Use LenientForm instead Form for CSRF protected pages #751
No reviewers
Labels
No labels
A: API
A: Backend
A: Federation
A: Front-End
A: I18N
A: Meta
A: Security
Build
C: Bug
C: Discussion
C: Enhancement
C: Feature
Compatibility
Dependency
Design
Documentation
Good first issue
Help welcome
Mobile
Rendering
S: Blocked
S: Duplicate
S: Incomplete
S: Instance specific
S: Invalid
S: Needs Voting/Discussion
S: Ready for review
Suggestion
S: Voted on Loomio
S: Wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: Plume/Plume#751
Loading…
Add table
Reference in a new issue
No description provided.
Delete branch "csrf-token-in-form"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Hi,
I found that password reset request(
POST /password-reset
) and password reset(POST /password-reset/<token>
) cause 422 Unprocessable Entity because Plume attempts to parsecsrf-token
in form to model fields. UsingLenientForm
instead ofForm
solved this problem.Codecov Report
Thanks :)
Thank you for meeting!