Use CSRF token on forms to trigger a new builds #3260
Conversation
Avoid "This endpoint is deprecated" raised when hitting and old endpoint with security issues. Now, each view that shows a form with the "Build" button uses the BuildTriggerMixin to handle the POST request and trigger the new build. Closes #3253
readthedocs/builds/views.py
Outdated
| class BuildTriggerMixin(object): | ||
| def post(self, request, project_slug): | ||
| project = get_object_or_404( | ||
| Project.objects.protected(self.request.user), |
There was a problem hiding this comment.
These queryset methods are not documented at all, which we should probably fix, but protected is not the method we want here. This queryset will return projects with the public or protected privacy state, adding projects the user can view, from Project.objects._add_user_repos.
Instead, this should probably be Project.objects.for_admin_user(self.request.user), as we only want to surface the form posting ability for users that are authenticated and own the project.
There was a problem hiding this comment.
Oh, I use the same than in BuildBase.
If I use for_admin_user, who will be able to trigger the builds? Just the owner?
If that's the case, we will need to remove/hide the Build button if the user doesn't own the project, right?
readthedocs/builds/views.py
Outdated
| @@ -33,7 +34,24 @@ def get_queryset(self): | |||
| return queryset | |||
|
|
|||
|
|
|||
| class BuildList(BuildBase, ListView): | |||
| class BuildTriggerMixin(object): | |||
| def post(self, request, project_slug): | |||
There was a problem hiding this comment.
This should not be only for logged in user?
There was a problem hiding this comment.
login_required decorator can be used here
There was a problem hiding this comment.
Good point, we do need to check for a proper request.user here.
There was a problem hiding this comment.
we do need to check for a proper request.user here
what do you mean with this?
The user must be logged in to trigger a build.
Avoid "This endpoint is deprecated" raised when hitting and old
endpoint with security issues.
Now, each view that shows a form with the "Build" button uses the
BuildTriggerMixin to handle the POST request and trigger the new build.
Closes #3253