This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/allura.git
The following commit(s) were added to refs/heads/master by this push:
new 32aa4dc40 form-action change from self to base_url to avoid proxied
sites
32aa4dc40 is described below
commit 32aa4dc400a9b58eaf9919ec27de176e467fa564
Author: Daniel Castillo <[email protected]>
AuthorDate: Tue May 19 19:23:09 2026 +0000
form-action change from self to base_url to avoid proxied sites
---
Allura/allura/tests/functional/test_root.py | 6 +++---
Allura/test.ini | 1 +
2 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/Allura/allura/tests/functional/test_root.py
b/Allura/allura/tests/functional/test_root.py
index 3fadfa247..1c0b8c8f7 100644
--- a/Allura/allura/tests/functional/test_root.py
+++ b/Allura/allura/tests/functional/test_root.py
@@ -212,7 +212,7 @@ def test_error_page(self):
'csp.script_src_enforce': True})
def test_headers(self):
resp = self.app.get('/p')
- expected_headers = "form-action 'self'; frame-src 'self'
www.youtube-nocookie.com; object-src 'none';"
+ expected_headers = f"form-action {tg.config['base_url']}; frame-src
'self' www.youtube-nocookie.com; object-src 'none';"
expected_headers += "frame-ancestors 'self'; report-uri
https://example.com/r/d/csp/enforce; script-src 'self;"
csp_headers = resp.headers.getall('Content-Security-Policy')[0]
assert all([h.strip() in csp_headers for h in
expected_headers.split(';')])
@@ -228,7 +228,7 @@ def test_headers_report(self):
resp = self.app.get('/p/wiki/Home/')
expected_headers = "report-uri https://example.com/r/d/csp/reportOnly;";
expected_headers += "frame-src 'self' www.youtube-nocookie.com;
script-src 'self' ;"
- expected_headers += "form-action 'self'"
+ expected_headers += f"form-action {tg.config['base_url']}"
csp_headers =
resp.headers.getall('Content-Security-Policy-Report-Only')[0]
assert all([h.strip() in csp_headers for h in
expected_headers.split(';')])
@@ -240,7 +240,7 @@ def test_headers_frame_sources_enforce(self):
expected_headers = "report-uri https://example.com/r/d/csp/enforce;";
expected_headers += "frame-src 'self' www.youtube-nocookie.com;"
expected_headers += "object-src 'none'"
- expected_report_headers = "script-src 'self' ; form-action 'self'"
+ expected_report_headers = f"script-src 'self' ; form-action
{tg.config['base_url']}"
csp_headers = resp.headers.getall('Content-Security-Policy')[0]
csp_report_headers =
resp.headers.getall('Content-Security-Policy-Report-Only')[0]
assert all([h.strip() in csp_headers for h in
expected_headers.split(';')])
diff --git a/Allura/test.ini b/Allura/test.ini
index 24770373d..a01d13359 100644
--- a/Allura/test.ini
+++ b/Allura/test.ini
@@ -54,6 +54,7 @@ debug = false
stats.sample_rate = 0
base_url = http://localhost
+csp.form_action_urls = http://localhost
; specify these without any build_key being included
ew.script_name = /nf/_ew_/
