Rakseeibra/arrr-erp
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Phase 3 harden CSRF invalid POST and work access handling

Browse Source
This commit is contained in:
A R R R Associates
2026-06-26 11:41:00 +05:30
parent 4ce5556e9d
commit fc31a5f4e9
7 changed files with 503 additions and 94 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/modules/marketplace/ui.py
+30 -6
View File
@@ -34,6 +34,12 @@ router = APIRouter(prefix="/marketplace", tags=["marketplace-ui"])
public_router = APIRouter(tags=["marketplace-public-ui"])
def _csrf_rejected(request: Request):
from app.core.http_responses import forbidden_response
return forbidden_response(request, "CSRF validation failed")
def _public_marketplace_ctx(request: Request, db, **ctx):
@@ -135,7 +141,10 @@ def marketplace_public_request_service_submit(request: Request, csrf_token: str
return RedirectResponse(url="/marketplace/public-lead", status_code=303)
db = CommonSessionLocal()
try:
validate_csrf(request, csrf_token)
try:
validate_csrf(request, csrf_token)
except PermissionError:
return _csrf_rejected(request)
lead = create_marketplace_lead(
db,
lead_name=lead_name,
@@ -254,7 +263,10 @@ def lead_create(request: Request, csrf_token: str = Form(...), lead_name: str =
user, response = _require_user(request, db, "marketplace_leads.create")
if response:
return response
validate_csrf(request, csrf_token)
try:
validate_csrf(request, csrf_token)
except PermissionError:
return _csrf_rejected(request)
lead = create_marketplace_lead(db, lead_name=lead_name, business_name=business_name, email=email, mobile=mobile, city=city, state=state, service_category=service_category, service_requested=service_requested, message=message, source=source, priority=priority, estimated_value=estimated_value, created_by_user_id=user.id)
return RedirectResponse(url=f"/marketplace/leads/{lead.id}", status_code=303)
finally:
@@ -274,7 +286,10 @@ def public_lead_form(request: Request):
def public_lead_submit(request: Request, csrf_token: str = Form(...), lead_name: str = Form(...), business_name: str = Form(""), email: str = Form(""), mobile: str = Form(""), city: str = Form(""), state: str = Form(""), service_category: str = Form(""), service_requested: str = Form(...), message: str = Form("")):
db = CommonSessionLocal()
try:
validate_csrf(request, csrf_token)
try:
validate_csrf(request, csrf_token)
except PermissionError:
return _csrf_rejected(request)
lead = create_marketplace_lead(db, lead_name=lead_name, business_name=business_name, email=email, mobile=mobile, city=city, state=state, service_category=service_category, service_requested=service_requested, message=message, source="public_website", priority="NORMAL")
return _render(request, "modules/marketplace/templates/marketplace/public_thank_you.html", db, None, title="Thank You", lead=lead)
finally:
@@ -303,7 +318,10 @@ def lead_assign(request: Request, lead_id: int, csrf_token: str = Form(...), ten
user, response = _require_user(request, db, "marketplace_leads.assign")
if response:
return response
validate_csrf(request, csrf_token)
try:
validate_csrf(request, csrf_token)
except PermissionError:
return _csrf_rejected(request)
lead = get_marketplace_lead(db, lead_id)
if lead:
assign_marketplace_lead(db, lead=lead, tenant_id=tenant_id, branch_id=branch_id or None, partner_user_id=partner_user_id or None, notes=notes, assigned_by_user_id=user.id)
@@ -319,7 +337,10 @@ def lead_status_update(request: Request, lead_id: int, csrf_token: str = Form(..
user, response = _require_user(request, db, "marketplace_leads.update")
if response:
return response
validate_csrf(request, csrf_token)
try:
validate_csrf(request, csrf_token)
except PermissionError:
return _csrf_rejected(request)
lead = get_marketplace_lead(db, lead_id)
if lead:
update_lead_status(db, lead=lead, status=status, user_id=user.id)
@@ -335,7 +356,10 @@ def lead_convert_client(request: Request, lead_id: int, csrf_token: str = Form(.
user, response = _require_user(request, db, "marketplace_leads.convert")
if response:
return response
validate_csrf(request, csrf_token)
try:
validate_csrf(request, csrf_token)
except PermissionError:
return _csrf_rejected(request)
lead = get_marketplace_lead(db, lead_id)
if lead:
client = convert_lead_to_client(db, lead=lead, tenant_id=tenant_id, branch_id=branch_id, partner_user_id=partner_user_id or None, client_code=client_code, user_id=user.id)