Ñò
wïJIc @ s¤ d Z d d k Z d d k l Z d d k l Z d d k l Z l Z d d k l Z d d g Z
e i e ƒ Z
d Z d
„ Z d „ Z e e ƒ Z d „ Z d S(
s Security related decoratorsiÿÿÿÿN( t decorator( t secure_form( t abortt redirect_to( t
get_pylonst authenticate_formt httpss† Cross-site request forgery detected, request denied. See http://en.wikipedia.org/wiki/Cross-site_request_forgery for more information.c C s/ | i t i ƒ } | d j o | t i ƒ j S( N( t getR t token_keyt Nonet authentication_token( t paramst submitted_token( ( s< /usr/lib/python2.6/site-packages/pylons/decorators/secure.pyt authenticated_form s
c O sh t | ƒ i } t | i ƒ o | i t i =| | | Ž St i d | | i f ƒ t d d t
ƒd S( sp Decorator for authenticating a form
This decorator uses an authorization token stored in the client's
session for prevention of certain Cross-site request forgery (CSRF)
attacks (See
http://en.wikipedia.org/wiki/Cross-site_request_forgery for more
information).
For use with the ``webhelpers.html.secure_form`` helper functions.
sG Cross-site request forgery detected, request denied: %r REMOTE_ADDR: %si“ t detailN( R t requestR
t POSTR R t logt warnt remote_addrR t csrf_detected_message( t funct argst kwargsR ( ( s< /usr/lib/python2.6/site-packages/pylons/decorators/secure.pyR s
c s ‡ ‡ f d † } t | ƒ S( sÖ Decorator to redirect to the SSL version of a page if not currently
using HTTPS. Takes as arguments the parameters to pass to redirect_to.
(Specify no arguments necessary to redirect the current page). Apply this
decorator to controller methods (actions).
Non-https POST requests are aborted (405 response code) by this decorator.
Example:
.. code-block:: python
@https('/pylons') # redirect to HTTPS /pylons
def index(self):
#...
# redirect to HTTPS /auth/login
@https(controller='auth', action='login')
def login(self):
#...
@https() # redirect to HTTPS version of myself
def get(self):
#...
c s” t | ƒ i } | i i ƒ d j o | | | Ž S| i i ƒ d j o4 d ˆ d s