maciejpi/nordabiz
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix: CSRF exempt classifieds blueprint — interest button 400 fix
Some checks are pending
NordaBiz Tests / Unit & Integration Tests (push) Waiting to run
Details
NordaBiz Tests / E2E Tests (Playwright) (push) Blocked by required conditions
Details
NordaBiz Tests / Smoke Tests (Production) (push) Blocked by required conditions
Details
NordaBiz Tests / Send Failure Notification (push) Blocked by required conditions
Details

Browse Source 
csrf.exempt on the full classifieds blueprint during registration,
same pattern as API blueprint. All classifieds endpoints are behind
@login_required + @member_required so CSRF exemption is safe.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Maciej Pienczyn 2026-04-09 23:27:14 +02:00
parent cab9511498
commit 9efbc7959a
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
blueprints/__init__.py
View File

@ -50,8 +50,10 @@ def register_blueprints(app):
try: try:
from blueprints.community.classifieds import bp as classifieds_bp from blueprints.community.classifieds import bp as classifieds_bp
from extensions import csrf
csrf.exempt(classifieds_bp)
app.register_blueprint(classifieds_bp) app.register_blueprint(classifieds_bp)
logger.info("Registered blueprint: classifieds") logger.info("Registered blueprint: classifieds (with CSRF exemption)")
except ImportError as e: except ImportError as e:
logger.debug(f"Blueprint classifieds not yet available: {e}") logger.debug(f"Blueprint classifieds not yet available: {e}")

2
blueprints/community/classifieds/routes.py
View File

@ -10,7 +10,6 @@ from flask import render_template, request, redirect, url_for, flash, jsonify
from flask_login import login_required, current_user from flask_login import login_required, current_user
from . import bp from . import bp
from extensions import csrf
from database import SessionLocal, Classified, ClassifiedRead, ClassifiedInterest, ClassifiedQuestion, User from database import SessionLocal, Classified, ClassifiedRead, ClassifiedInterest, ClassifiedQuestion, User
from sqlalchemy import desc from sqlalchemy import desc
from utils.helpers import sanitize_input from utils.helpers import sanitize_input
@ -267,7 +266,6 @@ def toggle_active(classified_id):
# ============================================================ # ============================================================
@bp.route('/<int:classified_id>/interest', methods=['POST'], endpoint='classifieds_interest') @bp.route('/<int:classified_id>/interest', methods=['POST'], endpoint='classifieds_interest')
@csrf.exempt
@login_required @login_required
@member_required @member_required
def toggle_interest(classified_id): def toggle_interest(classified_id):