2.0.0-rc2: Achievements Refactored & Admin improved.

web/auth.py

@@ -1,5 +1,8 @@
 from functools import wraps
-from flask import session, redirect, url_for, flash
+import hmac
+import secrets
+
+from flask import abort, flash, request, session, redirect, url_for
 
 def admin_required(f):
     @wraps(f)
@@ -9,3 +12,32 @@ def admin_required(f):
         flash('Admin access required', 'warning')
         return redirect(url_for('admin.login'))
     return decorated_function
+
+
+def get_csrf_token():
+    token = session.get('_csrf_token')
+    if not token:
+        token = secrets.token_urlsafe(32)
+        session['_csrf_token'] = token
+    return token
+
+
+def validate_csrf():
+    expected = session.get('_csrf_token')
+    received = (
+        request.headers.get('X-CSRF-Token')
+        or request.form.get('_csrf_token')
+    )
+    if not expected or not received or not hmac.compare_digest(
+        str(expected),
+        str(received),
+    ):
+        abort(400, description='Invalid CSRF token')
+
+
+def csrf_protected(f):
+    @wraps(f)
+    def decorated_function(*args, **kwargs):
+        validate_csrf()
+        return f(*args, **kwargs)
+    return decorated_function