Ticket #21324: 21324.diff

File 21324.diff, 4.4 KB (added by Claude Paroz, 11 years ago)

  • django/views/csrf.py 

    diff --git a/django/views/csrf.py b/django/views/csrf.py
index c95d19d..ba9c0b5 100644
    a b  
     1from django.conf import settings
    12from django.http import HttpResponseForbidden
    23from django.template import Context, Template
    3 from django.conf import settings
     4from django.utils.translation import ugettext as _
    45
    56# We include the template inline since we need to be able to reliably display
    67# this error message, especially for the sake of developers, and there isn't any
    78# other way of making it available independent of what is in the settings file.
     9# Only the text appearing with DEBUG=False is translated.
    810
    911CSRF_FAILURE_TEMPLATE = """
    1012<!DOCTYPE html>
    … … CSRF_FAILURE_TEMPLATE = """  
    2022    body { font:small sans-serif; background:#eee; }
    2123    body>div { border-bottom:1px solid #ddd; }
    2224    h1 { font-weight:normal; margin-bottom:.4em; }
    23     h1 span { font-size:60%; color:#666; font-weight:normal; }
     25    h1 span { font-size:60%%; color:#666; font-weight:normal; }
    2426    #info { background:#f6f6f6; }
    2527    #info ul { margin: 0.5em 4em; }
    2628    #info p, #summary p { padding-top:10px; }
    … … CSRF_FAILURE_TEMPLATE = """  
    3032</head>
    3133<body>
    3234<div id="summary">
    33   <h1>Forbidden <span>(403)</span></h1>
    34   <p>CSRF verification failed. Request aborted.</p>
    35 {% if no_referer %}
    36   <p>You are seeing this message because this HTTPS site requires a 'Referer
    37    header' to be sent by your Web browser, but none was sent. This header is
    38    required for security reasons, to ensure that your browser is not being
    39    hijacked by third parties.</p>
     35  <h1>%(title)s <span>(403)</span></h1>
     36  <p>%(main)s</p>
     37{%% if no_referer %%}
     38  <p>%(no_referer1)s</p>
    4039
    41   <p>If you have configured your browser to disable 'Referer' headers, please
    42    re-enable them, at least for this site, or for HTTPS connections, or for
    43    'same-origin' requests.</p>
    44 {% endif %}
     40  <p>%(no_referer2)s</p>
     41{%% endif %%}
    4542</div>
    46 {% if DEBUG %}
     43{%% if DEBUG %%}
    4744<div id="info">
    4845  <h2>Help</h2>
    49     {% if reason %}
     46    {%% if reason %%}
    5047    <p>Reason given for failure:</p>
    5148    <pre>
    5249    {{ reason }}
    5350    </pre>
    54     {% endif %}
     51    {%% endif %%}
    5552
    5653  <p>In general, this can occur when there is a genuine Cross Site Request Forgery, or when
    5754  <a
    … … CSRF_FAILURE_TEMPLATE = """  
    6663    href='http://docs.djangoproject.com/en/dev/ref/templates/api/#subclassing-context-requestcontext'><code>RequestContext</code></a>
    6764    for the template, instead of <code>Context</code>.</li>
    6865
    69     <li>In the template, there is a <code>{% templatetag openblock %} csrf_token
    70     {% templatetag closeblock %}</code> template tag inside each POST form that
     66    <li>In the template, there is a <code>{%% templatetag openblock %%} csrf_token
     67    {%% templatetag closeblock %%}</code> template tag inside each POST form that
    7168    targets an internal URL.</li>
    7269
    7370    <li>If you are not using <code>CsrfViewMiddleware</code>, then you must use
    … … CSRF_FAILURE_TEMPLATE = """  
    8279
    8380  <p>You can customize this page using the CSRF_FAILURE_VIEW setting.</p>
    8481</div>
    85 {% else %}
     82{%% else %%}
    8683<div id="explanation">
    87   <p><small>More information is available with DEBUG=True.</small></p>
     84  <p><small>%(more)s</small></p>
    8885</div>
    89 {% endif %}
     86{%% endif %%}
    9087</body>
    9188</html>
    9289"""
    … … def csrf_failure(request, reason=""):  
    9693    Default view used when request fails CSRF protection
    9794    """
    9895    from django.middleware.csrf import REASON_NO_REFERER
    99     t = Template(CSRF_FAILURE_TEMPLATE)
     96    t = Template(CSRF_FAILURE_TEMPLATE % {
     97        'title': _("Forbidden"),
     98        'main': _("CSRF verification failed. Request aborted."),
     99        'no_referer1': _(
     100            "You are seeing this message because this HTTPS site requires a 'Referer "
     101            "header' to be sent by your Web browser, but none was sent. This header is "
     102            "required for security reasons, to ensure that your browser is not being "
     103            "hijacked by third parties."),
     104        'no_referer2': _(
     105            "If you have configured your browser to disable 'Referer' headers, please "
     106            "re-enable them, at least for this site, or for HTTPS connections, or for "
     107            "'same-origin' requests."),
     108        'more': _("More information is available with DEBUG=True."),
     109    })
    100110    c = Context({'DEBUG': settings.DEBUG,
    101111                 'reason': reason,
    102112                 'no_referer': reason == REASON_NO_REFERER
Back to Top