colin
/
nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

pgadmin4: fix CSRF issue 

Without the downgrade of flask-security-too to 5.4.1
pgadmin4 is unusable, because one cannot login.

Alternatively one could disable CSRF altogether with the
module. This would still make the desktop version unusable
and impact security. Therefore flask-security-too is being
downgraded.

Signed-off-by: Florian Brandes <florian.brandes@posteo.de>
This commit is contained in:
Florian Brandes 2024-04-09 15:34:34 +02:00
parent c81c241415
commit 62faf6cddf
No known key found for this signature in database
GPG Key ID: 074048E893713170
1 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
pkgs/tools/admin/pgadmin/default.nix
View File

@ -26,7 +26,18 @@ let
# keep the scope, as it is used throughout the derivation and tests
# this also makes potential future overrides easier
pythonPackages = python3.pkgs.overrideScope (final: prev: rec { });
pythonPackages = python3.pkgs.overrideScope (final: prev: rec {
# Flask 5.4.3 introduces an CSRF error which makes it impossible to login
# So either we downgrade flask here or use "WTF_CSRF_ENABLED = false" in the
# module config to disable CSRF.
flask-security-too = prev.flask-security-too.overridePythonAttrs (oldAttrs: rec {
version = "5.4.1";
src = oldAttrs.src.override {
inherit version;
hash = "sha256-Ay7+gk+zuUlXtw0LDdsnvSa22z+yE6VR1guu9QmiFvw=";
};
});
});
offlineCache = fetchYarnDeps {
yarnLock = ./yarn.lock;