Protection using CSRF tokens.

see #240

modoboa/admin/templates/admin/extensions.html

@@ -1,6 +1,6 @@
 {% load i18n %}{% load url from future %}
 <h2>{% trans "Extensions" %} <small>{% trans "Choose the extension(s) to use" %}</small></h2><hr />
-<form id="settings_form" method="POST" action="{% url 'modoboa.admin.views.saveextensions' %}">
+<form id="settings_form" method="POST" action="{% url 'modoboa.admin.views.saveextensions' %}">{% csrf_token %}
   {{ extensions|safe }}
 </form>
 <a href="#" class="btn btn-primary" id="update" name="update">{% trans 'Save' %}</a>

modoboa/admin/templates/admin/parameters.html

@@ -1,7 +1,7 @@
 {% load i18n libextras %}{% load url from future %}
 {% url "modoboa.admin.views.saveparameters" as action %}
 <h2>{% trans "Parameters" %} <small>{% trans "Configure Modoboa" %}</small></h2><hr />
-<form id="settings_form" method="POST" action="{% url 'modoboa.admin.views.saveparameters' %}" class="form-horizontal">
+<form id="settings_form" method="POST" action="{% url 'modoboa.admin.views.saveparameters' %}" class="form-horizontal">{% csrf_token %}
   {% include "common/parameters.html" %}
 </form>
 <hr>

modoboa/admin/views.py

@@ -561,7 +561,7 @@ def viewparameters(request, tplname='admin/parameters.html'):
     return ajax_simple_response({
         "status": "ok",
         "left_selection": "parameters",
-        "content": render_to_string(tplname, {
+        "content": _render_to_string(request, tplname, {
             "forms": parameters.get_admin_forms
         })
     })

modoboa/core/templates/settings.py

@@ -101,7 +101,7 @@ TEMPLATE_LOADERS = (
 MIDDLEWARE_CLASSES = (
     'django.middleware.common.CommonMiddleware',
     'django.contrib.sessions.middleware.SessionMiddleware',
-    # 'django.middleware.csrf.CsrfViewMiddleware',
+    'django.middleware.csrf.CsrfViewMiddleware',
     'django.contrib.auth.middleware.AuthenticationMiddleware',
     'django.contrib.messages.middleware.MessageMiddleware',
     'django.middleware.locale.LocaleMiddleware',

modoboa/extensions/postfix_autoreply/templates/postfix_autoreply/autoreply.html

@@ -3,7 +3,7 @@
 <hr>
 <form class="form-horizontal" method="POST" 
       action="{% url 'modoboa.extensions.postfix_autoreply.views.autoreply' %}" 
-      id="uprefs_form">
+      id="uprefs_form">{% csrf_token %}
   {% render_form form %}
   <div class="form-actions">
     <button type="submit" class="btn btn-primary" id="update" name="update">{% trans 'Update' %}</button>

modoboa/extensions/postfix_autoreply/views.py

@@ -1,17 +1,19 @@
 # coding: utf-8
 from datetime import date
 from django.http import HttpResponse
-from django.template.loader import render_to_string
 from django.contrib.auth.decorators \
     import login_required
 from django.contrib import messages
 from django.core.urlresolvers import reverse
 from django.utils.translation import ugettext as _
-from modoboa.lib.webutils import _render, ajax_simple_response, ajax_response
+from modoboa.lib.webutils import (
+    ajax_simple_response, ajax_response, _render_to_string
+)
 from modoboa.lib.decorators import needs_mailbox
 from forms import *
 from models import *
 
+
 @login_required
 @needs_mailbox()
 def autoreply(request, tplname="postfix_autoreply/autoreply.html"):
@@ -26,18 +28,17 @@ def autoreply(request, tplname="postfix_autoreply/autoreply.html"):
         else:
             form = ARmessageForm(request.POST)
         if form.is_valid():
-            from modoboa import userprefs
-
             arm = form.save(commit=False)
             arm.untildate = form.cleaned_data["untildate"]
             arm.mbox = mb
             arm.save()
             return ajax_simple_response(dict(
-                status="ok", respmsg=_("Auto reply message updated successfully.")
+                status="ok",
+                respmsg=_("Auto reply message updated successfully.")
             ))
 
         return ajax_simple_response({
-            "status": "ko", 
+            "status": "ko",
             "errors": form.errors,
             "onload_cb": "autoreply_cb"
         })
@@ -48,7 +49,7 @@ def autoreply(request, tplname="postfix_autoreply/autoreply.html"):
     else:
         form.fields['untildate'].initial = date.today()
     return ajax_simple_response({
-            "status" : "ok", 
-            "content" : render_to_string(tplname, {"form" : form}),
-            "onload_cb" : "autoreply_cb"
-            })
+        "status": "ok",
+        "content": _render_to_string(request, tplname, {"form": form}),
+        "onload_cb": "autoreply_cb"
+    })

modoboa/extensions/sievefilters/app_settings.py

@@ -26,7 +26,7 @@ class ParametersForm(AdminParametersForm):
 
     port = forms.IntegerField(
         label=_("Server port"),
-        initial=2000,
+        initial=4190,
         help_text=_("Listening port of your MANAGESIEVE server")
     )
     

modoboa/extensions/sievefilters/templates/sievefilters/rawfilter.html

@@ -1,6 +1,6 @@
 {% load url from future %}
 <form action="{% url 'modoboa.extensions.sievefilters.views.savefs' name %}" 
-      method="POST" id="feditor" name="feditor">
+      method="POST" id="feditor" name="feditor">{% csrf_token %}
   <textarea id="scriptcontent" name="scriptcontent">{{ scriptcontent }}</textarea>
 </form>
 

modoboa/extensions/webmail/templates/webmail/compose.html

@@ -1,5 +1,5 @@
 {% load i18n libextras %}{% load url from future %}
-<form class="form-horizontal" method="POST" action="{{ posturl }}" id="composemail">
+<form class="form-horizontal" method="POST" action="{{ posturl }}" id="composemail">{% csrf_token %}
   <div id="compose-container">
     <div id="mailheader" class="well">
       {% render_field form.to %}

modoboa/templates/common/generic_modal_form.html

@@ -4,7 +4,7 @@
 {% if error %}<div class="alert alert-error">{{ error }}</div>{% endif %}
 <form class="form-horizontal" action="{{ action }}" enctype="{{ enctype }}" 
       method="POST" id="{{ formid }}" name="{{ formid }}"
-      target="{{ target }}">
+      target="{{ target }}">{% csrf_token %}
   {% block formbody %}
   {% render_form form %}
   {% block extrafields %}{% endblock %}

modoboa/templates/common/tabforms.html

@@ -1,7 +1,7 @@
 {% extends "common/generic_modal.html" %}
 {% load i18n libextras %}
 {% block modalbody %}
-  <form id="{{ formid }}" class="form-horizontal" action="{{ action }}" method="POST">
+  <form id="{{ formid }}" class="form-horizontal" action="{{ action }}" method="POST">{% csrf_token %}
     <ul class="nav nav-pills">{% for tab in tabs %}
       <li class="{% if tabs.active_id == tab.id %}active{% endif %}">
         <a href="#{{ tab.id }}" data-toggle="tab">{{ tab.title }}</a>

modoboa/templates/common/wizard_forms.html

@@ -5,7 +5,7 @@
 </div>
 <div class="modal-body">
   <form class="form-horizontal" action="{{ action }}" enctype="{{ enctype }}" 
-        method="POST" id="{{ formid }}" name="{{ formid }}">
+        method="POST" id="{{ formid }}" name="{{ formid }}">{% csrf_token %}
     <div id="wizard" class="carousel">
       <div class="carousel-inner">{% for step in steps %}
         <div id="step{{ forloop.counter }}" 

modoboa/templates/registration/login.html

@@ -27,7 +27,7 @@
         </div>
         <div class="row">
           <form method="post" action="{% url 'modoboa.auth.views.dologin' %}"
-                class="well span3">
+                class="well span3">{% csrf_token %}
             {% render_field form.username %}
             {% render_field form.password %}
             <input type="hidden" name="next" value="{{ next }}" />

modoboa/userprefs/templates/userprefs/preferences.html

@@ -2,7 +2,7 @@
 <h2>{% trans "Preferences" %} <small>{% trans "Customize Modoboa" %}</small></h2>
 <hr>
 <form class="form-horizontal" method="POST" action="{% url 'modoboa.userprefs.views.preferences' %}" 
-      id="uprefs_form">
+      id="uprefs_form">{% csrf_token %}
   {% include "common/parameters.html" %}
   <hr>
   <button type="submit" class="btn btn-primary" id="update" name="update">{% trans 'Save' %}</button>

modoboa/userprefs/templates/userprefs/profile.html

@@ -2,7 +2,7 @@
 <h2>{% trans "Profile" %} <small>{% trans "Update your personal information" %}</small></h2>
 <hr>
 <form class="form-horizontal" method="POST" action="{% url 'modoboa.userprefs.views.profile' %}" 
-      id="uprefs_form">
+      id="uprefs_form">{% csrf_token %}
   {% render_form form %}
   <div class="form-actions">
     <button type="submit" class="btn btn-primary" id="update" name="update">{% trans 'Update' %}</button>

modoboa/userprefs/views.py

@@ -5,7 +5,7 @@ from django.contrib.auth.decorators import login_required, user_passes_test
 from django.utils.translation import ugettext as _
 from modoboa.lib import parameters, events
 from modoboa.lib.exceptions import ModoboaException
-from modoboa.lib.webutils import ajax_response, ajax_simple_response
+from modoboa.lib.webutils import ajax_response, ajax_simple_response, _render_to_string
 from modoboa.admin.models import Mailbox, Alias
 from modoboa.auth.lib import encrypt
 from forms import ForwardForm, BadDestination, ProfileForm
@@ -94,7 +94,7 @@ def profile(request, tplname='userprefs/profile.html'):
     form = ProfileForm(update_password, instance=request.user)
     return ajax_simple_response({
         "status": "ok",
-        "content": render_to_string(tplname, {
+        "content": _render_to_string(request, tplname, {
             "form": form
         })
     })
@@ -116,8 +116,8 @@ def preferences(request):
         })
 
     return ajax_simple_response({
-            "status" : "ok",
-            "content" : render_to_string("userprefs/preferences.html", {
-                    "forms" : parameters.get_user_forms(request.user)
-                    })
-            })
+        "status" : "ok",
+        "content" : _render_to_string(request, "userprefs/preferences.html", {
+            "forms" : parameters.get_user_forms(request.user)
+        })
+    })