Ticket #1006: csrf-path-fix.diff

File csrf-path-fix.diff, 1.5 KB (added by Peter Kuma, 10 years ago)

  • mediagoblin/config_spec.ini 

    From dbd2c266b735c01548d63704d76525f08fff100c Mon Sep 17 00:00:00 2001
From: Peter Kuma <pkuma@pixelfederation.com>
Date: Fri, 24 Oct 2014 14:44:22 +0200
Subject: [PATCH] Fix CSRF cookie path

---
 mediagoblin/config_spec.ini    |    4 ++++
 mediagoblin/meddleware/csrf.py |    2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/mediagoblin/config_spec.ini b/mediagoblin/config_spec.ini
index dade842..7cb739a 100644
    a b allow_attachments = boolean(default=False)  
    8686# Cookie stuff
    8787csrf_cookie_name = string(default='mediagoblin_csrftoken')
    8888
     89# CSRF cookie path. Set to the path of your mediagoblin installation
     90# if not running under the root path of a domain.
     91csrf_cookie_path = string(default='/')
     92
    8993# Push stuff
    9094push_urls = string_list(default=list())
    9195

  • mediagoblin/meddleware/csrf.py 

    diff --git a/mediagoblin/meddleware/csrf.py b/mediagoblin/meddleware/csrf.py
index 6cad6fa..914e9ca 100644
    a b class CsrfMeddleware(BaseMeddleware):  
    105105        response.set_cookie(
    106106            mg_globals.app_config['csrf_cookie_name'],
    107107            request.environ['CSRF_TOKEN'],
    108             path=request.environ['SCRIPT_NAME'],
     108            path=mg_globals.app_config['csrf_cookie_path'],
    109109            domain=mg_globals.app_config.get('csrf_cookie_domain'),
    110110            secure=(request.scheme.lower() == 'https'),
    111111            httponly=True)