ソースを参照

HUE-2404 [oozie] CSRF token missing in rerun popups

Added CSRF token to form with POST methods
Paul McCaughtry 11 年 前
コミット
22a1a3b

+ 1 - 0
apps/oozie/src/oozie/templates/editor/action_utils.mako

@@ -28,6 +28,7 @@
 % endif
   <div data-bind="with: context().node">
     <form class="form-horizontal" id="${node_type}-action-form" method="POST">
+      ${ csrf_token(request) | n,unicode }
       <div class="modal-header">
         <a href="#" class="close">&times;</a>
         <h3 class="message" data-bind="text: '${_('Edit Node: ')}' + name()"></h3>

+ 3 - 0
apps/oozie/src/oozie/templates/editor/control_utils.mako

@@ -27,6 +27,7 @@
 % endif
   <div data-bind="with: context().node">
     <form class="form-horizontal" id="${node_type}-convert-form" method="POST">
+      ${ csrf_token(request) | n,unicode }
       <div class="modal-header">
         <a href="#" class="close" data-dismiss="modal">&times;</a>
         <h3 class="message" data-bind="text: '${_('Edit Node: ')}' + name()"></h3>
@@ -60,6 +61,7 @@
 % endif
   <div data-bind="with: context().node">
     <form class="form-horizontal" id="${node_type}-action-form" method="POST">
+      ${ csrf_token(request) | n,unicode }
       <div class="modal-header">
         <a href="#" class="close" data-dismiss="modal">&times;</a>
         <h3 class="message" data-bind="text: '${_('Edit Node: ')}' + name()"></h3>
@@ -99,6 +101,7 @@
 % endif
   <div data-bind="with: context().node">
     <form class="form-horizontal" id="${node_type}-action-form" method="POST">
+      ${ csrf_token(request) | n,unicode }
       <div class="modal-header">
         <a href="#" class="close" data-dismiss="modal">&times;</a>
         <h3 class="message" data-bind="text: '${_('Edit Node: ')}' + name()"></h3>

+ 1 - 0
apps/oozie/src/oozie/templates/editor/create_bundle.mako

@@ -29,6 +29,7 @@ ${ layout.menubar(section='bundles') }
 
 <div class="container-fluid">
   <form class="form-horizontal" id="bundleForm" action="${ url('oozie:create_bundle') }" method="POST">
+    ${ csrf_token(request) | n,unicode }
     <div class="row-fluid">
       <div class="span2">
         <div class="sidebar-nav">

+ 1 - 1
apps/oozie/src/oozie/templates/editor/create_coordinator.mako

@@ -64,7 +64,7 @@ ${ layout.menubar(section='coordinators') }
         <li><a href="#step5" class="step">${ _('Step 5: Advanced settings') }</a></li>
       </ul>
       <form class="form-horizontal" action="${ url('oozie:create_coordinator') }" method="POST">
-
+        ${ csrf_token(request) | n,unicode }
         <div class="steps">
 
           <div id="step1" class="stepDetails">

+ 1 - 0
apps/oozie/src/oozie/templates/editor/create_workflow.mako

@@ -44,6 +44,7 @@ ${ layout.menubar(section='workflows') }
           <div class="card-body">
             <p>
               <form class="form-horizontal" id="workflowForm" action="${ url('oozie:create_workflow') }" method="POST">
+                ${ csrf_token(request) | n,unicode }
               <fieldset>
               ${ utils.render_field(workflow_form['name']) }
               ${ utils.render_field(workflow_form['description']) }

+ 1 - 1
apps/oozie/src/oozie/templates/editor/edit_bundle.mako

@@ -89,7 +89,7 @@ ${ layout.menubar(section='bundles') }
       <div class="card card-small">
       <h1 class="card-heading simple">${ _('Bundle Editor : ') } ${ bundle.name }</h1>
       <form id="jobForm" class="form-horizontal" action="${ url('oozie:edit_bundle', bundle=bundle.id) }" method="POST">
-
+        ${ csrf_token(request) | n,unicode }
       <div id="properties" class="section">
         <ul class="nav nav-pills">
           <li class="active"><a href="#step1" class="step">${ _('Step 1: General') }</a></li>

+ 1 - 0
apps/oozie/src/oozie/templates/editor/edit_coordinator.mako

@@ -87,6 +87,7 @@ ${ layout.menubar(section='coordinators') }
       <div class="card card-small">
         <h1 class="card-heading simple">${ _('Coordinator Editor : ') } ${ coordinator.name }</h1>
       <form id="jobForm" class="form-horizontal" action="${ url('oozie:edit_coordinator', coordinator=coordinator.id) }" method="POST">
+      ${ csrf_token(request) | n,unicode }
       <div id="properties" class="section">
         <ul class="nav nav-pills">
           <li class="active"><a href="#step1" class="step">${ _('Step 1: General') }</a></li>

+ 1 - 0
apps/oozie/src/oozie/templates/editor/edit_workflow.mako

@@ -31,6 +31,7 @@ ${ layout.menubar(section='workflows') }
 
 <div id="workflow" class="container-fluid">
   <form class="form-horizontal" id="jobForm" method="POST">
+  ${ csrf_token(request) | n,unicode }
   <div class="ribbon-wrapper hide">
     <div class="ribbon">${ _('Unsaved') }</div>
   </div>

+ 1 - 0
apps/oozie/src/oozie/templates/editor/import_coordinator.mako

@@ -39,6 +39,7 @@ ${ layout.menubar(section='coordinators') }
 
     <div style="min-height:300px">
       <form class="form-horizontal" id="coordinatorForm" action="${ url('oozie:import_coordinator') }" method="POST" enctype="multipart/form-data">
+        ${ csrf_token(request) | n,unicode }
         <div class="row-fluid">
           <div class="span12">
             <fieldset>

+ 1 - 1
apps/oozie/src/oozie/templates/editor/import_workflow.mako

@@ -39,7 +39,7 @@ ${ layout.menubar(section='workflows') }
 
     <div style="min-height:300px">
       <form class="form-horizontal" id="workflowForm" action="${ url('oozie:import_workflow') }" method="POST" enctype="multipart/form-data">
-
+      ${ csrf_token(request) | n,unicode }
       <div class="row-fluid">
         <div class="span12">
           <fieldset>

+ 2 - 0
apps/oozie/src/oozie/templates/editor/list_bundles.mako

@@ -132,6 +132,7 @@ ${ layout.menubar(section='bundles') }
 
 <div id="trash-job" class="modal hide">
   <form id="trashForm" action="${ url('oozie:delete_bundle') }" method="POST">
+    ${ csrf_token(request) | n,unicode }
     <div class="modal-header">
       <a href="#" class="close" data-dismiss="modal">&times;</a>
       <h3 id="trashMessage">${ _('Move the selected bundle(s) to trash?') }</h3>
@@ -148,6 +149,7 @@ ${ layout.menubar(section='bundles') }
 
 <div id="destroy-job" class="modal hide">
   <form id="destroyForm" action="${ url('oozie:delete_bundle') }?skip_trash=true" method="POST">
+    ${ csrf_token(request) | n,unicode }
     <div class="modal-header">
       <a href="#" class="close" data-dismiss="modal">&times;</a>
       <h3 id="destroyMessage">${ _('Delete the selected bundle(s)?') }</h3>

+ 2 - 0
apps/oozie/src/oozie/templates/editor/list_coordinators.mako

@@ -136,6 +136,7 @@ ${ layout.menubar(section='coordinators') }
 
 <div id="trash-job" class="modal hide">
   <form id="trashForm" action="${ url('oozie:delete_coordinator') }" method="POST">
+    ${ csrf_token(request) | n,unicode }
     <div class="modal-header">
       <a href="#" class="close" data-dismiss="modal">&times;</a>
       <h3 id="trashMessage">${ _('Move the selected coordinator(s) to trash?') }</h3>
@@ -152,6 +153,7 @@ ${ layout.menubar(section='coordinators') }
 
 <div id="destroy-job" class="modal hide">
   <form id="destroyForm" action="${ url('oozie:delete_coordinator') }?skip_trash=true" method="POST">
+    ${ csrf_token(request) | n,unicode }
     <div class="modal-header">
       <a href="#" class="close" data-dismiss="modal">&times;</a>
       <h3 id="destroyMessage">${ _('Delete the selected coordinator(s)?') }</h3>

+ 3 - 0
apps/oozie/src/oozie/templates/editor/list_trashed_bundles.mako

@@ -96,6 +96,7 @@ ${ layout.menubar(section='bundles') }
 
 <div id="purge-job" class="modal hide">
   <form id="purgeForm" action="${ url('oozie:delete_bundle') }?skip_trash=true" method="POST">
+    ${ csrf_token(request) | n,unicode }
     <div class="modal-header">
       <a href="#" class="close" data-dismiss="modal">&times;</a>
       <h3 id="purgefMessage">${ _('Delete all bundle(s)?') }</h3>
@@ -112,6 +113,7 @@ ${ layout.menubar(section='bundles') }
 
 <div id="destroy-job" class="modal hide">
   <form id="destroyForm" action="${ url('oozie:delete_bundle') }?skip_trash=true" method="POST">
+    ${ csrf_token(request) | n,unicode }
     <div class="modal-header">
       <a href="#" class="close" data-dismiss="modal">&times;</a>
       <h3 id="destroyMessage">${ _('Delete the selected bundle(s)?') }</h3>
@@ -128,6 +130,7 @@ ${ layout.menubar(section='bundles') }
 
 <div id="restore-job" class="modal hide">
   <form id="restoreForm" action="${ url('oozie:restore_bundle') }" method="POST">
+    ${ csrf_token(request) | n,unicode }
     <div class="modal-header">
       <a href="#" class="close" data-dismiss="modal">&times;</a>
       <h3 id="restoreMessage">${ _('Restore the selected bundle(s)?') }</h3>

+ 3 - 0
apps/oozie/src/oozie/templates/editor/list_trashed_coordinators.mako

@@ -96,6 +96,7 @@ ${ layout.menubar(section='coordinators') }
 
 <div id="purge-job" class="modal hide">
   <form id="purgeForm" action="${ url('oozie:delete_coordinator') }?skip_trash=true" method="POST">
+    ${ csrf_token(request) | n,unicode }
     <div class="modal-header">
       <a href="#" class="close" data-dismiss="modal">&times;</a>
       <h3 id="purgeMessage">${ _('Delete all coordinator(s)?') }</h3>
@@ -113,6 +114,7 @@ ${ layout.menubar(section='coordinators') }
 
 <div id="destroy-job" class="modal hide">
   <form id="purgeForm" action="${ url('oozie:delete_coordinator') }?skip_trash=true" method="POST">
+    ${ csrf_token(request) | n,unicode }
     <div class="modal-header">
       <a href="#" class="close" data-dismiss="modal">&times;</a>
       <h3 id="purgeMessage">${ _('Delete the selected coordinator(s)?') }</h3>
@@ -130,6 +132,7 @@ ${ layout.menubar(section='coordinators') }
 
 <div id="restore-job" class="modal hide">
   <form id="restoreWfForm" action="${ url('oozie:restore_coordinator') }" method="POST">
+    ${ csrf_token(request) | n,unicode }
     <div class="modal-header">
       <a href="#" class="close" data-dismiss="modal">&times;</a>
       <h3 id="restoreWfMessage">${ _('Restore the selected coordinator(s)?') }</h3>

+ 3 - 0
apps/oozie/src/oozie/templates/editor/list_trashed_workflows.mako

@@ -96,6 +96,7 @@ ${ layout.menubar(section='workflows') }
 
 <div id="destroyWf" class="modal hide fade">
   <form id="destroyWfForm" action="${ url('oozie:delete_workflow') }?skip_trash=true" method="POST">
+    ${ csrf_token(request) | n,unicode }
     <div class="modal-header">
       <a href="#" class="close" data-dismiss="modal">&times;</a>
       <h3 id="destroyWfMessage">${ _('Delete the selected workflow(s)?') }</h3>
@@ -112,6 +113,7 @@ ${ layout.menubar(section='workflows') }
 
 <div id="purgeWfs" class="modal hide fade">
   <form id="purgeWfsForm" action="${ url('oozie:delete_workflow') }?skip_trash=true" method="POST">
+    ${ csrf_token(request) | n,unicode }
     <div class="modal-header">
       <a href="#" class="close" data-dismiss="modal">&times;</a>
       <h3 id="purgeWfsMessage">${ _('Delete all trashed workflow(s)?') }</h3>
@@ -128,6 +130,7 @@ ${ layout.menubar(section='workflows') }
 
 <div id="restoreWf" class="modal hide fade">
   <form id="restoreWfForm" action="${ url('oozie:restore_workflow') }" method="POST">
+    ${ csrf_token(request) | n,unicode }
     <div class="modal-header">
       <a href="#" class="close" data-dismiss="modal">&times;</a>
       <h3 id="restoreWfMessage">${ _('Restore the selected workflow(s)?') }</h3>

+ 2 - 0
apps/oozie/src/oozie/templates/editor/list_workflows.mako

@@ -131,6 +131,7 @@ ${ layout.menubar(section='workflows') }
 
 <div id="trashWf" class="modal hide fade">
   <form id="trashWfForm" action="${ url('oozie:delete_workflow') }" method="POST">
+    ${ csrf_token(request) | n,unicode }
     <div class="modal-header">
       <a href="#" class="close" data-dismiss="modal">&times;</a>
       <h3 id="trashWfMessage">${ _('Move the selected workflow(s) to trash?') }</h3>
@@ -147,6 +148,7 @@ ${ layout.menubar(section='workflows') }
 
 <div id="destroyWf" class="modal hide fade">
   <form id="destroyWfForm" action="${ url('oozie:delete_workflow') }?skip_trash=true" method="POST">
+    ${ csrf_token(request) | n,unicode }
     <div class="modal-header">
       <a href="#" class="close" data-dismiss="modal">&times;</a>
       <h3 id="destroyWfMessage">${ _('Delete the selected workflow(s)?') }</h3>

+ 1 - 0
apps/oozie/src/oozie/templates/editor/submit_job_popup.mako

@@ -22,6 +22,7 @@
 
 
 <form action="${ action }" method="POST">
+  ${ csrf_token(request) | n,unicode }
   <div class="modal-header">
     <a href="#" class="close" data-dismiss="modal">&times;</a>
     <h3>${ _('Submit this job?') }</h3>