Homec4science

Remove the developer-specific CSRF help in phabricator_form()

Authored by epriestley <git@epriestley.com> on Apr 15 2014, 19:18.

Description

Remove the developer-specific CSRF help in phabricator_form()

Summary:
Fixes T4802. For context, see T1921.

Originally (in T1921), a developer ran into an issue where rendering phabricator_form() with an absolute URI confusingly dropped CSRF tokens, and it wasn't obvious why. This is a security measure, but at the time it wasn't very clear how all the pieces fit together. To make it more clear, we:

  1. expanded the exception text in developer mode to include a description of this issue; and
  2. added an exception in developer mode when rendering a form like this.

However, (2) causes some undesirable interactions for file downloads. In particular, if:

  • developer mode is on; and
  • there's no alternate file domain configured; and
  • you try to download a file...

...we produce CDN URIs that are fully-qualified, and you get the exception from (2) above.

This is kind of a mess, and producing fully-qualified CDN URIs in all cases is simple and clear and desirable. To resolve this, just revert (2). We still have the clarification from (1) above and this hasn't caused further issues, so I think that's sufficient. This is a rare issue anyway and not particularly serious or error prone (at worst, a bit confusing and annoying, but hopefully easy to understand and resolve after the changes in (1)).

Test Plan: With develper mode and no alternate file domain, downloaded files from Files.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T4802

Differential Revision: https://secure.phabricator.com/D8776

Details

Committed
epriestley <git@epriestley.com>Apr 15 2014, 19:18
Pushed
aubortJan 31 2017, 17:16
Parents
rPHcb545856a9b8: Make task queue more robust against long-running tasks
Branches
Unknown
Tags
Unknown

Event Timeline

epriestley <git@epriestley.com> committed rPH04c07a7a7b6d: Remove the developer-specific CSRF help in phabricator_form() (authored by epriestley <git@epriestley.com>).Apr 15 2014, 19:18