Only add CSRF protect for upload view

[ar-anvd]

Hello,

Using the current setup of the docs, the csrf protection will apply to the every form and every post of the app, this config ideally should apply only to the upload of dropzone, not the entire app.

[greyli]

Hi, you will need to handle this by yourself since the extension CSRFProtect default to enable CSRF check for all POST requests. The solution will be like this:

from flask import request

app.config['WTF_CSRF_CHECK_DEFAULT'] = False  # disable all check

@app.before_request
def check_csrf():
    if request.endpoint == 'your-upload-view-func-name':  # only protect your upload endpoint
        csrf.protect()

Find more info on it's docs.