mam/mamweb
11
0
Fork 0
Code Issues Pull requests 8 Projects Wiki Activity Actions

Sensitivní POST parametry by se neměly posílat mailem

Browse source
This commit is contained in:
MaM Web user 2021-09-07 17:23:54 +02:00
parent f42bc12704
commit 4a6c6d49ef
1 changed files with 11 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
seminar/views/views_all.py
View file

@ -12,6 +12,7 @@ from django.utils.translation import ugettext as _
from django.http import Http404,HttpResponseBadRequest,HttpResponseRedirect
from django.db.models import Q, Sum, Count
from django.views.decorators.csrf import ensure_csrf_cookie
from django.views.decorators.debug import sensitive_post_parameters
from django.views.generic.edit import FormView, CreateView
from django.views.generic.base import TemplateView, RedirectView
from django.contrib.auth import authenticate, login, get_user_model, logout
@ -1133,6 +1134,7 @@ def prihlaska_log_gdpr_safe(logger, gdpr_logger, msg, form_data):
gdpr_logger.warn(msg+", form:{}".format(form_data))
from django.forms.models import model_to_dict
@sensitive_post_parameters('jmeno', 'prijmeni', 'email', 'telefon', 'datum_narozeni', 'ulice', 'mesto', 'psc', 'skola')
def resitelEditView(request):
err_logger = logging.getLogger('seminar.prihlaska.problem')
## Načtení objektů Osoba a Resitel patřících k aktuálně přihlášenému uživateli
@ -1207,6 +1209,7 @@ def resitelEditView(request):
return render(request, 'seminar/profil/edit.html', {'form': form})
@sensitive_post_parameters('jmeno', 'prijmeni', 'email', 'telefon', 'datum_narozeni', 'ulice', 'mesto', 'psc', 'skola')
def prihlaskaView(request):
generic_logger = logging.getLogger('seminar.prihlaska')
err_logger = logging.getLogger('seminar.prihlaska.problem')
@ -1360,16 +1363,20 @@ Tento e-mail byl vygenerován automaticky, chceš-li nás kontaktovat, napiš n
return render(request, 'seminar/profil/prihlaska.html', {'form': form})
# FIXME: Tohle asi vlastně vůbec nepatří do aplikace 'seminar'
@sensitive_post_parameters('password')
class LoginView(auth_views.LoginView):
# Jen vezmeme vestavěný a dáme mu vhodný template a přesměrovací URL
template_name = 'seminar/profil/login.html'
@sensitive_post_parameters('password')
class LogoutView(auth_views.LogoutView):
# Jen vezmeme vestavěný a dáme mu vhodný template a přesměrovací URL
template_name = 'seminar/profil/logout.html'
# Pavel: Vůbec nevím, proč to s _lazy funguje, ale bez toho to bylo rozbité.
next_page = reverse_lazy('titulni_strana')
# Nejsem si jistý, který view co dostává, tak zahazuji všechny POSTy
@sensitive_post_parameters()
class PasswordResetView(auth_views.PasswordResetView):
""" Chci resetovat heslo. """
template_name = 'seminar/registrace/reset_hesla.html'
@ -1378,19 +1385,23 @@ class PasswordResetView(auth_views.PasswordResetView):
email_template_name = 'seminar/registrace/password_reset_email.html'
subject_template_name = 'seminar/registrace/password_reset_subject.txt'
@sensitive_post_parameters()
class PasswordResetDoneView(auth_views.PasswordResetDoneView):
""" Poslali jsme e-mail (pokud bylo kam)). """
template_name = 'seminar/registrace/reset_poslan.html'
@sensitive_post_parameters()
class PasswordResetConfirmView(auth_views.PasswordResetConfirmView):
""" Vymysli si heslo. """
template_name = 'seminar/registrace/nove_heslo.html'
success_url = reverse_lazy('reset_password_complete')
@sensitive_post_parameters()
class PasswordResetCompleteView(auth_views.PasswordResetCompleteView):
""" Heslo se asi změnilo."""
template_name = 'seminar/registrace/nove_nastaveno.html'
@sensitive_post_parameters()
class PasswordChangeView(auth_views.PasswordChangeView):
#template_name = 'seminar/password_change.html'
success_url = reverse_lazy('titulni_strana')