a3x/nyaa
1
0
Fork 0
mirror of https://gitlab.com/SIGBUS/nyaa.git synced 2024-12-22 14:30:01 +00:00
Code Issues Projects Releases Wiki Activity

Re-enable CSRF token for upload & fix API CSRF handling

Browse source
This commit is contained in:
TheAMM 2017-05-22 16:28:06 +03:00
parent efb44724e1
commit a1c024a342
3 changed files with 4 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
nyaa/api_handler.py
View file

@ -104,7 +104,7 @@ def api_upload(upload_request, user):
return flask.make_response(flask.jsonify(
{'Failure': ['No torrent file was attached.']}), 400)
form = forms.UploadForm(CombinedMultiDict((torrent_file, form_info)))
form = forms.UploadForm(CombinedMultiDict((torrent_file, form_info)), csrf_enabled=False)
form.category.choices = _create_upload_category_choices()
if upload_request.method == 'POST' and form.validate():
@ -166,7 +166,7 @@ def v2_api_upload():
mapped_dict[mapped_key] = request_data.get(key) or ''
# Flask-WTF (very helpfully!!) automatically grabs the request form, so force a None formdata
upload_form = forms.UploadForm(None, data=mapped_dict)
upload_form = forms.UploadForm(None, data=mapped_dict, csrf_enabled=False)
upload_form.category.choices = _create_upload_category_choices()
if upload_form.validate():

3
nyaa/forms.py
View file

@ -166,9 +166,6 @@ class EditForm(FlaskForm):
class UploadForm(FlaskForm):
class Meta:
csrf = False
torrent_file = FileField('Torrent file', [
FileRequired()

2
nyaa/templates/upload.html
View file

@ -14,6 +14,8 @@
<div id="upload-drop-zone"><span>Drop here!</span></div>
<form method="POST" enctype="multipart/form-data">
{{ upload_form.csrf_token }}
{% if config.ENFORCE_MAIN_ANNOUNCE_URL %}<p><strong>Important:</strong> Please include <kbd>{{ config.MAIN_ANNOUNCE_URL }}</kbd> in your trackers</p>{% endif %}
<div class="row">
<div class="col-md-6">