← Back to branch summary

~azzar1/unity/add-show-desktop-key

« back to all changes in this revision

Viewing changes to ivle/dispatch/__init__.py

  • Committer: William Grant
  • Date: 2010-02-23 08:08:27 UTC
  • Revision ID: grantw@unimelb.edu.au-20100223080827-wklsx122pcw79wi7
https://launchpad.net/bugs/525559
Reject off-site non-GET requests.

Show diffs side-by-side

added added

removed removed

Lines of Context:
ivle/dispatch/__init__.py
30
30
import os
31
31
import os.path
32
32
import urllib
 
33
import urlparse
33
34
import cgi
34
35
import traceback
35
36
import logging
44
45
import ivle.webapp.security
45
46
from ivle.webapp.base.plugins import ViewPlugin, PublicViewPlugin
46
47
from ivle.webapp.base.xhtml import XHTMLView, XHTMLErrorView
47
 
from ivle.webapp.errors import HTTPError, Unauthorized, NotFound
 
48
from ivle.webapp.errors import BadRequest, HTTPError, NotFound, Unauthorized
48
49
from ivle.webapp.publisher import Publisher, PublishingError
49
50
from ivle.webapp import ApplicationRoot
50
51
 
157
158
                    raise Unauthorized('Unauthorized: %s' % view)
158
159
                else:
159
160
                    raise Unauthorized()
 
161
 
 
162
            # Non-GET requests from other sites leave us vulnerable to
 
163
            # CSRFs. Block them.
 
164
            referer = req.headers_in.get('Referer')
 
165
            if (referer is None or
 
166
                urlparse.urlparse(req.headers_in.get('Referer')).netloc !=
 
167
                    req.hostname):
 
168
                if req.method != 'GET' and not view.offsite_posts_allowed:
 
169
                    raise BadRequest(
 
170
                        "Non-GET requests from external sites are forbidden "
 
171
                        "for security reasons.")
 
172
 
160
173
            # Render the output
161
174
            view.render(req)
162
175
        except HTTPError, e: