Add global CSRF protection

tailbone/forms/__init__.py

@@ -28,7 +28,7 @@ from __future__ import unicode_literals, absolute_import
 
 from formencode import Schema
 
-from .core import Form, Field, FieldSet, GenericFieldSet, invalid_csrf_token
+from .core import Form, Field, FieldSet, GenericFieldSet
 from .simpleform import SimpleForm, FormRenderer
 from .alchemy import AlchemyForm
 from .fields import AssociationProxyField

tailbone/forms/alchemy.py

@@ -33,7 +33,6 @@ from pyramid.renderers import render
 from webhelpers.html import HTML, tags
 
 from tailbone.db import Session
-from tailbone.forms import invalid_csrf_token
 
 
 class TemplateEngine(fa.templates.TemplateEngine):
@@ -114,8 +113,5 @@ class AlchemyForm(Object):
         self.session.flush()
 
     def validate(self):
-        if invalid_csrf_token(self.request):
-            self.request.session.flash("Invalid CSRF token", 'error')
-            return False
         self.fieldset.rebind(data=self.request.params)
         return self.fieldset.validate()

tailbone/forms/core.py

@@ -33,17 +33,6 @@ from formalchemy.helpers import content_tag
 from pyramid.renderers import render
 
 
-def invalid_csrf_token(request):
-    """
-    Returns boolean indicating whether the given request has an *invalid* CSRF token.
-    """
-    if request.method == 'POST':
-        csrf_token = request.session.get_csrf_token()
-        if request.POST.get('_csrf') != csrf_token:
-            return True
-    return False
-
-
 class Form(object):
     """
     Base class for all forms.

tailbone/forms/simpleform.py

@@ -33,7 +33,7 @@ from pyramid_simpleform import renderers
 from webhelpers.html import tags
 from webhelpers.html import HTML
 
-from tailbone.forms import Form, invalid_csrf_token
+from tailbone.forms import Form
 
 
 class SimpleForm(Form):
@@ -53,9 +53,6 @@ class SimpleForm(Form):
         return super(SimpleForm, self).render(**kwargs)
 
     def validate(self):
-        if invalid_csrf_token(self.request):
-            self.request.session.flash("Invalid CSRF token", 'error')
-            return False
         return self._form.validate()