search

plone / plone.protect

HTTP protection utilities for the Plone CMS
https://pypi.org/project/plone.protect/
7 stars 8 forks source link

plone.protect prevents the execution of PythonScripts in the ZMI root #6

Closed zopyx closed 9 years ago

zopyx commented 9 years ago

Plone 5. PythonScripts in the Zope root can no longer be executed because of plone.protect. All transactions will be aborted:

plone.protect aborting transaction due to no CSRF protection on url http://localhost:8083/copy_master

This new behavior was introduced with Plone 5, all scripts are working in Plone 4.3. This is a major backward compatibility foul.

vangheem commented 9 years ago

I can not reproduce this. Scripts work fine for me.

Are you doing writes to the database in the scripts? If you are, then it's a security problem if you are not running them in a way that provides the CSRF token.

Please provide more info and re-open if something else is happening.