diff --git a/paramecio2/libraries/formsutils.py b/paramecio2/libraries/formsutils.py index e74e7eb..70214b8 100644 --- a/paramecio2/libraries/formsutils.py +++ b/paramecio2/libraries/formsutils.py @@ -248,6 +248,6 @@ def check_csrf(name_csrf_token='csrf_token'): csrf_token=session.get('csrf_token', '') if csrf_token=='' or csrf_token!=request.form.get(name_csrf_token): - abort(404) + abort(403) diff --git a/paramecio2/libraries/generate_admin_class.py b/paramecio2/libraries/generate_admin_class.py index 9078d41..4723400 100644 --- a/paramecio2/libraries/generate_admin_class.py +++ b/paramecio2/libraries/generate_admin_class.py @@ -24,6 +24,7 @@ from paramecio2.libraries.urls import add_get_parameters from paramecio2.libraries.formsutils import show_form from paramecio2.libraries.mtemplates import env_theme, PTemplate from paramecio2.libraries.i18n import I18n, PGetText +from paramecio2.libraries.formsutils import check_csrf from collections import OrderedDict pgettext=PGetText(__file__) @@ -173,6 +174,8 @@ class GenerateAdminClass: elif op_admin=='2': + check_csrf() + self.model.reset_conditions() insert_row=self.model.insert diff --git a/paramecio2/libraries/templates/forms/modelform.phtml b/paramecio2/libraries/templates/forms/modelform.phtml index 01ecc82..57ba89c 100644 --- a/paramecio2/libraries/templates/forms/modelform.phtml +++ b/paramecio2/libraries/templates/forms/modelform.phtml @@ -23,4 +23,5 @@ ${form.form()|n} % endif % endfor + ${csrf_token()|n}