Skip to content

Commit

Permalink
Remove workaround from check_csrf() (#6919)
Browse files Browse the repository at this point in the history
This code was supposed to be temporary, and raises an exception if REDASH_MULTI_ORG=true is set.
  • Loading branch information
eradman authored Apr 23, 2024
1 parent 6c68b48 commit e2a39de
Showing 1 changed file with 1 addition and 12 deletions.
13 changes: 1 addition & 12 deletions redash/security.py
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
import functools

from flask import request, session
from flask import session
from flask_login import current_user
from flask_talisman import talisman
from flask_wtf.csrf import CSRFProtect, generate_csrf
Expand Down Expand Up @@ -35,17 +35,6 @@ def inject_csrf_token(response):

@app.before_request
def check_csrf():
# BEGIN workaround until https://github.com/lepture/flask-wtf/pull/419 is merged
if request.blueprint in csrf._exempt_blueprints:
return

view = app.view_functions.get(request.endpoint)
dest = f"{view.__module__}.{view.__name__}"

if dest in csrf._exempt_views:
return
# END workaround

if not current_user.is_authenticated or "user_id" in session:
csrf.protect()

Expand Down

0 comments on commit e2a39de

Please sign in to comment.