CSRF protection. #361

[zzz-spline-forum.git] / splinext / forum / __init__.py

diff --git a/splinext/forum/__init__.py b/splinext/forum/__init__.py
index e234c14..806795a 100644 (file)
--- a/splinext/forum/__init__.py
+++ b/splinext/forum/__init__.py
@@ -1,6 +1,6 @@
 from pkg_resources import resource_filename
 
-from pylons import c, session
+from pylons import session, tmpl_context as c
 
 from spline.lib.plugin import PluginBase
 from spline.lib.plugin import PluginBase, PluginLink, Priority
@@ -9,14 +9,17 @@ import splinext.forum.controllers.forum
 
 def add_routes_hook(map, *args, **kwargs):
     """Hook to inject some of our behavior into the routes configuration."""
+    require_GET = dict(conditions=dict(method=['GET']))
     require_POST = dict(conditions=dict(method=['POST']))
 
     map.connect('/forums', controller='forum', action='forums')
-    map.connect('/forums/{forum_id}', controller='forum', action='threads')
-    map.connect('/forums/{forum_id}/threads/{thread_id}', controller='forum', action='posts')
+    map.connect(r'/forums/{forum_id:\d+}', controller='forum', action='threads')
+    map.connect(r'/forums/{forum_id:\d+}/threads/{thread_id:\d+}', controller='forum', action='posts')
 
-    map.connect('/forums/{forum_id}/write', controller='forum', action='write_thread')
-    map.connect('/forums/{forum_id}/threads/{thread_id}/write', controller='forum', action='write')
+    map.connect(r'/forums/{forum_id:\d+}/write', controller='forum', action='write_thread', **require_GET)
+    map.connect(r'/forums/{forum_id:\d+}/write', controller='forum', action='write_thread_commit', **require_POST)
+    map.connect(r'/forums/{forum_id:\d+}/threads/{thread_id:\d+}/write', controller='forum', action='write', **require_GET)
+    map.connect(r'/forums/{forum_id:\d+}/threads/{thread_id:\d+}/write', controller='forum', action='write_commit', **require_POST)
 
 
 class ForumPlugin(PluginBase):
@@ -26,6 +29,16 @@ class ForumPlugin(PluginBase):
         )
 
     def hooks(self):
-        return [
+        hooks = [
             ('routes_mapping',    Priority.NORMAL,      add_routes_hook),
         ]
+
+        # frontpage plugin may or may not be installed
+        try:
+            from splinext.forum.frontpage_sources import ForumSource
+            hooks.append(
+                ('frontpage_updates_forum', Priority.NORMAL, ForumSource))
+        except ImportError:
+            pass
+
+        return hooks