diff --git a/rhodecode/lib/helpers.py b/rhodecode/lib/helpers.py --- a/rhodecode/lib/helpers.py +++ b/rhodecode/lib/helpers.py @@ -1906,13 +1906,18 @@ def secure_form(url, method="POST", mult """ from webhelpers.pylonslib.secure_form import insecure_form form = insecure_form(url, method, multipart, **attrs) - token = csrf_input() + + session = None + # TODO(marcink): after pyramid migration require request variable ALWAYS + if 'request' in attrs: + session = attrs['request'].session + + token = literal( + ''.format( + csrf_token_key, csrf_token_key, get_csrf_token(session))) + return literal("%s\n%s" % (form, token)) -def csrf_input(): - return literal( - ''.format( - csrf_token_key, csrf_token_key, get_csrf_token())) def dropdownmenu(name, selected, options, enable_filter=False, **attrs): select_html = select(name, selected, options, **attrs) diff --git a/rhodecode/model/forms.py b/rhodecode/model/forms.py --- a/rhodecode/model/forms.py +++ b/rhodecode/model/forms.py @@ -49,6 +49,7 @@ from pkg_resources import resource_filen from formencode import All, Pipe from pylons.i18n.translation import _ +from pyramid.threadlocal import get_current_request from rhodecode import BACKENDS from rhodecode.lib import helpers @@ -66,6 +67,7 @@ class RhodecodeFormZPTRendererFactory(de """ Subclass of ZPTRendererFactory to add rhodecode context variables """ def __call__(self, template_name, **kw): kw['h'] = helpers + kw['request'] = get_current_request() return self.load(template_name)(**kw) diff --git a/rhodecode/templates/admin/auth/auth_settings.mako b/rhodecode/templates/admin/auth/auth_settings.mako --- a/rhodecode/templates/admin/auth/auth_settings.mako +++ b/rhodecode/templates/admin/auth/auth_settings.mako @@ -38,7 +38,7 @@
- ${h.secure_form(request.resource_path(resource, route_name='auth_home'))} + ${h.secure_form(request.resource_path(resource, route_name='auth_home'), request=request)}
diff --git a/rhodecode/templates/admin/auth/plugin_settings.mako b/rhodecode/templates/admin/auth/plugin_settings.mako --- a/rhodecode/templates/admin/auth/plugin_settings.mako +++ b/rhodecode/templates/admin/auth/plugin_settings.mako @@ -47,7 +47,7 @@
- ${h.secure_form(request.resource_path(resource, route_name='auth_home'))} + ${h.secure_form(request.resource_path(resource, route_name='auth_home'), request=request)}
%for node in plugin.get_settings_schema(): diff --git a/rhodecode/templates/admin/gists/edit.mako b/rhodecode/templates/admin/gists/edit.mako --- a/rhodecode/templates/admin/gists/edit.mako +++ b/rhodecode/templates/admin/gists/edit.mako @@ -26,7 +26,7 @@
- ${h.secure_form(h.route_path('gist_update', gist_id=c.gist.gist_access_id), id='eform', method='POST')} + ${h.secure_form(h.route_path('gist_update', gist_id=c.gist.gist_access_id), id='eform', method='POST', request=request)}
diff --git a/rhodecode/templates/admin/gists/show.mako b/rhodecode/templates/admin/gists/show.mako --- a/rhodecode/templates/admin/gists/show.mako +++ b/rhodecode/templates/admin/gists/show.mako @@ -45,7 +45,7 @@
%if h.HasPermissionAny('hg.admin')() or c.gist.gist_owner == c.rhodecode_user.user_id:
- ${h.secure_form(h.route_path('gist_delete', gist_id=c.gist.gist_access_id), method='POST')} + ${h.secure_form(h.route_path('gist_delete', gist_id=c.gist.gist_access_id), method='POST', request=request)} ${h.submit('remove_gist', _('Delete'),class_="btn btn-mini btn-danger",onclick="return confirm('"+_('Confirm to delete this Gist')+"');")} ${h.end_form()}
diff --git a/rhodecode/templates/admin/my_account/my_account_auth_tokens.mako b/rhodecode/templates/admin/my_account/my_account_auth_tokens.mako --- a/rhodecode/templates/admin/my_account/my_account_auth_tokens.mako +++ b/rhodecode/templates/admin/my_account/my_account_auth_tokens.mako @@ -42,7 +42,7 @@ %endif - ${h.secure_form(h.route_path('my_account_auth_tokens_delete'), method='post')} + ${h.secure_form(h.route_path('my_account_auth_tokens_delete'), method='POST', request=request)} ${h.hidden('del_auth_token', auth_token.user_api_key_id)}
- ${h.secure_form(h.route_path('my_account_auth_tokens_add'), method='post')} + ${h.secure_form(h.route_path('my_account_auth_tokens_add'), method='POST', request=request)}
diff --git a/rhodecode/templates/admin/my_account/my_account_emails.mako b/rhodecode/templates/admin/my_account/my_account_emails.mako --- a/rhodecode/templates/admin/my_account/my_account_emails.mako +++ b/rhodecode/templates/admin/my_account/my_account_emails.mako @@ -25,7 +25,7 @@ - ${h.secure_form(h.route_path('my_account_emails_delete'), method='POST')} + ${h.secure_form(h.route_path('my_account_emails_delete'), method='POST', request=request)} ${h.hidden('del_email_id',em.email_id)}
- ${h.secure_form(h.route_path('my_account_emails_add'), method='POST')} + ${h.secure_form(h.route_path('my_account_emails_add'), method='POST', request=request)}
diff --git a/rhodecode/templates/admin/my_account/my_account_profile_edit.mako b/rhodecode/templates/admin/my_account/my_account_profile_edit.mako --- a/rhodecode/templates/admin/my_account/my_account_profile_edit.mako +++ b/rhodecode/templates/admin/my_account/my_account_profile_edit.mako @@ -6,7 +6,7 @@
- ${h.secure_form(h.route_path('my_account_update'), class_='form', method='POST')} + ${h.secure_form(h.route_path('my_account_update'), class_='form', method='POST', request=request)} <% readonly = None %> <% disabled = "" %> diff --git a/rhodecode/templates/admin/permissions/permissions_ips.mako b/rhodecode/templates/admin/permissions/permissions_ips.mako --- a/rhodecode/templates/admin/permissions/permissions_ips.mako +++ b/rhodecode/templates/admin/permissions/permissions_ips.mako @@ -20,7 +20,7 @@
${h.ip_range(ip.ip_addr)}
${ip.description}
- ${h.secure_form(h.route_path('edit_user_ips_delete', user_id=c.user.user_id), method='POST')} + ${h.secure_form(h.route_path('edit_user_ips_delete', user_id=c.user.user_id), method='POST', request=request)} ${h.hidden('del_ip_id',ip.ip_id)} ${h.hidden('default_user', 'True')} ${h.submit('remove_',_('Delete'),id="remove_ip_%s" % ip.ip_id, @@ -40,7 +40,7 @@
- ${h.secure_form(h.route_path('edit_user_ips_add', user_id=c.user.user_id), method='POST')} + ${h.secure_form(h.route_path('edit_user_ips_add', user_id=c.user.user_id), method='POST', request=request)}
diff --git a/rhodecode/templates/admin/repos/repo_edit_advanced.mako b/rhodecode/templates/admin/repos/repo_edit_advanced.mako --- a/rhodecode/templates/admin/repos/repo_edit_advanced.mako +++ b/rhodecode/templates/admin/repos/repo_edit_advanced.mako @@ -24,7 +24,7 @@

${_('Fork Reference')}

- ${h.secure_form(h.route_path('edit_repo_advanced_fork', repo_name=c.repo_info.repo_name), method='POST')} + ${h.secure_form(h.route_path('edit_repo_advanced_fork', repo_name=c.repo_info.repo_name), method='POST', request=request)} % if c.repo_info.fork:
${h.literal(_('This repository is a fork of %(repo_link)s') % {'repo_link': h.link_to_if(c.has_origin_repo_read_perm,c.repo_info.fork.repo_name, h.route_path('repo_summary', repo_name=c.repo_info.fork.repo_name))})} @@ -48,7 +48,7 @@

${_('Public Journal Visibility')}

- ${h.secure_form(h.route_path('edit_repo_advanced_journal', repo_name=c.repo_info.repo_name), method='POST')} + ${h.secure_form(h.route_path('edit_repo_advanced_journal', repo_name=c.repo_info.repo_name), method='POST', request=request)}
%if c.in_public_journal:
- ${h.secure_form(h.route_path('edit_repo_advanced_locking', repo_name=c.repo_info.repo_name), method='POST')} + ${h.secure_form(h.route_path('edit_repo_advanced_locking', repo_name=c.repo_info.repo_name), method='POST', request=request)} %if c.repo_info.locked[0]:
${'Locked by %s on %s. Lock reason: %s' % (h.person_by_id(c.repo_info.locked[0]), @@ -113,7 +113,7 @@

${_('Delete repository')}

- ${h.secure_form(h.route_path('edit_repo_advanced_delete', repo_name=c.repo_name), method='POST')} + ${h.secure_form(h.route_path('edit_repo_advanced_delete', repo_name=c.repo_name), method='POST', request=request)}
diff --git a/rhodecode/templates/admin/repos/repo_edit_caches.mako b/rhodecode/templates/admin/repos/repo_edit_caches.mako --- a/rhodecode/templates/admin/repos/repo_edit_caches.mako +++ b/rhodecode/templates/admin/repos/repo_edit_caches.mako @@ -14,7 +14,7 @@

- ${h.secure_form(h.route_path('edit_repo_caches', repo_name=c.repo_name), method='POST')} + ${h.secure_form(h.route_path('edit_repo_caches', repo_name=c.repo_name), method='POST', request=request)}
${h.submit('reset_cache_%s' % c.repo_info.repo_name,_('Invalidate repository cache'),class_="btn btn-small",onclick="return confirm('"+_('Confirm to invalidate repository cache')+"');")} diff --git a/rhodecode/templates/admin/repos/repo_edit_permissions.mako b/rhodecode/templates/admin/repos/repo_edit_permissions.mako --- a/rhodecode/templates/admin/repos/repo_edit_permissions.mako +++ b/rhodecode/templates/admin/repos/repo_edit_permissions.mako @@ -5,7 +5,7 @@

${_('Repository Permissions')}

- ${h.secure_form(h.route_path('edit_repo_perms', repo_name=c.repo_name), method='POST')} + ${h.secure_form(h.route_path('edit_repo_perms', repo_name=c.repo_name), method='POST', request=request)} diff --git a/rhodecode/templates/admin/repos/repo_edit_settings.mako b/rhodecode/templates/admin/repos/repo_edit_settings.mako --- a/rhodecode/templates/admin/repos/repo_edit_settings.mako +++ b/rhodecode/templates/admin/repos/repo_edit_settings.mako @@ -6,7 +6,7 @@

${_('Settings for Repository: %s') % c.rhodecode_db_repo.repo_name}

- ${h.secure_form(h.route_path('edit_repo', repo_name=c.rhodecode_db_repo.repo_name), method='POST')} + ${h.secure_form(h.route_path('edit_repo', repo_name=c.rhodecode_db_repo.repo_name), method='POST', request=request)}
diff --git a/rhodecode/templates/admin/repos/repo_edit_strip.mako b/rhodecode/templates/admin/repos/repo_edit_strip.mako --- a/rhodecode/templates/admin/repos/repo_edit_strip.mako +++ b/rhodecode/templates/admin/repos/repo_edit_strip.mako @@ -9,7 +9,7 @@ ${_('In the first step commits will be verified for existance in the repository')}.
${_('In the second step, correct commits will be available for stripping')}.

- ${h.secure_form(h.route_path('strip_check', repo_name=c.repo_info.repo_name), method='post')} + ${h.secure_form(h.route_path('strip_check', repo_name=c.repo_info.repo_name), method='POST', request=request)}
${_('Cleanup Old Sessions')}
- ${h.secure_form(h.route_path('admin_settings_sessions_cleanup'), method='post')} + ${h.secure_form(h.route_path('admin_settings_sessions_cleanup'), method='POST', request=request)}

${_('Cleanup user sessions that were not active during chosen time frame.')}
diff --git a/rhodecode/templates/admin/users/user_edit_auth_tokens.mako b/rhodecode/templates/admin/users/user_edit_auth_tokens.mako --- a/rhodecode/templates/admin/users/user_edit_auth_tokens.mako +++ b/rhodecode/templates/admin/users/user_edit_auth_tokens.mako @@ -38,7 +38,7 @@ %endif

${_('None')} - ${h.secure_form(h.route_path('edit_user_auth_tokens_delete', user_id=c.user.user_id), method='POST')} + ${h.secure_form(h.route_path('edit_user_auth_tokens_delete', user_id=c.user.user_id), method='POST', request=request)} ${h.hidden('del_auth_token', auth_token.user_api_key_id)} - ${h.secure_form(h.route_path('edit_user_emails_delete', user_id=c.user.user_id), method='POST')} + ${h.secure_form(h.route_path('edit_user_emails_delete', user_id=c.user.user_id), method='POST', request=request)} ${h.hidden('del_email_id', em.email_id)}
- ${h.secure_form(h.route_path('edit_user_emails_add', user_id=c.user.user_id), method='POST')} + ${h.secure_form(h.route_path('edit_user_emails_add', user_id=c.user.user_id), method='POST', request=request)}
diff --git a/rhodecode/templates/admin/users/user_edit_groups.mako b/rhodecode/templates/admin/users/user_edit_groups.mako --- a/rhodecode/templates/admin/users/user_edit_groups.mako +++ b/rhodecode/templates/admin/users/user_edit_groups.mako @@ -19,7 +19,7 @@
- ${h.secure_form(h.route_path('edit_user_groups_management_updates', user_id=c.user.user_id), method='post')} + ${h.secure_form(h.route_path('edit_user_groups_management_updates', user_id=c.user.user_id), method='POST', request=request)}
diff --git a/rhodecode/templates/admin/users/user_edit_ips.mako b/rhodecode/templates/admin/users/user_edit_ips.mako --- a/rhodecode/templates/admin/users/user_edit_ips.mako +++ b/rhodecode/templates/admin/users/user_edit_ips.mako @@ -30,7 +30,7 @@
${h.ip_range(ip.ip_addr)}
${ip.description}
 - ${h.secure_form(h.route_path('edit_user_ips_delete', user_id=c.user.user_id), method='POST')} + ${h.secure_form(h.route_path('edit_user_ips_delete', user_id=c.user.user_id), method='POST', request=request)} ${h.hidden('del_ip_id', ip.ip_id)} ${h.submit('remove_', _('Delete'),id="remove_ip_%s" % ip.ip_id, class_="btn btn-link btn-danger", onclick="return confirm('"+_('Confirm to delete this ip: %s') % ip.ip_addr+"');")} @@ -51,7 +51,7 @@
- ${h.secure_form(h.route_path('edit_user_ips_add', user_id=c.user.user_id), method='POST')} + ${h.secure_form(h.route_path('edit_user_ips_add', user_id=c.user.user_id), method='POST', request=request)}
diff --git a/rhodecode/templates/base/base.mako b/rhodecode/templates/base/base.mako --- a/rhodecode/templates/base/base.mako +++ b/rhodecode/templates/base/base.mako @@ -348,7 +348,7 @@
  • ${h.link_to(_(u'My personal group'), h.route_path('repo_group_home', repo_group_name=c.rhodecode_user.personal_repo_group.group_name))}
    • % endif
  • - ${h.secure_form(h.route_path('logout'))} + ${h.secure_form(h.route_path('logout'), request=request)} ${h.submit('log_out', _(u'Sign Out'),class_="btn btn-primary")} ${h.end_form()}
    • diff --git a/rhodecode/templates/data_table/_dt_elements.mako b/rhodecode/templates/data_table/_dt_elements.mako --- a/rhodecode/templates/data_table/_dt_elements.mako +++ b/rhodecode/templates/data_table/_dt_elements.mako @@ -119,7 +119,7 @@ Edit
    - ${h.secure_form(h.route_path('edit_repo_advanced_delete', repo_name=repo_name), method='POST')} + ${h.secure_form(h.route_path('edit_repo_advanced_delete', repo_name=repo_name), method='POST', request=request)} ${h.submit('remove_%s' % repo_name,_('Delete'),class_="btn btn-link btn-danger", onclick="return confirm('"+_('Confirm to delete this repository: %s') % repo_name+"');")} ${h.end_form()} diff --git a/rhodecode/templates/forms/form.pt b/rhodecode/templates/forms/form.pt --- a/rhodecode/templates/forms/form.pt +++ b/rhodecode/templates/forms/form.pt @@ -27,7 +27,7 @@ ${title} - +