Check CSRF properly on the /config admin site.

gubernator/github/admin.py

@@ -91,7 +91,6 @@ def check_csrf(self):
         #     #Checking_The_Referer_Header
         origin = self.request.headers.get('origin') + '/'
         expected = self.request.host_url + '/'
-        print expected
         if not (origin and origin == expected):
             logging.error('csrf check failed for %s, origin: %r', self.request.url, origin)
             self.abort(403)

gubernator/main.py

@@ -64,6 +64,7 @@ def get(self):
         self.render('config.html', {'hostname': hostname})
 
     def post(self):
+        self.check_csrf()
         if users.is_current_user_admin():
             oauth_set = False
             webhook_set = False

gubernator/view_base.py

@@ -58,6 +58,15 @@ def __init__(self, *args, **kwargs):
         # directory listing operations.
         urlfetch.set_default_fetch_deadline(60)
 
+    def check_csrf(self):
+        # https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet
+        #     #Checking_The_Referer_Header
+        origin = self.request.headers.get('origin') + '/'
+        expected = self.request.host_url + '/'
+        if not (origin and origin == expected):
+            logging.error('csrf check failed for %s, origin: %r', self.request.url, origin)
+            self.abort(403)
+
     # This example code is from:
     # http://webapp2.readthedocs.io/en/latest/api/webapp2_extras/sessions.html
     def dispatch(self):