fix: preserve browser form origins for update panel authentication

server/updates/tests/test_updates.py

@@ -101,6 +101,23 @@ def test_csrf_and_cross_origin_login_publish_logout_are_rejected(service):
     assert client.post('/update/logout', data={'csrf': 'bad'}, headers={'Origin': BASE}).status_code == 403
 
 
+@pytest.mark.parametrize('origin', [None, 'null', 'https://evil.test'])
+def test_valid_csrf_does_not_allow_missing_null_or_foreign_origin(service, origin):
+    client, _ = service
+    headers = {} if origin is None else {'Origin': origin}
+    page = client.get('/update')
+    values = {'username': 'admin', 'password': PASSWORD, 'csrf': csrf(page)}
+    assert client.post('/update/login', data=values, headers=headers).status_code == 403
+    assert login(client).status_code == 303
+    page = client.get('/update')
+    values = {'csrf': csrf(page), 'version': '0.8.0', 'build_number': '25',
+              'notes': '不得发布', 'download_url': BASE + '/test.apk', 'revision': 'none'}
+    assert client.post('/update/publish', data=values, headers=headers).status_code == 403
+    assert client.get('/v1/updates/android').json()['latest'] is None
+    assert client.post('/update/logout', data={'csrf': csrf(page)}, headers=headers).status_code == 403
+    assert 'name="download_url"' in client.get('/update').text
+
+
 def test_login_rejects_unicode_username_and_limits_password_guesses(service):
     client, _ = service
     page = client.get('/update')