dinislage/web2py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

made form session logic backward compatible

Browse Source
This commit is contained in:
Massimo
2013-09-26 13:35:39 -05:00
parent 09ba525f2e
commit 633acffd28
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
VERSION
+1 -1
View File
@@ -1 +1 @@
Version 2.6.4-stable+timestamp.2013.09.26.11.24.52 Version 2.6.4-stable+timestamp.2013.09.26.13.34.47
gluon/html.py
+3 -3
View File
@@ -2019,9 +2019,9 @@ class FORM(DIV):
if session is not None: if session is not None:
formkey = request_vars._formkey formkey = request_vars._formkey
keyname = '_formkey[%s]' % formname keyname = '_formkey[%s]' % formname
formkeys = session.get(keyname, []) formkeys = list(session.get(keyname, []))
# check if user tampering with form and void CSRF # check if user tampering with form and void CSRF
if not formkeys or formkey not in formkeys: if not (formkey and formkeys and formkey in formkeys):
status = False status = False
else: else:
session[keyname].remove(formkey) session[keyname].remove(formkey)
@@ -2062,7 +2062,7 @@ class FORM(DIV):
formkey = web2py_uuid() formkey = web2py_uuid()
self.formkey = formkey self.formkey = formkey
keyname = '_formkey[%s]' % formname keyname = '_formkey[%s]' % formname
session[keyname] = session.get(keyname,[])[-9:] + [formkey] session[keyname] = list(session.get(keyname,[]))[-9:] + [formkey]
if status and not keepvalues: if status and not keepvalues:
self._traverse(False, hideerror) self._traverse(False, hideerror)
self.accepted = status self.accepted = status