Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
my_value = colander.SchemaNode(colander.String())
And in your application code, *bind* the schema, passing the request
as a keyword argument:
.. code-block:: python
def aview(request):
schema = MySchema().bind(request=request)
In order for the CRSFSchema to work, you must configure a *session
factory* in your Pyramid application.
"""
csrf_token = colander.SchemaNode(
colander.String(),
widget=deform.widget.HiddenWidget(),
default=deferred_csrf_value,
validator=deferred_csrf_validator,
)
def translator(term):
request = get_current_request()
if request is not None:
return get_localizer(request).translate(term)
else:
return term.interpolate() if hasattr(term, 'interpolate') else term
def configure_zpt_renderer(search_path=()):
default_paths = deform.form.Form.default_renderer.loader.search_path
paths = []
for path in search_path:
pkg, resource_name = path.split(':')
class ValidationError(httpexceptions.HTTPBadRequest):
pass
class CSRFSchema(colander.Schema):
"""
A CSRFSchema backward-compatible with the one from the hem module.
Unlike hem, this doesn't require that the csrf_token appear in the
serialized appstruct.
"""
csrf_token = colander.SchemaNode(
colander.String(),
widget=deform.widget.HiddenWidget(),
default=deferred_csrf_token,
missing=None,
)
def validator(self, form, value):
request = form.bindings["request"]
check_csrf_token(request)
class JSONSchema:
"""
Validate data according to a Draft 4 JSON Schema.
Inherit from this class and override the `schema` class property with a
valid JSON schema.
"""
def deferred_recaptcha_widget(node, kw):
""" No recaptcha if captcha settings is now present or if the current user is an admin
"""
context = kw['context']
request = kw['request']
api = kw['api']
# Get principals for current user
principals = api.context_effective_principals(context)
if api.root.get_field_value('captcha_registration', False) and security.ROLE_ADMIN not in principals:
return RecaptchaWidget(api.root.get_field_value('captcha_public_key', ''),
api.root.get_field_value('captcha_private_key', ''))
return deform.widget.HiddenWidget()
my_value = colander.SchemaNode(colander.String())
And in your application code, *bind* the schema, passing the request as a keyword argument:
.. code-block:: python
def aview(request):
schema = MySchema().bind(request=request)
The token is automatically then verified by Pyramid CSRF view deriver.
Original code: https://github.com/Pylons/pyramid_deform/blob/master/pyramid_deform/__init__.py
"""
csrf_token = colander.SchemaNode(
colander.String(),
widget=deform.widget.HiddenWidget(),
default=deferred_csrf_value,
)
csrf_token.dictify_by_default = False
def add_csrf(schema: colander.Schema):
"""Add a hidden csrf_token field on the existing Colander schema."""
csrf_token = colander.SchemaNode(colander.String(), name="csrf_token", widget=deform.widget.HiddenWidget(), default=deferred_csrf_value)
csrf_token.dictify_by_default = False
schema.add(csrf_token)
@view_config(renderer='templates/form.pt', name='hidden_field')
@demonstrate('Hidden Field Widget')
def hidden_field(self):
class Schema(colander.Schema):
sneaky = colander.SchemaNode(
colander.Boolean(),
widget = deform.widget.HiddenWidget(),
default=True,
)
schema = Schema()
form = deform.Form(schema, buttons=('submit',))
return self.render_form(form)
@view_config(renderer='templates/form.pt', name='hiddenmissing')
@demonstrate('Hidden, Missing Widget Representing an Integer')
def hiddenmissing(self):
class Schema(colander.Schema):
title = colander.SchemaNode(
colander.String())
number = colander.SchemaNode(
colander.Integer(),
widget = deform.widget.HiddenWidget(),
missing=colander.null,
)
schema = Schema()
form = deform.Form(schema, buttons=('submit',))
return self.render_form(form)
def post(self):
"""
Handle submission of the reset password form.
This function checks that the activation code (i.e. reset token)
provided by the form is valid, retrieves the user associated with the
activation code, and resets their password.
"""
try:
appstruct = self.form.validate(self.request.POST.items())
except deform.ValidationFailure:
# If the code is valid, hide the field.
if not self.form["user"].error:
self.form.set_widgets({"user": deform.widget.HiddenWidget()})
return {"form": self.form.render()}
self._reset_password(appstruct["user"], appstruct["password"])
return httpexceptions.HTTPFound(location=self.request.route_path("index"))
.. code-block:: python
def view(request):
schema = MySchema().bind(request=request)
When using Pyramid 1.7+, the CSRF token is validated by CSRF view deriver.
More information
http://docs.pylonsproject.org/projects/pyramid/en/latest/narr/sessions.html?highlight=csrf#checking-csrf-tokens-automatically
"""
csrf_token = colander.SchemaNode(
colander.String(),
widget=widget.HiddenWidget(),
default=deferred_csrf_value,
)
password = password_node()
@schema_factory('RequestNewPasswordSchema', title = _(u"Request new password"), description = _(u"Use this form to request a new password"))
class RequestNewPasswordSchema(colander.Schema):
userid_or_email = colander.SchemaNode(colander.String(),
title = _(u"UserID or email address."))
@schema_factory('TokenPasswordChangeSchema')
class TokenPasswordChangeSchema(colander.Schema):
#FIXME: Implement captcha here to avoid bruteforce
token = colander.SchemaNode(colander.String(),
validator = deferred_password_token_validator,
missing = u'',
widget = deform.widget.HiddenWidget(),)
password = password_node()