浏览代码

[core] Add CSRF protection to all requests

Word 11 年之前
父节点
当前提交
339e68a99e
共有 46 个文件被更改,包括 100 次插入9 次删除
  1. 1 0
      apps/beeswax/src/beeswax/templates/choose_delimiter.mako
  2. 1 0
      apps/beeswax/src/beeswax/templates/choose_file.mako
  3. 1 0
      apps/beeswax/src/beeswax/templates/configuration.mako
  4. 1 0
      apps/beeswax/src/beeswax/templates/confirm.mako
  5. 1 0
      apps/beeswax/src/beeswax/templates/create_database.mako
  6. 1 0
      apps/beeswax/src/beeswax/templates/create_table_manually.mako
  7. 1 0
      apps/beeswax/src/beeswax/templates/define_columns.mako
  8. 4 0
      apps/beeswax/src/beeswax/templates/execute.mako
  9. 1 0
      apps/beeswax/src/beeswax/templates/list_designs.mako
  10. 1 0
      apps/beeswax/src/beeswax/templates/list_trashed_designs.mako
  11. 1 0
      apps/beeswax/src/beeswax/templates/my_queries.mako
  12. 1 0
      apps/beeswax/src/beeswax/templates/save_results.mako
  13. 2 0
      apps/beeswax/src/beeswax/templates/watch_results.mako
  14. 2 0
      apps/filebrowser/src/filebrowser/templates/edit.mako
  15. 1 0
      apps/filebrowser/src/filebrowser/templates/fileop.mako
  16. 10 0
      apps/filebrowser/src/filebrowser/templates/listdir_components.mako
  17. 1 0
      apps/filebrowser/src/filebrowser/templates/saveas.mako
  18. 1 0
      apps/hbase/src/hbase/templates/app.mako
  19. 4 0
      apps/jobsub/src/jobsub/templates/designs.mako
  20. 1 0
      apps/metastore/src/metastore/templates/confirm.mako
  21. 1 0
      apps/metastore/src/metastore/templates/databases.mako
  22. 1 0
      apps/metastore/src/metastore/templates/describe_table.mako
  23. 1 0
      apps/metastore/src/metastore/templates/popups/load_data.mako
  24. 2 0
      apps/metastore/src/metastore/templates/tables.mako
  25. 1 0
      apps/oozie/src/oozie/templates/dashboard/rerun_bundle_popup.mako
  26. 1 0
      apps/oozie/src/oozie/templates/dashboard/rerun_coord_popup.mako
  27. 1 1
      apps/oozie/src/oozie/templates/dashboard/rerun_job_popup.mako
  28. 1 0
      apps/search/src/search/templates/search.mako
  29. 1 0
      apps/spark/src/spark/templates/common.mako
  30. 1 0
      apps/spark/src/spark/templates/list_contexts.mako
  31. 3 0
      apps/sqoop/src/sqoop/templates/app.mako
  32. 1 0
      apps/useradmin/src/useradmin/templates/add_ldap_users.mako
  33. 2 1
      apps/useradmin/src/useradmin/templates/confirm.mako
  34. 1 0
      apps/useradmin/src/useradmin/templates/edit_group.mako
  35. 1 0
      apps/useradmin/src/useradmin/templates/edit_permissions.mako
  36. 1 0
      apps/useradmin/src/useradmin/templates/edit_user.mako
  37. 1 0
      apps/useradmin/src/useradmin/templates/list_groups.mako
  38. 1 0
      apps/useradmin/src/useradmin/templates/list_users.mako
  39. 1 0
      apps/useradmin/src/useradmin/templates/sync_ldap_users_groups.mako
  40. 1 0
      apps/zookeeper/src/zookeeper/templates/create.mako
  41. 1 0
      apps/zookeeper/src/zookeeper/templates/edit.mako
  42. 15 2
      desktop/core/src/desktop/lib/django_mako.py
  43. 4 2
      desktop/core/src/desktop/lib/django_util.py
  44. 2 1
      desktop/core/src/desktop/settings.py
  45. 15 0
      desktop/core/src/desktop/templates/common_header.mako
  46. 2 2
      desktop/core/src/desktop/templates/login.mako

+ 1 - 0
apps/beeswax/src/beeswax/templates/choose_delimiter.mako

@@ -73,6 +73,7 @@ ${ layout.metastore_menubar() }
                 <li><a id="step3" href="#">${_('Step 3: Define Columns')}</a></li>
             </ul>
                 <form id="delimiterForm" action="${action}" method="POST" class="form-horizontal">
+                ${ csrf_token(request) | n,unicode }
                 <div class="hide">
                     ${util.render_form(file_form)}
                     ${comps.field(delim_form['file_type'])}

+ 1 - 0
apps/beeswax/src/beeswax/templates/choose_file.mako

@@ -72,6 +72,7 @@ ${ layout.metastore_menubar() }
                 <li><a href="#">${_('Step 3: Define Columns')}</a></li>
             </ul>
                 <form action="${action}" method="POST" class="form-horizontal">
+                ${ csrf_token(request) | n,unicode }
                 <fieldset>
                     <div class="alert alert-info"><h3>${_('Name Your Table and Choose A File')}</h3></div>
                     <div class="control-group">

+ 1 - 0
apps/beeswax/src/beeswax/templates/configuration.mako

@@ -30,6 +30,7 @@ ${layout.menubar(section='configuration')}
     <div class="card-body">
       <p>
         <form class="form-search" method="POST">
+          ${ csrf_token(request) | n,unicode }
           <input type="text" id="filterInput" class="input-xlarge search-query" placeholder="${_('Search for key, value, etc.')}">
           <a href="#" id="clearFilterBtn" class="btn">${_('Clear')}</a>
         </form>

+ 1 - 0
apps/beeswax/src/beeswax/templates/confirm.mako

@@ -19,6 +19,7 @@ from django.utils.translation import ugettext as _
 %>
 
 <form action="{{ url }}" method="POST">>
+  ${ csrf_token(request) | n,unicode }
   <div class="modal-header">
 	<a href="javascript:void(0);" class="close">&times;</a>
 	<h3>${ _('Confirm action') }</h3>

+ 1 - 0
apps/beeswax/src/beeswax/templates/create_database.mako

@@ -47,6 +47,7 @@ ${layout.metastore_menubar()}
       </ul>
 
       <form action="${ url(app_name + ':create_database')}" method="POST" id="mainForm" class="form-horizontal">
+        ${ csrf_token(request) | n,unicode }
         <div class="steps">
           <div id="step1" class="stepDetails">
               <fieldset>

+ 1 - 0
apps/beeswax/src/beeswax/templates/create_table_manually.mako

@@ -77,6 +77,7 @@ ${ layout.metastore_menubar() }
         </ul>
 
         <form action="#" method="POST" id="mainForm" class="form-horizontal">
+      ${ csrf_token(request) | n,unicode }
       <div class="steps">
 
         <div id="step1" class="stepDetails">

+ 1 - 0
apps/beeswax/src/beeswax/templates/define_columns.mako

@@ -73,6 +73,7 @@ ${ layout.metastore_menubar() }
                 <li class="active"><a href="#">${_('Step 3: Define Columns')}</a></li>
             </ul>
                 <form action="${action}" method="POST" class="form-stacked">
+                ${ csrf_token(request) | n,unicode }
                 <div class="hide">
                     ${util.render_form(file_form)}
                     ${util.render_form(delim_form)}

+ 4 - 0
apps/beeswax/src/beeswax/templates/execute.mako

@@ -67,6 +67,7 @@ ${layout.menubar(section='query')}
         <div class="card-body">
           <div id="advanced-settings">
           <form id="advancedSettingsForm" action="" method="POST" class="form form-horizontal">
+              ${ csrf_token(request) | n,unicode }
               <ul class="nav nav-list" style="border: none; padding: 0;">
                 <li class="nav-header">${_('settings')}</li>
                 <li class="white paramContainer">
@@ -479,6 +480,7 @@ ${layout.menubar(section='query')}
       <div class="card-body">
         <p>
         <form method="POST" action="" class="form-horizontal">
+          ${ csrf_token(request) | n,unicode }
           <fieldset>
             <!-- ko foreach: $root.design.parameters -->
             <div class="control-group">
@@ -510,6 +512,7 @@ ${layout.menubar(section='query')}
         <p>
 
         <form method="POST" action="" class="form-horizontal">
+          ${ csrf_token(request) | n,unicode }
           <fieldset>
             <!-- ko foreach: $root.design.parameters -->
             <div class="control-group">
@@ -624,6 +627,7 @@ ${layout.menubar(section='query')}
       <h4 data-bind="text: $root.design.results.save.targetDirectoryError()"></h4>
     <!-- /ko -->
     <form id="saveResultsForm" method="POST" class="form form-inline">
+      ${ csrf_token(request) | n,unicode }
       <fieldset>
         <div data-bind="css: {'error': $root.design.results.save.targetFileError()}" class="control-group">
           <div class="controls">

+ 1 - 0
apps/beeswax/src/beeswax/templates/list_designs.mako

@@ -125,6 +125,7 @@ ${ layout.menubar(section='saved queries') }
 
 <div id="deleteQuery" class="modal hide fade">
   <form id="deleteQueryForm" action="${ url(app_name + ':delete_design') }" method="POST">
+    ${ csrf_token(request) | n,unicode }
     <input type="hidden" name="skipTrash" id="skipTrash" value="false"/>
     <div class="modal-header">
       <a href="#" class="close" data-dismiss="modal">&times;</a>

+ 1 - 0
apps/beeswax/src/beeswax/templates/list_trashed_designs.mako

@@ -108,6 +108,7 @@ ${layout.menubar(section='saved queries')}
 
 <div id="deleteQuery" class="modal hide fade">
   <form id="deleteQueryForm" action="${ url(app_name + ':delete_design') }" method="POST">
+    ${ csrf_token(request) | n,unicode }
     <input type="hidden" name="skipTrash" id="skipTrash" value="true"/>
     <div class="modal-header">
       <a href="#" class="close" data-dismiss="modal">&times;</a>

+ 1 - 0
apps/beeswax/src/beeswax/templates/my_queries.mako

@@ -164,6 +164,7 @@ ${layout.menubar(section='my queries')}
 
 <div id="deleteQuery" class="modal hide fade">
   <form id="deleteQueryForm" action="${ url(app_name + ':delete_design') }" method="POST">
+    ${ csrf_token(request) | n,unicode }
     <input type="hidden" name="skipTrash" id="skipTrash" value="false"/>
     <div class="modal-header">
       <a href="#" class="close" data-dismiss="modal">&times;</a>

+ 1 - 0
apps/beeswax/src/beeswax/templates/save_results.mako

@@ -38,6 +38,7 @@ ${layout.menubar(section='query')}
     <div class="card-body">
       <p>
         <form id="saveForm" action="${action}" method="POST" class="form form-inline">
+          ${ csrf_token(request) | n,unicode }
           <fieldset>
             <div class="control-group">
               <div class="controls">

+ 2 - 0
apps/beeswax/src/beeswax/templates/watch_results.mako

@@ -113,6 +113,7 @@ ${layout.menubar(section='query')}
               ${_('Hue stopped as one of your query contains some results.') }
               ${_('Click on') }
               <form action="${ url(app_name + ':watch_query_history', query.id) }?context=${ query.design.get_query_context() }" method="POST">
+                ${ csrf_token(request) | n,unicode }
                 <input type="submit" value="${ _("next") }"/ class="btn btn-primary">
               </form>
               ${_('to continue execution of the remaining statements.') }
@@ -296,6 +297,7 @@ ${layout.menubar(section='query')}
 <div id="saveAs" class="modal hide fade">
   <form id="saveForm" action="${url(app_name + ':save_results', query.id) }" method="POST"
         class="form form-inline form-padding-fix">
+    ${ csrf_token(request) | n,unicode }
     <div class="modal-header">
       <a href="#" class="close" data-dismiss="modal">&times;</a>
       <h3>${_('Save Query Results')}</h3>

+ 2 - 0
apps/filebrowser/src/filebrowser/templates/edit.mako

@@ -46,6 +46,7 @@ ${ fb_components.menubar() }
         <div class="card-body">
           <p>
             <form class="form-stacked" method="post" action="${url('filebrowser.views.save_file')}">
+              ${ csrf_token(request) | n,unicode }
               % if form.errors:
               <div class="alert-message">
                 % for field in form:
@@ -72,6 +73,7 @@ ${ fb_components.menubar() }
 
 <div id="saveAsModal" class="modal hide fade">
     <form id="saveAsForm" action="${url('filebrowser.views.save_file')}" method="POST" class="form-stacked form-padding-fix">
+    ${ csrf_token(request) | n,unicode }
     <div class="modal-header">
         <a href="#" class="close" data-dismiss="modal">&times;</a>
         <h3>${_('Save as')}</h3>

+ 1 - 0
apps/filebrowser/src/filebrowser/templates/fileop.mako

@@ -30,6 +30,7 @@ ${ commonheader(_('File Operation'), 'filebrowser', user) | n,unicode }
 <div class="container-fluid">
 <div class="well">
 <form action="" method="POST" enctype="multipart/form-data" class="form-stacked">
+${ csrf_token(request) | n,unicode }
 <h1>${form.op}</h1>
 % if isinstance(form, forms.Form):
 	${form.as_p()|n}

+ 10 - 0
apps/filebrowser/src/filebrowser/templates/listdir_components.mako

@@ -108,6 +108,7 @@ from django.utils.translation import ugettext as _
     </div>
     <div class="modal-footer">
       <form id="deleteForm" action="/filebrowser/rmtree" method="POST" enctype="multipart/form-data" class="form-stacked">
+        ${ csrf_token(request) | n,unicode }
         <a class="btn" data-dismiss="modal">${_('No')}</a>
         <input type="submit" value="${_('Yes')}" class="btn btn-danger" />
       </form>
@@ -125,6 +126,7 @@ from django.utils.translation import ugettext as _
     </div>
     <div class="modal-footer">
       <form id="restoreTrashForm" action="/filebrowser/trash/restore" method="POST" enctype="multipart/form-data" class="form-stacked">
+        ${ csrf_token(request) | n,unicode }
         <a class="btn" data-dismiss="modal">${_('No')}</a>
         <input type="submit" value="${_('Yes')}" class="btn btn-primary" />
       </form>
@@ -144,6 +146,7 @@ from django.utils.translation import ugettext as _
 
     <div class="modal-footer">
       <form id="purgeTrashForm" action="/filebrowser/trash/purge" method="POST" enctype="multipart/form-data" class="form-stacked">
+        ${ csrf_token(request) | n,unicode }
         <a class="btn" data-dismiss="modal">${_('Cancel')}</a>
         <input type="submit" value="${_('Delete')}" class="btn btn-primary" />
       </form>
@@ -153,6 +156,7 @@ from django.utils.translation import ugettext as _
   <!-- rename modal -->
   <div id="renameModal" class="modal hide fade">
     <form id="renameForm" action="/filebrowser/rename?next=${current_request_path}" method="POST" enctype="multipart/form-data" class="form-inline form-padding-fix">
+      ${ csrf_token(request) | n,unicode }
       <div class="modal-header">
         <a href="#" class="close" data-dismiss="modal">&times;</a>
         <h3>${_('Renaming:')} <span id="renameFileName">file name</span></h3>
@@ -181,6 +185,7 @@ from django.utils.translation import ugettext as _
       select_filter = is_superuser and 'SelectWithOther' or ''
     %>
     <form id="chownForm" action="/filebrowser/chown" method="POST" enctype="multipart/form-data" class="form-stacked form-padding-fix">
+      ${ csrf_token(request) | n,unicode }
       <div class="modal-header">
         <a href="#" class="close" data-dismiss="modal">&times;</a>
         <h3>${_('Change Owner/Group')}</h3>
@@ -212,6 +217,7 @@ from django.utils.translation import ugettext as _
   <!-- chmod modal -->
   <div id="changePermissionModal" class="modal hide fade">
     <form action="/filebrowser/chmod" method="POST" enctype="multipart/form-data" class="form-inline form-padding-fix" id="chmodForm">
+      ${ csrf_token(request) | n,unicode }
       <div class="modal-header">
         <a href="#" class="close" data-dismiss="modal">&times;</a>
         <h3>${_('Change Permissions:')} </h3>
@@ -275,6 +281,7 @@ from django.utils.translation import ugettext as _
   <!-- move modal -->
   <div id="moveModal" class="modal hide fade">
     <form id="moveForm" action="/filebrowser/move" method="POST" enctype="multipart/form-data" class="form-inline form-padding-fix">
+      ${ csrf_token(request) | n,unicode }
       <div class="modal-header">
         <a href="#" class="close" data-dismiss="modal">&times;</a>
         <h3>${_('Move to')}</h3>
@@ -296,6 +303,7 @@ from django.utils.translation import ugettext as _
   <!-- copy modal -->
   <div id="copyModal" class="modal hide fade">
     <form id="copyForm" action="/filebrowser/copy" method="POST" enctype="multipart/form-data" class="form-inline form-padding-fix">
+      ${ csrf_token(request) | n,unicode }
       <div class="modal-header">
         <a href="#" class="close" data-dismiss="modal">&times;</a>
         <h3>${_('Copy to')}</h3>
@@ -350,6 +358,7 @@ from django.utils.translation import ugettext as _
   <!-- new directory modal -->
   <div id="createDirectoryModal" class="modal hide fade">
     <form id="createDirectoryForm" data-bind="submit: createDirectory" method="POST" enctype="multipart/form-data" class="form-inline form-padding-fix">
+      ${ csrf_token(request) | n,unicode }
       <div class="modal-header">
         <a href="#" class="close" data-dismiss="modal">&times;</a>
         <h3>${_('Create Directory')}</h3>
@@ -374,6 +383,7 @@ from django.utils.translation import ugettext as _
   <!-- new file modal -->
   <div id="createFileModal" class="modal hide fade">
     <form id="createFileForm" data-bind="submit: createFile" method="POST" enctype="multipart/form-data" class="form-inline form-padding-fix">
+      ${ csrf_token(request) | n,unicode }
       <div class="modal-header">
         <a href="#" class="close" data-dismiss="modal">&times;</a>
         <h3>${_('Create File')}</h3>

+ 1 - 0
apps/filebrowser/src/filebrowser/templates/saveas.mako

@@ -30,6 +30,7 @@
     % endif
     <div class="saveAsPrompt_popup">
       <form method="post" action="${url('filebrowser.views.save_file')}">
+          ${ csrf_token(request) | n,unicode }
           ${ _('Enter the location where you would like to save the file.') }
           ${edit.render_field(form["path"], notitle=True)}
           <div>${edit.render_field(form["contents"], hidden=True)}</div>

+ 1 - 0
apps/hbase/src/hbase/templates/app.mako

@@ -193,6 +193,7 @@ ${ commonheader(None, "hbase", user) | n,unicode }
 
     <!-- New Table Modal -->
     <form id="new_table_modal" action="createTable" method="POST" class="modal hide fade ajaxSubmit" tabindex="-1" role="dialog" aria-labelledby="myModalLabel" aria-hidden="true">
+      ${ csrf_token(request) | n,unicode }
       <div class="modal-header">
         <a class="close pointer" data-dismiss="modal" aria-hidden="true">&times;</a>
         <h3>${_('Create New Table')}</h3>

+ 4 - 0
apps/jobsub/src/jobsub/templates/designs.mako

@@ -210,6 +210,7 @@ ${ commonheader(None, "jobsub", user) | n,unicode }
 
 <div id="trashWf" class="modal hide fade">
   <form id="trashWfForm" action="#" method="POST" style="margin:0">
+    ${ csrf_token(request) | n,unicode }
     <div class="modal-header">
       <a href="#" class="close" data-dismiss="modal">&times;</a>
       <h3 id="trashWfMessage">${_('Move the selected designs to trash?')}</h3>
@@ -223,6 +224,7 @@ ${ commonheader(None, "jobsub", user) | n,unicode }
 
 <div id="destroyWf" class="modal hide fade">
   <form id="destroyWfForm" action="#" method="POST" style="margin:0">
+    ${ csrf_token(request) | n,unicode }
     <div class="modal-header">
       <a href="#" class="close" data-dismiss="modal">&times;</a>
       <h3 id="destroyWfMessage">${_('Delete selected designs?')}</h3>
@@ -236,6 +238,7 @@ ${ commonheader(None, "jobsub", user) | n,unicode }
 
 <div id="purgeWf" class="modal hide fade">
   <form id="purgeWfForm" action="#" method="POST" style="margin:0">
+    ${ csrf_token(request) | n,unicode }
     <div class="modal-header">
       <a href="#" class="close" data-dismiss="modal">&times;</a>
       <h3 id="purgeWfMessage">${_('Delete all trashed designs?')}</h3>
@@ -249,6 +252,7 @@ ${ commonheader(None, "jobsub", user) | n,unicode }
 
 <div id="restoreWf" class="modal hide fade">
   <form id="restoreWfForm" action="#" method="POST" style="margin:0">
+    ${ csrf_token(request) | n,unicode }
     <div class="modal-header">
       <a href="#" class="close" data-dismiss="modal">&times;</a>
       <h3 id="restoreWfMessage">${_('Restore selected designs?')}</h3>

+ 1 - 0
apps/metastore/src/metastore/templates/confirm.mako

@@ -19,6 +19,7 @@ from django.utils.translation import ugettext as _
 %>
 
 <form action="{{ url }}" method="POST">>
+  ${ csrf_token(request) | n,unicode }
   <div class="modal-header">
     <a href="javascript:void(0);" class="close">&times;</a>
     <h3>${ _('Confirm action') }</h3>

+ 1 - 0
apps/metastore/src/metastore/templates/databases.mako

@@ -82,6 +82,7 @@ ${ components.menubar() }
 
 <div id="dropDatabase" class="modal hide fade">
   <form id="dropDatabaseForm" action="${ url('metastore:drop_database') }" method="POST">
+    ${ csrf_token(request) | n,unicode }
     <div class="modal-header">
       <a href="#" class="close" data-dismiss="modal">&times;</a>
       <h3 id="dropDatabaseMessage">${_('Confirm action')}</h3>

+ 1 - 0
apps/metastore/src/metastore/templates/describe_table.mako

@@ -176,6 +176,7 @@ ${ components.menubar() }
 
 <div id="dropTable" class="modal hide fade">
   <form id="dropTableForm" method="POST" action="${ url('metastore:drop_table', database=database) }">
+    ${ csrf_token(request) | n,unicode }
     <div class="modal-header">
       <a href="#" class="close" data-dismiss="modal">&times;</a>
 

+ 1 - 0
apps/metastore/src/metastore/templates/popups/load_data.mako

@@ -20,6 +20,7 @@ from django.utils.translation import ugettext as _
 <%namespace name="comps" file="../components.mako" />
 
 <form method="POST" class="form-horizontal" id="load-data-form" onsubmit="return false;">
+    ${ csrf_token(request) | n,unicode }
     <div class="modal-header">
         <a href="#" class="close" data-dismiss="modal">&times;</a>
         <h3>${_('Import data')}</h3>

+ 2 - 0
apps/metastore/src/metastore/templates/tables.mako

@@ -35,6 +35,7 @@ ${ components.menubar() }
           <li class="nav-header">${_('database')}</li>
           <li class="white">
             <form action="${ url('metastore:show_tables') }" id="db_form" method="POST" style="margin-bottom: 0">
+              ${ csrf_token(request) | n,unicode }
               ${ db_form | n,unicode }
             </form>
           </li>
@@ -94,6 +95,7 @@ ${ components.menubar() }
 
 <div id="dropTable" class="modal hide fade">
   <form id="dropTableForm" action="${ url('metastore:drop_table', database=database) }" method="POST">
+    ${ csrf_token(request) | n,unicode }
     <div class="modal-header">
       <a href="#" class="close" data-dismiss="modal">&times;</a>
       <h3 id="dropTableMessage">${_('Confirm action')}</h3>

+ 1 - 0
apps/oozie/src/oozie/templates/dashboard/rerun_bundle_popup.mako

@@ -23,6 +23,7 @@
 
 
 <form action="${ action }" method="POST">
+  ${ csrf_token(request) | n,unicode }
   <div class="modal-header">
     <a href="#" class="close" data-dismiss="modal">&times;</a>
     <h3>${ _('Select coordinators to rerun') }</h3>

+ 1 - 0
apps/oozie/src/oozie/templates/dashboard/rerun_coord_popup.mako

@@ -23,6 +23,7 @@
 
 
 <form action="${ action }" method="POST">
+  ${ csrf_token(request) | n,unicode }
   <div class="modal-header">
     <a href="#" class="close" data-dismiss="modal">&times;</a>
     <span class="btn-group pull-right" style="margin-right: 20px">

+ 1 - 1
apps/oozie/src/oozie/templates/dashboard/rerun_job_popup.mako

@@ -23,7 +23,7 @@
 
 
 <form action="${ action }" method="POST">
-
+  ${ csrf_token(request) | n,unicode }
   <div class="modal-header">
     <a href="#" class="close" data-dismiss="modal">&times;</a>
     <h3>${ _('Select actions to rerun') }</h3>

+ 1 - 0
apps/search/src/search/templates/search.mako

@@ -691,6 +691,7 @@ ${ dashboard.layout_skeleton() }
   <!-- ko if: $data.response.numFound > 0 -->
   <span class="pull-right">
     <form method="POST" action="${ url('search:download') }">
+      ${ csrf_token(request) | n,unicode }
       <input type="hidden" name="collection" data-bind="value: ko.mapping.toJSON($root.collection)"/>
       <input type="hidden" name="query" data-bind="value: ko.mapping.toJSON($root.query)"/>
       <input type="hidden" name="download">

+ 1 - 0
apps/spark/src/spark/templates/common.mako

@@ -91,6 +91,7 @@ def is_selected(section, matcher):
 <%def name="uploadAppModal()">
 <div id="uploadAppModal" class="modal hide fade">
   <form class="form-horizontal" id="uploadAppForm" action="${ url('spark:upload_app') }" method="POST" enctype="multipart/form-data">
+  ${ csrf_token(request) | n,unicode }
   <div class="modal-header">
     <a href="#" class="close" data-dismiss="modal">&times;</a>
     <h3>${_('Upload application')}</h3>

+ 1 - 0
apps/spark/src/spark/templates/list_contexts.mako

@@ -76,6 +76,7 @@ ${ common.navbar('contexts') }
 
 <div id="deleteContext" class="modal hide fade">
   <form id="deleteContextForm" action="${ url('spark:delete_contexts') }" method="POST">
+    ${ csrf_token(request) | n,unicode }
     <input type="hidden" name="skipTrash" id="skipTrash" value="false"/>
     <div class="modal-header">
       <a href="#" class="close" data-dismiss="modal">&times;</a>

+ 3 - 0
apps/sqoop/src/sqoop/templates/app.mako

@@ -122,6 +122,7 @@ ${ commonheader(None, "sqoop", user) | n,unicode }
     <div id="job-editor" class="row-fluid section hide" data-bind="with: job">
       <div class="sidebar-nav span2" data-bind="visible: $root.job().persisted">
         <form id="advanced-settings" method="POST" class="form form-horizontal noPadding">
+          ${ csrf_token(request) | n,unicode }
           <ul class="nav nav-list">
             <li class="nav-header" data-bind="visible: $root.job().persisted">${_('Actions')}</li>
             <li data-bind="visible: $root.job().persisted() && !$root.job().isRunning()">
@@ -193,6 +194,7 @@ ${ commonheader(None, "sqoop", user) | n,unicode }
           </ul>
 
           <form method="POST" class="form form-horizontal noPadding" data-bind="with: page">
+            ${ csrf_token(request) | n,unicode }
             <div class="alert alert-info"><h3 data-bind="text: description"></h3></div>
             <div class="job-form" data-bind="template: {'name': template(), 'data': node}">
             </div>
@@ -240,6 +242,7 @@ ${ commonheader(None, "sqoop", user) | n,unicode }
     <div id="connection-editor" class="row-fluid section hide" data-bind="with: editConnection">
       <div id="connection-forms" class="span12">
         <form method="POST" class="form form-horizontal noPadding">
+          ${ csrf_token(request) | n,unicode }
           <div class="control-group">
             <label class="control-label">${ _('Name') }</label>
             <div class="controls">

+ 1 - 0
apps/useradmin/src/useradmin/templates/add_ldap_users.mako

@@ -32,6 +32,7 @@ ${ layout.menubar(section='users') }
     <br/>
 
   <form id="editForm" method="POST" class="form form-horizontal" autocomplete="off">
+    ${ csrf_token(request) | n,unicode }
     <fieldset>
           % for field in form.fields:
                   % if form[field].is_hidden:

+ 2 - 1
apps/useradmin/src/useradmin/templates/confirm.mako

@@ -21,7 +21,8 @@ ${ commonheader(title, "useradmin", user) | n,unicode }
 <div class="container-fluid">
 	<h1>${_('Confirm')}</h1>
 	<form action="${path}" method="POST">
-		${title}
+	    ${ csrf_token(request) | n,unicode }
+	    ${title}
 		<input type="submit" value="${_('Yes')}">
 	</form>
 </div>

+ 1 - 0
apps/useradmin/src/useradmin/templates/edit_group.mako

@@ -57,6 +57,7 @@ ${layout.menubar(section='groups')}
     <br/>
 
     <form id="editForm" action="${urllib.quote(action)}" method="POST" class="form form-horizontal" autocomplete="off">
+      ${ csrf_token(request) | n,unicode }
       <fieldset>
           % for field in form:
         ${render_field(field)}

+ 1 - 0
apps/useradmin/src/useradmin/templates/edit_permissions.mako

@@ -45,6 +45,7 @@ ${layout.menubar(section='permissions')}
     <br/>
 
     <form id="editForm" action="${urllib.quote(action)}" method="POST" class="form form-horizontal">
+      ${ csrf_token(request) | n,unicode }
       <fieldset>
           % for field in form:
           ${render_field(field)}

+ 1 - 0
apps/useradmin/src/useradmin/templates/edit_user.mako

@@ -33,6 +33,7 @@ ${ layout.menubar(section='users') }
 
     <br/>
     <form id="editForm" method="POST" class="form form-horizontal" autocomplete="off">
+    ${ csrf_token(request) | n,unicode }
     <div id="properties" class="section">
       <ul class="nav nav-tabs" style="margin-bottom: 0">
         <li class="active">

+ 1 - 0
apps/useradmin/src/useradmin/templates/list_groups.mako

@@ -108,6 +108,7 @@ ${layout.menubar(section='groups')}
 
 <div id="deleteGroup" class="modal hide fade groupModal">
   <form id="deleteGroupForm" action="${ url('useradmin.views.delete_group') }" method="POST">
+    ${ csrf_token(request) | n,unicode }
     <div class="modal-header">
       <a href="#" class="close" data-dismiss="modal">&times;</a>
       <h3 id="deleteGroupMessage">${_("Are you sure you want to delete the selected group(s)?")}</h3>

+ 1 - 0
apps/useradmin/src/useradmin/templates/list_users.mako

@@ -118,6 +118,7 @@ ${layout.menubar(section='users')}
 
   <div id="deleteUser" class="modal hide fade">
     <form id="dropTableForm" action="${ url('useradmin.views.delete_user') }" method="POST">
+      ${ csrf_token(request) | n,unicode }
       <div class="modal-header">
         <a href="#" class="close" data-dismiss="modal">&times;</a>
 

+ 1 - 0
apps/useradmin/src/useradmin/templates/sync_ldap_users_groups.mako

@@ -34,6 +34,7 @@ from django.utils.translation import ugettext as _
 </%def>
 
 <form action="${path}" method="POST" class="form form-horizontal">
+  ${ csrf_token(request) | n,unicode }
   <div class="modal-header left">
     <button type="button" class="close" data-dismiss="modal">&times;</button>
     <h3>${_('Sync LDAP users and groups')}</h3>

+ 1 - 0
apps/zookeeper/src/zookeeper/templates/create.mako

@@ -39,6 +39,7 @@ ${ shared.menubar() }
 ${ shared.header(_breadcrumbs, clusters) }
 
 <form class="createZnodeForm" action="" method="POST">
+  ${ csrf_token(request) | n,unicode }
   ${form.as_table()|n}
   <br/>
   <br/>

+ 1 - 0
apps/zookeeper/src/zookeeper/templates/edit.mako

@@ -40,6 +40,7 @@ ${ shared.menubar() }
 ${ shared.header(_breadcrumbs,clusters) }
 
 <form action="" method="POST">
+  ${ csrf_token(request) | n,unicode }
   ${form.as_table()|n}
   <br/>
   <input type="submit" class="btn btn-primary" value="${ _('Save') }">

+ 15 - 2
desktop/core/src/desktop/lib/django_mako.py

@@ -23,13 +23,17 @@ import os
 import tempfile
 from mako.lookup import TemplateLookup, TemplateCollection
 import django.template
+from django import template
+
+register = template.Library()
 
 ENCODING_ERRORS = 'replace'
 
 # Things to automatically import into all template namespaces
 IMPORTS=[
   "from desktop.lib.django_mako import url",
-  "from django.utils.html import escape"
+  "from django.utils.html import escape",
+  "from desktop.lib.django_mako import csrf_token"
 ]
 
 class DesktopLookup(TemplateCollection):
@@ -81,7 +85,6 @@ class DesktopLookup(TemplateCollection):
 
 lookup = DesktopLookup()
 
-
 def render_to_string_test(template_name, django_context):
   """
   In tests, send a template rendered signal.  This puts
@@ -121,3 +124,13 @@ def url(view_name, *args, **view_args):
   """URL tag for use in templates - like {% url ... %} in django"""
   from django.core.urlresolvers import reverse
   return reverse(view_name, args=args, kwargs=view_args)
+
+
+from django.core.context_processors import csrf
+
+def csrf_token(request):
+  """
+  Returns the rendered common footer
+  """
+  csrf_token = csrf(request)["csrf_token"]
+  return str.format("<input type='hidden' name='csrfmiddlewaretoken' value='{0}' />",csrf_token)

+ 4 - 2
desktop/core/src/desktop/lib/django_util.py

@@ -25,6 +25,7 @@ import datetime
 
 from django.utils.tzinfo import LocalTimezone
 from django.utils.translation import ungettext, ugettext
+from django.core.context_processors import csrf
 from django.core import urlresolvers, serializers
 from django.conf import settings
 from django.utils.http import urlencode # this version is unicode-friendly
@@ -135,10 +136,10 @@ def _get_template_lib(template, kwargs):
   return template_lib
 
 
-def _render_to_response(template, *args, **kwargs):
+def _render_to_response(template, request, *args, **kwargs):
   template_lib = _get_template_lib(template, kwargs)
-
   if template_lib == DJANGO:
+    kwargs.update(csrf(request))
     return django_render_to_response(template, *args, **kwargs)
   elif template_lib == MAKO:
     return django_mako.render_to_response(template, *args, **kwargs)
@@ -216,6 +217,7 @@ def render(template, request, data, json=None, template_lib=None, force_template
       return render_json(data, request.GET.get("callback"), status=status)
   else:
     return _render_to_response(template,
+                               request,
                                RequestContext(request=request, dict_=data),
                                template_lib=template_lib,
                                status=status,

+ 2 - 1
desktop/core/src/desktop/settings.py

@@ -129,8 +129,9 @@ MIDDLEWARE_CLASSES = [
     'desktop.middleware.ExceptionMiddleware',
     'desktop.middleware.ClusterMiddleware',
     'desktop.middleware.AppSpecificMiddleware',
-    'django.middleware.transaction.TransactionMiddleware'
+    'django.middleware.transaction.TransactionMiddleware',
     # 'debug_toolbar.middleware.DebugToolbarMiddleware'
+    'django.middleware.csrf.CsrfViewMiddleware'
 ]
 
 if os.environ.get(ENV_DESKTOP_DEBUG):

+ 15 - 0
desktop/core/src/desktop/templates/common_header.mako

@@ -175,6 +175,21 @@ from django.utils.translation import ugettext as _
         $.ajaxSetup({ cache: false });
       }
 
+      //Add CSRF Token to all XHR Requests
+      var csrftoken = $.cookie('csrftoken');
+      function csrfSafeMethod(method) {
+        // these HTTP methods do not require CSRF protection
+        return (/^(GET|HEAD|OPTIONS|TRACE)$/.test(method));
+      }
+      $.ajaxSetup({
+        beforeSend: function(xhr, settings) {
+          if (!csrfSafeMethod(settings.type) && !this.crossDomain) {
+            xhr.setRequestHeader("X-CSRFToken", csrftoken);
+          }
+        }
+      });
+      /////
+
       // prevents framebusting and clickjacking
       if (self == top){
         $("body").css({

+ 2 - 2
desktop/core/src/desktop/templates/login.mako

@@ -191,7 +191,7 @@ ${ commonheader("Welcome to Hue", "login", user, "50px") | n,unicode }
       <div id="logo"></div>
 
       <form method="POST" action="${action}" class="well">
-
+        ${ csrf_token(request) | n,unicode }
         %if first_login_ever:
           <h3>${_('Create your Hue account')}</h3>
         %else:
@@ -288,4 +288,4 @@ ${ commonheader("Welcome to Hue", "login", user, "50px") | n,unicode }
   });
 </script>
 
-${ commonfooter(messages) | n,unicode }
+${ commonfooter(messages) | n,unicode }