external/aurweb
0
0
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/aurweb.git synced 2025-02-03 10:43:03 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge branch 'feat-csrf-login-check' into pu

Browse source
This commit is contained in:
Kevin Morris 2021-11-15 12:00:07 -08:00
commit e3fff9e357
No known key found for this signature in database
GPG key ID: F7E46DED420788F3
3 changed files with 49 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

12
aurweb/routers/auth.py
View file

@ -1,13 +1,14 @@
from datetime import datetime
from http import HTTPStatus
from fastapi import APIRouter, Form, Request
from fastapi import APIRouter, Form, HTTPException, Request
from fastapi.responses import HTMLResponse, RedirectResponse
import aurweb.config
from aurweb import cookies
from aurweb.auth import auth_required
from aurweb.l10n import get_translator_for_request
from aurweb.models import User
from aurweb.templates import make_variable_context, render_template
@ -35,6 +36,15 @@ async def login_post(request: Request,
user: str = Form(default=str()),
passwd: str = Form(default=str()),
remember_me: bool = Form(default=False)):
# TODO: Once the Origin header gets broader adoption, this code can be
# slightly simplified to use it.
login_path = aurweb.config.get("options", "aur_location") + "/login"
referer = request.headers.get("Referer")
if not referer or not referer.startswith(login_path):
_ = get_translator_for_request(request)
raise HTTPException(status_code=HTTPStatus.BAD_REQUEST,
detail=_("Bad Referer header."))
from aurweb.db import session
user = session.query(User).filter(User.Username == user).first()