diff --git a/apiserver/plane/authentication/views/common.py b/apiserver/plane/authentication/views/common.py index 640f744ce..3e95d6ed8 100644 --- a/apiserver/plane/authentication/views/common.py +++ b/apiserver/plane/authentication/views/common.py @@ -1,3 +1,6 @@ +# Django imports +from django.shortcuts import render + # Third party imports from rest_framework import status from rest_framework.permissions import AllowAny @@ -17,7 +20,7 @@ from plane.authentication.adapter.error import ( ) from django.middleware.csrf import get_token from plane.utils.cache import invalidate_cache - +from plane.authentication.utils.host import base_host class CSRFTokenEndpoint(APIView): @@ -34,6 +37,11 @@ class CSRFTokenEndpoint(APIView): ) +def csrf_failure(request, reason=""): + """Custom CSRF failure view""" + return render(request, "csrf_failure.html", {"reason": reason, "root_url": base_host(request=request)}) + + class ChangePasswordEndpoint(APIView): def post(self, request): user = User.objects.get(pk=request.user.id) diff --git a/apiserver/plane/settings/common.py b/apiserver/plane/settings/common.py index ed756642b..853478c75 100644 --- a/apiserver/plane/settings/common.py +++ b/apiserver/plane/settings/common.py @@ -345,6 +345,7 @@ CSRF_COOKIE_SECURE = secure_origins CSRF_COOKIE_HTTPONLY = True CSRF_TRUSTED_ORIGINS = cors_allowed_origins CSRF_COOKIE_DOMAIN = os.environ.get("COOKIE_DOMAIN", None) +CSRF_FAILURE_VIEW = "plane.authentication.views.common.csrf_failure" # Base URLs ADMIN_BASE_URL = os.environ.get("ADMIN_BASE_URL", None) diff --git a/apiserver/templates/csrf_failure.html b/apiserver/templates/csrf_failure.html new file mode 100644 index 000000000..b5a58cb02 --- /dev/null +++ b/apiserver/templates/csrf_failure.html @@ -0,0 +1,66 @@ + + + + + + + CSRF Verification Failed + + + +
+
+

CSRF Verification Failed

+
+
+

+ It looks like your form submission has expired or there was a problem + with your request. +

+

Please try the following:

+ + Go to Home Page +
+
+ +