{"push_id":781208639,"size":1,"distinct_size":1,"ref":"refs/heads/lg-csrf-tracing","head":"120659b4c6d7d6e7124eb0cc7f43c70814cebd19","before":"4343c5664df757c71759a4847af210eccd207bd3","commits":[{"sha":"120659b4c6d7d6e7124eb0cc7f43c70814cebd19","author":{"email":"0853bffa8bdda3b53ed64ee24f78356fe48f0d7d@4teamwork.ch","name":"Lukas Graf"},"message":"CSRF: Add view to enable and disable CSRF tracing monkey patches.\n\nThis view allows to enable CSRF tracing, which will monkey patch\nthe method for object registration on the ZODB connection in\norder to save a stack trace at the point a persistent object has\nbeen registered (i.e. changed for the first time in a transaction).\n\nActivating CSRF tracing will patch two methods: register() on the\nZODB connection and _build_csrf_report() on our own\nOGProtectTransform. The patch to register() will save a formatted\nstack trace to a module global every time a persistent object is\nmodified for the first time in a transaction. This will then allow\nthe patched _build_csrf_report() to include that stored stack\ntrace in the CSRF incident log if a CSRF confirmation dialog is\ntriggered.\n\nThose patches can also be reverted from this view: The respective\nmethods will then be restored to their original state.\n\nAdditionally, there is a timeout after which the patches will\nexpire, and remove themselves the next time they're called.","distinct":true,"url":"https://api.github.com/repos/4teamwork/opengever.maintenance/commits/120659b4c6d7d6e7124eb0cc7f43c70814cebd19"}]}