self-hosted/Mailu
1
0
Fork 0
mirror of https://github.com/Mailu/Mailu.git synced 2025-01-28 03:56:43 +02:00
Code Issues Releases Activity

Disable anti-csrf on the login form

Browse Source 
The rationale is that the attacker doesn't have the password...
and that doing it this way we avoid creating useless sessions
This commit is contained in:
Florent Daigniere 2021-02-22 21:59:15 +01:00
parent 481cb67392
commit 64d757582d
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
core/admin/mailu/ui/forms.py
View File

@ -46,6 +46,8 @@ class ConfirmationForm(flask_wtf.FlaskForm):
class LoginForm(flask_wtf.FlaskForm):
class Meta:
csrf = False
email = fields.StringField(_('E-mail'), [validators.Email()])
pw = fields.PasswordField(_('Password'), [validators.DataRequired()])
submit = fields.SubmitField(_('Sign in'))