Mailing-List: contact allura-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: allura-dev@incubator.apache.org
Received-SPF: pass (athena.apache.org: domain of noreply@sourceforge.net
 designates 216.34.181.60 as permitted sender)
Content-Type: multipart/related;
 boundary="===============2382246877695870339=="
MIME-Version: 1.0
To: "[allura:tickets] " <5475@tickets.allura.p.re.sf.net>
From: "Dave Brondsema" <brondsem@users.sf.net>
Reply-To: "[allura:tickets] " <5475@tickets.allura.p.re.sf.net>
Subject: [allura:tickets] #5475 Move CSRF token insertion from JS to
 easywidgets
Message-ID: 
 </p/allura/tickets/5475/ffef6d70c5211eb77ffce981b58961439bc87c41.tickets@allura.p.sourceforge.net>
In-Reply-To: <50cf8e2d1be1ce5545da56b8.tickets@allura.p.sourceforge.net>
References: <50cf8e2d1be1ce5545da56b8.tickets@allura.p.sourceforge.net>
Date: Thu, 31 Oct 2013 19:17:08 +0000

--===============2382246877695870339==
Content-Type: multipart/alternative;
 boundary="===============2464242375178218133=="
MIME-Version: 1.0

--===============2464242375178218133==
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit

- **summary**: Provide non-javascript fallback behavior --> Move CSRF token insertion from JS to easywidgets
- Description has changed:

Diff:

~~~~

--- old
+++ new
@@ -1,3 +1,5 @@
-Site functions should continue to work with Javascript disabled.
+Standard forms across on Allura have a `_session_id` field inserted by JS.  AJAX forms insert it themselves.  This is for CSRF protection.
 
-Ref: [forge:site-support:#2017]
+For the standard forms, we can make them work without JS by inserting the field server-side instead of client-side.  The `ForgeForm` class seems like a useful place to do this.  Other manually-constructed forms (e.g. I know ForgeImporter templates have some, others are around too probably) will need it in the jinja template.  A one-line macro seems like a good way to handle that.
+
+AJAX forms can stay as-is, they use JS already anyway.

~~~~


---

** [tickets:#5475] Move CSRF token insertion from JS to easywidgets**

**Status:** open
**Labels:** support p3 
**Created:** Mon Dec 17, 2012 09:27 PM UTC by Rich Bowen
**Last Updated:** Wed Apr 24, 2013 01:18 PM UTC
**Owner:** nobody

Standard forms across on Allura have a `_session_id` field inserted by JS.  AJAX forms insert it themselves.  This is for CSRF protection.

For the standard forms, we can make them work without JS by inserting the field server-side instead of client-side.  The `ForgeForm` class seems like a useful place to do this.  Other manually-constructed forms (e.g. I know ForgeImporter templates have some, others are around too probably) will need it in the jinja template.  A one-line macro seems like a good way to handle that.

AJAX forms can stay as-is, they use JS already anyway.


---

Sent from sourceforge.net because allura-dev@incubator.apache.org is subscribed to https://sourceforge.net/p/allura/tickets/

To unsubscribe from further messages, a project admin can change settings at https://sourceforge.net/p/allura/admin/tickets/options.  Or, if this is a mailing list, you can unsubscribe from the mailing list.
--===============2464242375178218133==
MIME-Version: 1.0
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: 7bit

<div class="markdown_content"><ul>
<li><strong>summary</strong>: Provide non-javascript fallback behavior --&gt; Move CSRF token insertion from JS to easywidgets</li>
<li>Description has changed:</li>
</ul>
<p>Diff:</p>
<div class="codehilite"><pre><span class="gd">--- old</span>
<span class="gi">+++ new</span>
<span class="gu">@@ -1,3 +1,5 @@</span>
<span class="gd">-Site functions should continue to work with Javascript disabled.</span>
<span class="gi">+Standard forms across on Allura have a `_session_id` field inserted by JS.  AJAX forms insert it themselves.  This is for CSRF protection.</span>

<span class="gd">-Ref: [forge:site-support:#2017]</span>
<span class="gi">+For the standard forms, we can make them work without JS by inserting the field server-side instead of client-side.  The `ForgeForm` class seems like a useful place to do this.  Other manually-constructed forms (e.g. I know ForgeImporter templates have some, others are around too probably) will need it in the jinja template.  A one-line macro seems like a good way to handle that.</span>
<span class="gi">+</span>
<span class="gi">+AJAX forms can stay as-is, they use JS already anyway.</span>
</pre></div>
<hr />
<p><strong> <a class="alink" href="http://sourceforge.net/p/allura/tickets/5475/">[tickets:#5475]</a> Move CSRF token insertion from JS to easywidgets</strong></p>
<p><strong>Status:</strong> open<br />
<strong>Labels:</strong> support p3 <br />
<strong>Created:</strong> Mon Dec 17, 2012 09:27 PM UTC by Rich Bowen<br />
<strong>Last Updated:</strong> Wed Apr 24, 2013 01:18 PM UTC<br />
<strong>Owner:</strong> nobody</p>
<p>Standard forms across on Allura have a <code>_session_id</code> field inserted by JS.  AJAX forms insert it themselves.  This is for CSRF protection.</p>
<p>For the standard forms, we can make them work without JS by inserting the field server-side instead of client-side.  The <code>ForgeForm</code> class seems like a useful place to do this.  Other manually-constructed forms (e.g. I know ForgeImporter templates have some, others are around too probably) will need it in the jinja template.  A one-line macro seems like a good way to handle that.</p>
<p>AJAX forms can stay as-is, they use JS already anyway.</p>
<hr />
<p>Sent from sourceforge.net because allura-dev@incubator.apache.org is subscribed to <a href="https://sourceforge.net/p/allura/tickets/">https://sourceforge.net/p/allura/tickets/</a></p>
<p>To unsubscribe from further messages, a project admin can change settings at <a href="https://sourceforge.net/p/allura/admin/tickets/options.">https://sourceforge.net/p/allura/admin/tickets/options.</a>  Or, if this is a mailing list, you can unsubscribe from the mailing list.</p></div>
--===============2464242375178218133==--

--===============2382246877695870339==--