Context Navigation

Ticket #9559: csrf.patch

File csrf.patch, 1.2 KB (added by Zain Memon, 16 years ago)

 import itertools
 from django.conf import settings
-from django.http import HttpResponseForbidden
 from django.utils.hashcompat import md5_constructor
 from django.utils.safestring import mark_safe
 CSRF_TOKEN_NAME = 'csrfmiddlewaretoken'
-_ERROR_MSG = mark_safe('<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><body><h1>403 Forbidden</h1><p>Cross Site Request Forgery detected. Request aborted.</p></body></html>')
 _POST_FORM_RE = \
     re.compile(r'(<form\W[^>]*\bmethod=(\'|"|)POST(\'|"|)\b[^>]*>)', re.IGNORECASE)
 …
             # check incoming token
             try:
                 request_csrf_token = request.POST[CSRF_TOKEN_NAME]
+                if request_csrf_token != csrf_token:
+                    raise KeyError
             except KeyError:
                 return HttpResponseForbidden(_ERROR_MSG)
+                request.POST = []
-            if request_csrf_token != csrf_token:
-                return HttpResponseForbidden(_ERROR_MSG)
         return None
     def process_response(self, request, response):