search

plone / plone.protect

HTTP protection utilities for the Plone CMS
https://pypi.org/project/plone.protect/
7 stars 8 forks source link

CSRF protection override doesn't propagate to parent request #10

Closed mattss closed 9 years ago

mattss commented 9 years ago

If I mark the request with IDisableCSRFProtection during a plone.subrequest, this interface is applied only to the subrequest itself, and not the parent. This makes it impossible to disable CSRF protection inside tile code.

This is causing me specific issues using plone.app.imaging scales inside a tile, as the scales are generated when the tile is rendered, and then CSRF auto-protect blocks the main page request.

vangheem commented 9 years ago

I have no idea how to fix this.

It's a problem that scales are being generated when you just need a url for a scale. If we're going to lazy load scales, it should be done on the request of the scale.

davisagli commented 9 years ago

It's a problem that scales are being generated when you just need a url for a scale.

We do this so that the scale has a unique URL which can be cached forever.

mattss commented 9 years ago

The issue is not really about image scales - that was just an example of a common write-on-read operation. The only way I've found to deal with this is by patching in plone.subrequest to pass the interface marker up once the subrequest is complete. I've raised the same ticket in plone.subrequest as I'm not sure what the best fix is.

vangheem commented 9 years ago

This has been fixed in latest plone.subrequest.