[Solved] CRSF and custom templates

marclava · September 21, 2020, 3:56pm

I have a custom template for the Event type; it causes CRSF issues when viewing events using different views (standard vs custom). It happens only when authenticated.

Is there a way to inform Plone that a custom template is "safe" (just like a standard template)?

Update: it happens even when viewing different events using the custom template (without viewing an event with the standard template), so it looks like an issue with the template.

pigeonflight · September 21, 2020, 4:02pm

I recently used IDisableCSRFProtection.
You can read more about it here: https://pypi.org/project/plone.protect/
I'm assuming you have a supporting .py file with your template.

You can see an example of it being used here:

github.com

plone/Products.CMFPlone/blob/master/Products/CMFPlone/browser/admin.py

# -*- coding: utf-8 -*-
from AccessControl import getSecurityManager
from AccessControl.Permissions import view as View
from OFS.interfaces import IApplication
from Products.CMFCore.permissions import ManagePortal
from Products.CMFPlone.factory import _DEFAULT_PROFILE
from Products.CMFPlone.factory import addPloneSite
from Products.CMFPlone.interfaces import INonInstallable
from Products.CMFPlone.interfaces import IPloneSiteRoot
from Products.CMFPlone.utils import get_installer
from Products.Five.browser.pagetemplatefile import ViewPageTemplateFile
from Products.GenericSetup import BASE, EXTENSION
from Products.GenericSetup import profile_registry
from Products.GenericSetup.upgrade import normalize_version
from ZPublisher.BaseRequest import DefaultPublishTraverse
from collections import OrderedDict
from plone.i18n.locales.interfaces import IContentLanguageAvailability
from plone.keyring.interfaces import IKeyManager
from plone.protect.authenticator import check as checkCSRF
from plone.protect.interfaces import IDisableCSRFProtection

This file has been truncated. show original

marclava · September 21, 2020, 6:29pm

I used it before to solve another issue.

I found the problem; the custom view (but I'm not going to explain here).
So please excuse the noise.