heckyel/mediagoblin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug #685: only provide CSRF token if it exists

Browse Source 
This was suggested by Nathan Yergler in the bug logs.
Just implementing it.

- Let render_csrf_form_token return None, if the CSRF_TOKEN
  is not available in the environ, because the
  process_request part of the meddleware has not yet run.

- In render_template: If the returned value from above is
  None, then do not add the csrf_token to the templates
  context.
This commit is contained in:
Elrond 2011-12-03 21:20:11 +01:00
parent 968dd9e735
commit 71c6c432a5
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
mediagoblin/meddleware/csrf.py
View File

@ -50,6 +50,9 @@ def render_csrf_form_token(request):
"""Render the CSRF token in a format suitable for inclusion in a """Render the CSRF token in a format suitable for inclusion in a
form.""" form."""
if 'CSRF_TOKEN' not in request.environ:
return None
form = CsrfForm(csrf_token=request.environ['CSRF_TOKEN']) form = CsrfForm(csrf_token=request.environ['CSRF_TOKEN'])
return form.csrf_token return form.csrf_token

4
mediagoblin/tools/template.py
View File

@ -79,7 +79,9 @@ def render_template(request, template_path, context):
template = request.template_env.get_template( template = request.template_env.get_template(
template_path) template_path)
context['request'] = request context['request'] = request
context['csrf_token'] = render_csrf_form_token(request) rendered_csrf_token = render_csrf_form_token(request)
if rendered_csrf_token is not None:
context['csrf_token'] = render_csrf_form_token(request)
rendered = template.render(context) rendered = template.render(context)
if common.TESTS_ENABLED: if common.TESTS_ENABLED: