From 5c561c637aebd1f48e9e09edeb4b919d462c46d5 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jun 18 2018 09:56:14 +0000
Subject: [PATCH 1/2] Revert "Migrate away from csrf_enabled which is deprecated upstream"


This reverts commit b8e6b6d5ad07e38713180e7231bb0fd78da9d07c.

---

diff --git a/pagure/api/fork.py b/pagure/api/fork.py
index 829acd7..3cb7311 100644
--- a/pagure/api/fork.py
+++ b/pagure/api/fork.py
@@ -545,7 +545,7 @@ def api_pull_request_add_comment(
     if not request:
         raise pagure.exceptions.APIError(404, error_code=APIERROR.ENOREQ)
 
-    form = pagure.forms.AddPullRequestCommentForm(meta={'csrf': False})
+    form = pagure.forms.AddPullRequestCommentForm(csrf_enabled=False)
     if form.validate_on_submit():
         comment = form.comment.data
         commit = form.commit.data or None
@@ -730,9 +730,9 @@ def api_pull_request_add_flag(repo, requestid, username=None, namespace=None):
         raise pagure.exceptions.APIError(404, error_code=APIERROR.ENOREQ)
 
     if 'status' in get_request_data():
-        form = pagure.forms.AddPullRequestFlagForm(meta={'csrf': False})
+        form = pagure.forms.AddPullRequestFlagForm(csrf_enabled=False)
     else:
-        form = pagure.forms.AddPullRequestFlagFormV1(meta={'csrf': False})
+        form = pagure.forms.AddPullRequestFlagFormV1(csrf_enabled=False)
     if form.validate_on_submit():
         username = form.username.data
         percent = form.percent.data.strip() or None
@@ -863,7 +863,7 @@ def api_subscribe_pull_request(
     if not request:
         raise pagure.exceptions.APIError(404, error_code=APIERROR.ENOREQ)
 
-    form = pagure.forms.SubscribtionForm(meta={'csrf': False})
+    form = pagure.forms.SubscribtionForm(csrf_enabled=False)
     if form.validate_on_submit():
         status = is_true(form.status.data)
         try:
@@ -998,7 +998,7 @@ def api_pull_request_create(repo, username=None, namespace=None):
         raise pagure.exceptions.APIError(
             401, error_code=APIERROR.EINVALIDTOK)
 
-    form = pagure.forms.RequestPullForm(meta={'csrf': False})
+    form = pagure.forms.RequestPullForm(csrf_enabled=False)
     if not form.validate_on_submit():
         raise pagure.exceptions.APIError(
             400, error_code=APIERROR.EINVALIDREQ, errors=form.errors)
diff --git a/pagure/api/issue.py b/pagure/api/issue.py
index 765947e..b44fd3c 100644
--- a/pagure/api/issue.py
+++ b/pagure/api/issue.py
@@ -263,7 +263,7 @@ def api_new_issue(repo, username=None, namespace=None):
     form = pagure.forms.IssueFormSimplied(
         priorities=repo.priorities,
         milestones=repo.milestones,
-        meta={'csrf': False})
+        csrf_enabled=False)
     if form.validate_on_submit():
         title = form.title.data
         content = form.issue_content.data
@@ -764,7 +764,7 @@ def api_change_status_issue(repo, issueid, username=None, namespace=None):
     form = pagure.forms.StatusForm(
         status=status,
         close_status=repo.close_status,
-        meta={'csrf': False})
+        csrf_enabled=False)
 
     if not pagure.utils.is_repo_user(repo) \
             and flask.g.fas_user.username != issue.user.user:
@@ -880,7 +880,7 @@ def api_change_milestone_issue(repo, issueid, username=None, namespace=None):
 
     form = pagure.forms.MilestoneForm(
         milestones=repo.milestones.keys(),
-        meta={'csrf': False})
+        csrf_enabled=False)
 
     if form.validate_on_submit():
         new_milestone = form.milestone.data
@@ -977,7 +977,7 @@ def api_comment_issue(repo, issueid, username=None, namespace=None):
     issue = _get_issue(repo, issueid)
     _check_private_issue_access(issue)
 
-    form = pagure.forms.CommentForm(meta={'csrf': False})
+    form = pagure.forms.CommentForm(csrf_enabled=False)
     if form.validate_on_submit():
         comment = form.comment.data
         try:
@@ -1057,7 +1057,7 @@ def api_assign_issue(repo, issueid, username=None, namespace=None):
     issue = _get_issue(repo, issueid)
     _check_ticket_access(issue, assignee=True)
 
-    form = pagure.forms.AssignIssueForm(meta={'csrf': False})
+    form = pagure.forms.AssignIssueForm(csrf_enabled=False)
     if form.validate_on_submit():
         assignee = form.assignee.data or None
         # Create our metadata comment object
@@ -1155,7 +1155,7 @@ def api_subscribe_issue(repo, issueid, username=None, namespace=None):
     issue = _get_issue(repo, issueid)
     _check_private_issue_access(issue)
 
-    form = pagure.forms.SubscribtionForm(meta={'csrf': False})
+    form = pagure.forms.SubscribtionForm(csrf_enabled=False)
     if form.validate_on_submit():
         status = is_true(form.status.data)
         try:
diff --git a/pagure/api/project.py b/pagure/api/project.py
index 474a3b7..9690037 100644
--- a/pagure/api/project.py
+++ b/pagure/api/project.py
@@ -824,7 +824,7 @@ def api_new_project():
         namespaces.extend([grp for grp in user.groups])
 
     form = pagure.forms.ProjectForm(
-        namespaces=namespaces, meta={'csrf': False})
+        namespaces=namespaces, csrf_enabled=False)
     if form.validate_on_submit():
         name = form.name.data
         description = form.description.data
@@ -1094,7 +1094,7 @@ def api_fork_project():
     """
     output = {}
 
-    form = pagure.forms.ForkRepoForm(meta={'csrf': False})
+    form = pagure.forms.ForkRepoForm(csrf_enabled=False)
     if form.validate_on_submit():
         repo = form.repo.data
         username = form.username.data or None
@@ -1537,7 +1537,7 @@ def api_commit_add_flag(repo, commit_hash, username=None, namespace=None):
         raise pagure.exceptions.APIError(
             404, error_code=APIERROR.ENOCOMMIT)
 
-    form = pagure.forms.AddPullRequestFlagForm(meta={'csrf': False})
+    form = pagure.forms.AddPullRequestFlagForm(csrf_enabled=False)
     if form.validate_on_submit():
         username = form.username.data
         percent = form.percent.data.strip() or None

From 9740ae9651a444b01f40b0ab5921d0a93c034a1b Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jun 18 2018 09:56:14 +0000
Subject: [PATCH 2/2] Remove the csrf_enabled argument on newer flask-wtf which deprecates it


Fixes https://pagure.io/pagure/issue/3284

Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/pagure/forms.py b/pagure/forms.py
index a1bb3a6..15b7393 100644
--- a/pagure/forms.py
+++ b/pagure/forms.py
@@ -35,22 +35,24 @@ STRICT_REGEX = '^[a-zA-Z0-9-_]+$'
 TAGS_REGEX = '^[a-zA-Z0-9-_, .]+$'
 FALSE_VALUES = ('false', '', False, 'False', 0, '0')
 
+WTF_VERSION = tuple()
+if hasattr(wtf, '__version__'):
+    WTF_VERSION = tuple(int(v) for v in wtf.__version__.split('.'))
+
 
 class PagureForm(FlaskForm):
     """ Local form allowing us to form set the time limit. """
 
     def __init__(self, *args, **kwargs):
         delta = pagure_config.get('WTF_CSRF_TIME_LIMIT', 3600)
-        if delta \
-                and (
-                    not hasattr(wtf, '__version__')
-                    or tuple(
-                        int(v) for v in wtf.__version__.split('.')
-                    ) < (0, 10, 0)
-                ):
+        if delta and WTF_VERSION < (0, 10, 0):
             self.TIME_LIMIT = datetime.timedelta(seconds=delta)
         else:
             self.TIME_LIMIT = delta
+        if 'csrf_enabled' in kwargs and kwargs['csrf_enabled'] is False:
+            kwargs['meta'] = {'csrf': False}
+            if WTF_VERSION >= (0, 14, 0):
+                kwargs.pop('csrf_enabled')
         super(PagureForm, self).__init__(*args, **kwargs)
 
 

