
import colander
import deform

@colander.deferred
def deferred_csrf_default(node, kw):
    request = kw.get('request')
    csrf_token = request.session.get_csrf_token()
    return csrf_token

@colander.deferred
def deferred_csrf_validator(node, kw):
    def validate_csrf(node, value):
        request = kw.get('request')
        csrf_token = request.session.get_csrf_token()
        if value != csrf_token:
            raise colander.Invalid(node, _('Invalid cross-site scripting token'))
    return validate_csrf

class CSRFSchema(colander.Schema):
    csrf_token = colander.SchemaNode(
            colander.String(),
            default=deferred_csrf_default,
            validator=deferred_csrf_validator,
            widget=deform.widget.HiddenWidget()
            )



import colander
import deform

@colander.deferred
def deferred_csrf_default(node, kw):
    request = kw.get('request')

    if request is None:
        raise KeyError('Require bind: request')

    csrf_token = request.session.get_csrf_token()
    return csrf_token

@colander.deferred
def deferred_csrf_validator(node, kw):
    request = kw.get('request')

    if request is None:
        raise KeyError('Require bind: request')

    def validate_csrf(node, value):
        csrf_token = request.session.get_csrf_token()
        if value != csrf_token:
            raise colander.Invalid(node, _('Invalid cross-site scripting token'))
    return validate_csrf

class CSRFSchema(colander.Schema):
    csrf_token = colander.SchemaNode(
            colander.String(),
            default=deferred_csrf_default,
            validator=deferred_csrf_validator,
            widget=deform.widget.HiddenWidget()
            )


Add some checking that stuff is bound
Add some checking that stuff is bound

Specifically we require that request is bound to the form.

  
  import colander
  import deform
  
  @colander.deferred
  def deferred_csrf_default(node, kw):
      request = kw.get('request')
+ 
+     if request is None:
+         raise KeyError('Require bind: request')
+ 
      csrf_token = request.session.get_csrf_token()
      return csrf_token
  
  @colander.deferred
  def deferred_csrf_validator(node, kw):
+     request = kw.get('request')
+ 
+     if request is None:
+         raise KeyError('Require bind: request')
+ 
      def validate_csrf(node, value):
-         request = kw.get('request')
          csrf_token = request.session.get_csrf_token()
          if value != csrf_token:
              raise colander.Invalid(node, _('Invalid cross-site scripting token'))
      return validate_csrf
  
  class CSRFSchema(colander.Schema):
      csrf_token = colander.SchemaNode(
              colander.String(),
              default=deferred_csrf_default,
              validator=deferred_csrf_validator,
              widget=deform.widget.HiddenWidget()
              )
  
  
Add some checking that stuff is bound
## Code Before:

import colander
import deform

@colander.deferred
def deferred_csrf_default(node, kw):
    request = kw.get('request')
    csrf_token = request.session.get_csrf_token()
    return csrf_token

@colander.deferred
def deferred_csrf_validator(node, kw):
    def validate_csrf(node, value):
        request = kw.get('request')
        csrf_token = request.session.get_csrf_token()
        if value != csrf_token:
            raise colander.Invalid(node, _('Invalid cross-site scripting token'))
    return validate_csrf

class CSRFSchema(colander.Schema):
    csrf_token = colander.SchemaNode(
            colander.String(),
            default=deferred_csrf_default,
            validator=deferred_csrf_validator,
            widget=deform.widget.HiddenWidget()
            )


## Instruction:
Add some checking that stuff is bound
## Code After:

import colander
import deform

@colander.deferred
def deferred_csrf_default(node, kw):
    request = kw.get('request')

    if request is None:
        raise KeyError('Require bind: request')

    csrf_token = request.session.get_csrf_token()
    return csrf_token

@colander.deferred
def deferred_csrf_validator(node, kw):
    request = kw.get('request')

    if request is None:
        raise KeyError('Require bind: request')

    def validate_csrf(node, value):
        csrf_token = request.session.get_csrf_token()
        if value != csrf_token:
            raise colander.Invalid(node, _('Invalid cross-site scripting token'))
    return validate_csrf

class CSRFSchema(colander.Schema):
    csrf_token = colander.SchemaNode(
            colander.String(),
            default=deferred_csrf_default,
            validator=deferred_csrf_validator,
            widget=deform.widget.HiddenWidget()
            )

