style="height: 100%">
 
+  {% csrf_token %}
   <div id="loading-notification" class="alert lead text-center" style="display:none">
     Loading <i class="fa-pulse icon-spinner"></i>
   </div>
Signature · 1 line
1.9.1
#2 lore raw

Re: [PATCH 1/1] bitbake: toastergui: Call csrf function in all pages to ensure cookie is sent

Quoted 11 lines · brian avery

From: Michael Wood <[email protected]>

Not all pages call the csrf token template function so django does not bother to send the cookike, this meant that all subsequent ajax calls fail. So add this to the base template.

[YOCTO #8175]

Patches sent to bitbake-devel shouldn't have the 'bitbake:' commit subject prefix, that's only appropriate in poky.

Signature · 5 lines
Christopher Larson
clarson at kergoth dot com
Founder - BitBake, OpenEmbedded, OpenZaurus
Maintainer - Tslib
Senior Software Engineer, Mentor Graphics
#3 lore raw

Re: [PATCH 1/1] bitbake: toastergui: Call csrf function in all pages to ensure cookie is sent

Noted for the future, sorry. Figured my 1st time would be entertaining :).

Should I resubmit?

-bavery

Quoted 22 lines · Christopher Larson
Quoted 11 lines · brian avery

From: Michael Wood <[email protected]>

Not all pages call the csrf token template function so django does not bother to send the cookike, this meant that all subsequent ajax calls fail. So add this to the base template.

[YOCTO #8175]

Patches sent to bitbake-devel shouldn't have the 'bitbake:' commit subject prefix, that's only appropriate in poky.
--
Christopher Larson
clarson at kergoth dot com
Founder - BitBake, OpenEmbedded, OpenZaurus
Maintainer - Tslib
Senior Software Engineer, Mentor Graphics

#4 lore raw

Re: [PATCH 1/1] bitbake: toastergui: Call csrf function in all pages to ensure cookie is sent

Quoted 3 lines · Brian Avery

Noted for the future, sorry. Figured my 1st time would be entertaining :).

Should I resubmit?

Er, I thought we already discussed this and you already did? There is another version of the patch on the list...

Cheers,

Richard