Commits on Jun 10, 2024

1. docs: remove 'came_from' from login view …

   - The narrative doesn't discuss this (mis-)feature.
   
   - Without any authorization, there is no meaninful reason to remember
     the 'previous' page.
   
   - As a general rule, we want to avoid trusting user-supplied data (i.e.,
     from the query string or form params) when constructing redirect URLs.

   

   tseaver committed Jun 10, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for c923514
   • Browse repository at this point

   Copy the full SHA

   c923514 View commit details

   Browse the repository at this point in the history

2. fix: store 'came_from' information in the session …

   - As with the previous commit, we want to avoid trusting user-supplied data
     from the query string or form parameters when constructing redirect URLs.
   
   - Storing the route name and matchdict for the view being forbidden in
     the session allows us to construct the redirect URL on successful
     login cleanly.
   
   - In order to clarify that the logic of storing the 'came from'
     information is separate from rendering or processing the login form,
     this PR splits the `@forbidden_view` mapping onto a separate view function.

   

   tseaver committed Jun 10, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for e72d437
   • Browse repository at this point

   Copy the full SHA

   e72d437 View commit details

   Browse the repository at this point in the history

3. chore: remove 'retail_forms' fossil …

   Ten years on, it has never landed in the generated docs.

   

   tseaver committed Jun 10, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for 1ebd988
   • Browse repository at this point

   Copy the full SHA

   1ebd988 View commit details

   Browse the repository at this point in the history