nik/FreedomBox
1
0
Fork 0
mirror of https://github.com/freedombox/FreedomBox.git synced 2026-08-26 12:46:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

network: CSRF check for (de)activating connections

Browse Source 
Fixes issue #127
Network manager: fix CSRF when activating/deactivating network connections
https://github.com/freedombox/Plinth/issues/127
This commit is contained in:
Sean Alexandre 2015-09-02 21:39:03 -04:00 committed by Sunil Mohan Adapa
parent 09fa98f8b1
commit d14f077608
2 changed files with 50 additions and 33 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
plinth/modules/networks/networks.py
View File

@ -19,6 +19,7 @@ from django.contrib import messages
from django.core.urlresolvers import reverse_lazy from django.core.urlresolvers import reverse_lazy
from django.shortcuts import redirect from django.shortcuts import redirect
from django.template.response import TemplateResponse from django.template.response import TemplateResponse
from django.views.decorators.http import require_POST
from gettext import gettext as _ from gettext import gettext as _
from logging import Logger from logging import Logger
@ -167,6 +168,7 @@ def edit(request, uuid):
'form': form}) 'form': form})
@require_POST
def activate(request, uuid): def activate(request, uuid):
"""Activate the connection.""" """Activate the connection."""
try: try:
@ -184,6 +186,7 @@ def activate(request, uuid):
return redirect(reverse_lazy('networks:index')) return redirect(reverse_lazy('networks:index'))
@require_POST
def deactivate(request, uuid): def deactivate(request, uuid):
"""Deactivate the connection.""" """Deactivate the connection."""
try: try:

80
plinth/modules/networks/templates/connections_list.html
View File

@ -23,15 +23,23 @@
{% block page_head %} {% block page_head %}
<style type="text/css"> <style type="text/css">
.connection-edit-label { .connection-edit-label {
display: inline-block; display: inline-block;
width: 40%; width: 40%;
} }
.connection-type-label { .connection-type-label {
display: inline-block; display: inline-block;
width: 20%; width: 20%;
} }
.list-group-item .btn { .list-group-item .btn {
margin: -5px 0; margin: -5px 0;
}
.dropdown-menu .btn {
background: none;
width: 100%;
text-align: left;
} }
</style> </style>
{% endblock %} {% endblock %}
@ -59,35 +67,41 @@
<span class="connection-type-label">{{ connection.type }}</span> <span class="connection-type-label">{{ connection.type }}</span>
{% if connection.is_active %} {% if connection.is_active %}
<div class="btn-group"> <div class="btn-group">
<button type="button" <button type="button"
class="btn btn-success btn-xs dropdown-toggle" class="btn btn-success btn-xs dropdown-toggle"
data-toggle="dropdown" aria-expanded="false"> data-toggle="dropdown" aria-expanded="false">
Active <span class="caret"></span> Active <span class="caret"></span>
</button> </button>
<ul class="dropdown-menu" role="menu"> <ul class="dropdown-menu" role="menu">
<li> <li>
<a href="{% url 'networks:deactivate' connection.uuid %}"> <form name="toggle_form" id="toggle_form" class="form" method="post"
Deactivate action="{% url 'networks:deactivate' connection.uuid %}">
</a> {% csrf_token %}
</li>
</ul> <button type="submit" class="btn">Deactivate</button>
</div> </form>
</li>
</ul>
</div>
{% else %} {% else %}
<div class="btn-group"> <div class="btn-group">
<button type="button" <button type="button"
class="btn btn-warning btn-xs dropdown-toggle" class="btn btn-warning btn-xs dropdown-toggle"
data-toggle="dropdown" aria-expanded="false"> data-toggle="dropdown" aria-expanded="false">
Not Active <span class="caret"></span> Not Active <span class="caret"></span>
</button> </button>
<ul class="dropdown-menu" role="menu"> <ul class="dropdown-menu" role="menu">
<li> <li>
<a href="{% url 'networks:activate' connection.uuid %}"> <form name="toggle_form" id="toggle_form" class="form" method="post"
Activate action="{% url 'networks:activate' connection.uuid %}">
</a> {% csrf_token %}
</li>
</ul> <button type="submit" class="btn">Activate</button>
</div> </form>
</li>
</ul>
</div>
{% endif %} {% endif %}
</div> </div>