665950 - Copy fails with CSRF error

Status: RESOLVED DUPLICATE of bug 652875

(addons.mozilla.org Graveyard :: Add-on Builder, defect, P1)

Description

[Andy McKay]

Clicking on copy in builder generates a 403 error, CSRF verification failed.

http://screencast.com/t/zyvT0TYZAV

Comment 1

[Sean McArthur [:seanmonstar]]

Didn't AMO change the way they handle CSRF? Would us pulling that into Flightdeck help remove these errors?

Comment 2

[Wil Clouser [:clouserw]]

Yeah, they no longer use the built-in CSRF (which means you don't need referrers on anymore).  They're also using jinja though, and I'm not sure if that is integrated or not.

Comment 3

[Piotr Zalewa [:zalun]]

Copy shouldn't be a POST - it's just taking the revision.pk and copies it to a new package.
in review https://github.com/zalun/FlightDeck/commit/9b430f7d2b1ce2ff74686bca00e9c1b1b22ee266

Comment 4

[Wil Clouser [:clouserw]]

r-.  Copy does need to be a POST.  You're altering data for the user on the server

Comment 5

[Piotr Zalewa [:zalun]]

right

Comment 6

[Piotr Zalewa [:zalun]]

and it wasn't the case as the 'post' isn't even called.
CSRF is broken when user is redirected after successful login.
I think it might happen be that the page is loaded from browser cache with wrong csrf.

Comment 8

[Alexandre Poirot [:ochameau]]

There is still an issue with "Copy" feature.
If always fails if you have never create an addon while you signed in!

Steps to reproduce:
 Logout
 Sign in
 open any existing addon
 click on Copy
 --> CSRF error popup
 
 Now if you create an addon, then open an addon. Copy is going to work :o