From aa2354a25a528d7ffd7d9cd81838269bd57c0b58 Mon Sep 17 00:00:00 2001 From: bruno Date: Mon, 13 Jul 2026 21:01:21 -0400 Subject: [PATCH] fix: exempt /api/admin + /api/gitea du CSRF middleware MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Les endpoints admin ont déjà leur propre protection admin_required. Le CSRF middleware bloquait les DELETE/PUT sur ces routes. --- app/middleware/csrf.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/middleware/csrf.py b/app/middleware/csrf.py index cca9a01..ea280cd 100644 --- a/app/middleware/csrf.py +++ b/app/middleware/csrf.py @@ -16,7 +16,7 @@ class CSRFMiddleware(BaseHTTPMiddleware): """ SAFE_METHODS = {"GET", "HEAD", "OPTIONS"} - EXCLUDED_PATHS = {"/api/webhook", "/api/v1", "/auth/callback", "/auth/register", "/auth/local-login", "/api/user", "/board/api/pages", "/board/api/favorites", "/api/workspace", "/api/local-workspace", "/api/settings", "/db/", "/workspace", "/api/frontend-error"} + EXCLUDED_PATHS = {"/api/webhook", "/api/v1", "/auth/callback", "/auth/register", "/auth/local-login", "/api/user", "/board/api/pages", "/board/api/favorites", "/api/workspace", "/api/local-workspace", "/api/settings", "/db/", "/workspace", "/api/frontend-error", "/api/admin", "/api/gitea"} async def dispatch(self, request: Request, call_next): # Webhook receiver, OAuth callback, and internal API are exempt