[issue2551229] Implement CSRF protection for issue.search

New submission from John Rouillard:

As I was debugging my changes to add redis support for session and otks
databases, I noticed that the issue.search page does not request a CSRF token.

It also uses GET for it's submission mode.

This makes sense in most cases as it doesn't change any issue data. However
because we name the search and save it to the search list, it does modify data.

So this should have CSRF protection if the change is to be saved/committed.

I think this is a low priority. I am not sure how it could be used to do much
of anything other than mess with a user's searches. Using GET for searches (so we
can bookmark and share them) already provides the same exposure this does to issue
data.

----------
components: Web interface
keywords: Effort-Medium
messages: 7628
nosy: rouilj
priority: low
severity: normal
status: new
title: Implement CSRF protection for issue.search
type: security

_________________________________________________
Roundup tracker <[email protected]>
<https://issues.roundup-tracker.org/issue2551229>
_________________________________________________