lp:~rvb/maas/1.5-bug-1298790

Branch merges

Propose for merging

Merged into lp:maas/1.5 at revision 2219

MAAS Maintainers: Pending requested 2014-04-02

Diff: 116 lines (+70/-3)

3 files modified

src/maasserver/templates/maasserver/logout_confirm.html (+21/-0)
src/maasserver/views/account.py (+24/-2)
src/maasserver/views/tests/test_account.py (+25/-1)

api

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Bug #1298790: Logout page vulnerable to CSRF

High

Fix Released

Link a bug report

Related blueprints

2219. By Raphaël Badin on 2014-04-02

Backport revision 2219: Add a 'logout confirmation' page. Using this, the logout action is protected against CSRF attacks because it uses a POST request, in conjunction with Django's CSRF protection feature.

2218. By Jeroen T. Vermeulen on 2014-04-02

[r=allenap][bug=1300587][author=jtv] Remove the cloud_images_archive setting, which has become unused. And, stop passing the archive settings to the import script: it only cares about Simplestreams sources now, not archive URLs.

2217. By Gavin Panella on 2014-04-01

[r=jtv][bug=1300363][author=allenap] Take an advisory lock to prevent concurrent creation of the eventloops table.

Creating tables in PostgreSQL is a transactional operation like any
other. If the isolation level is not sufficient - the default in Django
- it is susceptible to races. Using a higher isolation level may lead to
serialisation failures, for example. Advisory locking side-steps this.

2216. By Blake Rouse on 2014-04-01

[r=jtv][bug=1300285][author=blake-rouse] Resolves issue where if a node does not provide an architecture type on dhcp request, or no other boot method is available for that architecture, the node still uses pxelinux.0 to boot.

2215. By Jeroen T. Vermeulen on 2014-04-01

[r=allenap][bug=][author=jtv] Drop unused NetworkListForm. It was probably just a development placeholder for unblocking other work, while someone else wrote NetworksListingForm which we actually use.

2214. By Jeroen T. Vermeulen on 2014-04-01

[r=allenap][bug=1299114][author=jtv] Fix inappropriate ValidationError when defining networks with nested (but non-identical) address ranges.

2213. By Jeroen T. Vermeulen on 2014-04-01

[r=allenap][bug=1295479][author=jtv] Remove remains of the old import script: tests, and the passing of archive URLs (not used by Simplestreams) through environment variables.

2212. By Jeroen T. Vermeulen on 2014-04-01

[r=jtv][bug=][author=jtv] Clarify a phrase in the maas-import-pxe-files manpage.

2211. By Jeroen T. Vermeulen on 2014-04-01

[r=rvb][bug=][author=jtv] Unit-test a few more of the functions in the new import script. Undo an accidental change which had boot_merge overwriting existing entries.

2210. By Jeroen T. Vermeulen on 2014-04-01

[r=julian-edwards,rvb][bug=][author=jtv] Update some bits of the maas-import-pxe-files manpage that were specific to the old script.