The AJAX example reads csrftoken from document.cookie, which fails when
CSRF_COOKIE_HTTPONLY is True. Drop the setting from the production
block (the default is False) and set it to False in the CSRF block, as
the .kiro copy already does there. Also remove SECURE_BROWSER_XSS_FILTER,
which Django 4.0 removed. Updated .kiro and regenerated pi/core.
Signed-off-by: Wen <jwcastillo@gmail.com>
(cherry picked from commit bdc4407edf)
Perl::Critic has no InputOutput::RequireThreeArgOpen or
Modules::RequireTaintChecking policy. perlcritic warns that they are
not installed and ignores them. Two-arg open is already covered by
InputOutput::ProhibitTwoArgOpen in the same profile. Regenerated pi/core.
Signed-off-by: Wen <jwcastillo@gmail.com>
(cherry picked from commit d70726d79c)
sanitize_html is not a built-in Laravel rule and the skill never
registers it, so the validator throws BadMethodCallException. The same
FormRequest already strips tags in validated(). Regenerated pi/core.
Signed-off-by: Wen <jwcastillo@gmail.com>
(cherry picked from commit 453c0651f7)
The users router uses Depends() for OAuth2PasswordRequestForm but the
import line omits it, so the module raises NameError on import.
Regenerated pi/core with scripts/build-pi-core.js.
Signed-off-by: Wen <jwcastillo@gmail.com>
(cherry picked from commit d383fb57e9)
Wen