dinislage/web2py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

possible fix to issue 1688, support for multiple forms with same formname in different browser pages

Browse Source
This commit is contained in:
Massimo
2013-09-26 11:26:08 -05:00
parent a8cbb1590d
commit 09ba525f2e
2 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
VERSION
+1 -1
View File
@@ -1 +1 @@
Version 2.6.4-stable+timestamp.2013.09.26.07.55.44 Version 2.6.4-stable+timestamp.2013.09.26.11.24.52
gluon/html.py
+9 -3
View File
@@ -2017,10 +2017,14 @@ class FORM(DIV):
changed = False changed = False
request_vars = self.request_vars request_vars = self.request_vars
if session is not None: if session is not None:
formkey = session.get('_formkey[%s]' % formname, None) formkey = request_vars._formkey
keyname = '_formkey[%s]' % formname
formkeys = session.get(keyname, [])
# check if user tampering with form and void CSRF # check if user tampering with form and void CSRF
if not formkey or formkey != request_vars._formkey: if not formkeys or formkey not in formkeys:
status = False status = False
else:
session[keyname].remove(formkey)
if formname != request_vars._formname: if formname != request_vars._formname:
status = False status = False
if status and session: if status and session:
@@ -2056,7 +2060,9 @@ class FORM(DIV):
formkey = self.record_hash formkey = self.record_hash
else: else:
formkey = web2py_uuid() formkey = web2py_uuid()
self.formkey = session['_formkey[%s]' % formname] = formkey self.formkey = formkey
keyname = '_formkey[%s]' % formname
session[keyname] = session.get(keyname,[])[-9:] + [formkey]
if status and not keepvalues: if status and not keepvalues:
self._traverse(False, hideerror) self._traverse(False, hideerror)
self.accepted = status self.accepted = status