def csrf_protect():
if request.method == 'POST':
token = session.pop('_csrf_token', None)
if not token or token != request.form.get('_csrf_token'):
abort(403)
This fails to correctly validate the csrf if:
User opens upload page (1)
User opens upload page (2)
Both 1 and 2 will have the same csrf token renderd in the template
When one of the upload pages is submitted (or any POST request) then the CSRF token is popped from the session, this means than when the user goes to submit the other page the CSRF token is deemed invalid because it is comparing against None. A simple patch to change this from pop to get should fix this.
in middleware.py we have
This fails to correctly validate the csrf if: User opens upload page (1) User opens upload page (2) Both 1 and 2 will have the same csrf token renderd in the template
When one of the upload pages is submitted (or any POST request) then the CSRF token is popped from the session, this means than when the user goes to submit the other page the CSRF token is deemed invalid because it is comparing against None. A simple patch to change this from pop to get should fix this.