Partiallly Revert "Remove workaround from check_csrf() (#6919)" (#7327)

This workaround was missing 'if view is not None ' as found in
https://github.com/pallets-eco/flask-wtf/pull/419/files

Tested with MULTI_ORG enabled.

Author: eradman

redash/security.py

@@ -1,6 +1,6 @@
 import functools
 
-from flask import session
+from flask import request, session
 from flask_login import current_user
 from flask_talisman import talisman
 from flask_wtf.csrf import CSRFProtect, generate_csrf
@@ -35,6 +35,15 @@ def inject_csrf_token(response):
 
         @app.before_request
         def check_csrf():
+            # BEGIN workaround until https://github.com/lepture/flask-wtf/pull/419 is merged
+            if request.blueprint in csrf._exempt_blueprints:
+                return
+
+            view = app.view_functions.get(request.endpoint)
+            if view is not None and f"{view.__module__}.{view.__name__}" in csrf._exempt_views:
+                return
+            # END workaround
+
             if not current_user.is_authenticated or "user_id" in session:
                 csrf.protect()