From d3925f371b99a90752900b385c378351aced800d Mon Sep 17 00:00:00 2001
From: mdipierro <massimo.dipierro@gmail.com>
Date: Tue, 17 Jul 2012 18:01:58 -0500
Subject: [PATCH] extra crsf protection for admin

---
 VERSION                             | 2 +-
 applications/admin/models/access.py | 9 ++++++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/VERSION b/VERSION
index 0c7e0cde..81a434d1 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-Version 2.00.0 (2012-07-17 17:32:31) dev
+Version 2.00.0 (2012-07-17 18:01:46) dev
diff --git a/applications/admin/models/access.py b/applications/admin/models/access.py
index 633d739e..de6219b9 100644
--- a/applications/admin/models/access.py
+++ b/applications/admin/models/access.py
@@ -2,6 +2,7 @@ import base64, os, time
 from gluon import portalocker
 from gluon.admin import apath
 from gluon.fileutils import read_file
+from gluon.utils import web2py_uuid
 # ###########################################################
 # ## make sure administrator is on localhost or https
 # ###########################################################
@@ -152,5 +153,11 @@ if request.controller=='appadmin' and DEMO_MODE:
     session.flash = 'Appadmin disabled in demo mode'
     redirect(URL('default','sites'))
 
-
+# extra protection, csrf protection for every admin interaction
+response.cookies['token'] = session.token = session.token or web2py_uuid()
+if request.post_vars and not (
+    'token' in request.cookies and 
+    request.cookies['token'].value == session.token):
+    raise HTTP(401,"Not Authorized")
+# end extra secruity measures