ticketfrei
/
ticketfrei
10
1
Fork 1
Code Issues Pull Requests 1 Releases Wiki Activity

give CSRF token to template engine

master
b3yond 2019-01-27 15:56:19 +01:00
parent d0feecc9b2
commit 9e6e8aadfe
1 changed files with 12 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
user.py
View File

@ -1,5 +1,5 @@
from config import config from config import config
from bottle import response from bottle import response, request
from db import db from db import db
import jwt import jwt
from mastodon import Mastodon from mastodon import Mastodon
@ -11,10 +11,15 @@ class User(object):
def __init__(self, uid): def __init__(self, uid):
# set cookie # set cookie
response.set_cookie('uid', uid, secret=db.get_secret(), path='/') response.set_cookie('uid', uid, secret=db.get_secret(), path='/')
allchar = "1234567890"
response.set_cookie('csrf', "".join(choice(allchar) for x in [32]),
db.get_secret(), path='/')
self.uid = uid self.uid = uid
response.set_cookie('csrf', self.get_csrf(), db.get_secret(), path='/')
def get_csrf(self):
csrf_token = request.get_cookie('csrf')
if not csrf_token:
allchar = "1234567890"
csrf_token = "".join(choice(allchar) for x in [32])
return csrf_token
def check_password(self, password): def check_password(self, password):
db.execute("SELECT passhash FROM user WHERE id=?;", (self.uid,)) db.execute("SELECT passhash FROM user WHERE id=?;", (self.uid,))
@ -239,6 +244,7 @@ schlitz
# - mail_md # - mail_md
# - goodlist # - goodlist
# - blocklist # - blocklist
# - csrf
# - logged in with twitter? # - logged in with twitter?
# - logged in with mastodon? # - logged in with mastodon?
# - enabled? # - enabled?
@ -248,7 +254,8 @@ schlitz
mail_md=citydict['mail_md'], mail_md=citydict['mail_md'],
triggerwords=self.get_trigger_words(), triggerwords=self.get_trigger_words(),
badwords=self.get_badwords(), badwords=self.get_badwords(),
enabled=self.enabled) enabled=self.enabled,
csrf=self.get_csrf())
def save_request_token(self, token): def save_request_token(self, token):
db.execute("""INSERT INTO db.execute("""INSERT INTO