search

openplans / openblock

OpenBlock is a web application and RESTful service that allows users to browse and search their local area for "hyper-local news
61 stars 26 forks source link

do a CSRF audit #178

Closed slinkp closed 12 years ago

slinkp commented 12 years ago

make sure we don't have anything vulnerable. we probably do. https://docs.djangoproject.com/en/1.3/ref/contrib/csrf/

slinkp commented 12 years ago

All the forms in obadmin are vulnerable. Happened to see this while adding the zip importer. Almost might be easiest to add the csrf middleware and see what breaks.

slinkp commented 12 years ago

Milestone Beta Release 1 deleted

slinkp commented 12 years ago

Ticket imported from Trac: http://developer.openblockproject.org/ticket/185 Reported by: slinkp