From 01d29283f1f2a3fee246516d77cc27f98fe1b91b Mon Sep 17 00:00:00 2001 From: Ankush Menat Date: Tue, 27 Feb 2024 21:40:33 +0530 Subject: [PATCH] fix: restrict method for security critical endpoints (#25105) --- frappe/core/doctype/user/user.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/frappe/core/doctype/user/user.py b/frappe/core/doctype/user/user.py index f44224e9b5..1ec3923064 100644 --- a/frappe/core/doctype/user/user.py +++ b/frappe/core/doctype/user/user.py @@ -841,7 +841,7 @@ def get_perm_info(role): return get_all_perms(role) -@frappe.whitelist(allow_guest=True) +@frappe.whitelist(allow_guest=True, methods=["POST"]) def update_password( new_password: str, logout_all_sessions: int = 0, key: str | None = None, old_password: str | None = None ): @@ -989,7 +989,7 @@ def reset_user_data(user): return user_doc, redirect_url -@frappe.whitelist() +@frappe.whitelist(methods=["POST"]) def verify_password(password): frappe.local.login_manager.check_password(frappe.session.user, password) @@ -1045,7 +1045,7 @@ def sign_up(email: str, full_name: str, redirect_to: str) -> tuple[int, str]: return 2, _("Please ask your administrator to verify your sign-up") -@frappe.whitelist(allow_guest=True) +@frappe.whitelist(allow_guest=True, methods=["POST"]) @rate_limit(limit=get_password_reset_limit, seconds=60 * 60) def reset_password(user: str) -> str: try: @@ -1311,7 +1311,7 @@ def get_restricted_ip_list(user): return [i.strip() for i in user.restrict_ip.split(",")] -@frappe.whitelist() +@frappe.whitelist(methods=["POST"]) def generate_keys(user: str): """ generate api key and api secret