IntenseWebs/pgadmin4
3
0
Fork 0
mirror of https://github.com/pgadmin-org/pgadmin4.git synced 2025-02-25 18:55:31 -06:00
Code Issues Packages Projects Releases Wiki Activity

Allow enhanced cookie protection to be disabled for compatibility with dynamically addressed hosting environments. Fixes #4566

Browse Source
This commit is contained in:
Murtuza Zabuawala
2019-08-06 09:21:31 +01:00
committed by Dave Page
parent f8afe2ef94
commit ee8fec6d7f
3 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
web/config.py
View File

@@ -432,6 +432,16 @@ ALLOW_SAVE_TUNNEL_PASSWORD = False
##########################################################################
MASTER_PASSWORD_REQUIRED = True
##########################################################################
# Allows pgAdmin4 to create session cookies based on IP address, so even
# if a cookie is stolen, the attacker will not be able to connect to the
# server using that stolen cookie.
# Note: This can cause problems when the server is deployed in dynamic IP
# address hosting environments, such as Kubernetes or behind load
# balancers. In such cases, this option should be set to False.
##########################################################################
ENHANCED_COOKIE_PROTECTION = True
##########################################################################
# Local config settings
##########################################################################

2
web/pgadmin/__init__.py
View File

@@ -390,7 +390,7 @@ def create_app(app_name=None):
)
# Make the Session more secure against XSS & CSRF when running in web mode
if config.SERVER_MODE:
if config.SERVER_MODE and config.ENHANCED_COOKIE_PROTECTION:
paranoid = Paranoid(app)
paranoid.redirect_view = 'browser.index'