fixed CSRF in admin enabled/disable. thanks Nerendra Bhati

2016-05-04 09:11:55 -05:00
parent 735d79c211
commit 4bd002aee9
5 changed files with 14 additions and 9 deletions
@@ -533,8 +533,8 @@ def delete():
        redirect(URL(sender, anchor=request.vars.id2))
    return dict(dialog=dialog, filename=filename)

-
 def enable():
+    if not URL.verify(request, hmac_key=session.hmac_key): raise HTTP(401)
    app = get_app()
    filename = os.path.join(apath(app, r=request), 'DISABLED')
    if is_gae: