mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-31 09:41:08 +00:00
Code Issues 32 Releases Wiki Activity

[1.5.x] Fixed bug causing CSRF token not to rotate on login.

Browse Source 
Thanks Gavin McQuillan for the report.

Backport of ac4fec5ca2 from master
This commit is contained in:
Tim Graham
2013-10-17 19:51:45 -04:00
parent 312ca5e9cb
commit 0fb2897c81
2 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
django/contrib/auth/tests/views.py
View File

@@ -392,7 +392,6 @@ class LoginTest(AuthViewsTestCase):
CsrfViewMiddleware().process_view(req, login_view, (), {}) CsrfViewMiddleware().process_view(req, login_view, (), {})
req.META["SERVER_NAME"] = "testserver" # Required to have redirect work in login view req.META["SERVER_NAME"] = "testserver" # Required to have redirect work in login view
req.META["SERVER_PORT"] = 80 req.META["SERVER_PORT"] = 80
req.META["CSRF_COOKIE_USED"] = True
resp = login_view(req) resp = login_view(req)
resp2 = CsrfViewMiddleware().process_response(req, resp) resp2 = CsrfViewMiddleware().process_response(req, resp)
csrf_cookie = resp2.cookies.get(settings.CSRF_COOKIE_NAME, None) csrf_cookie = resp2.cookies.get(settings.CSRF_COOKIE_NAME, None)

5
django/middleware/csrf.py
View File

@@ -58,7 +58,10 @@ def rotate_token(request):
Changes the CSRF token in use for a request - should be done on login Changes the CSRF token in use for a request - should be done on login
for security purposes. for security purposes.
""" """
request.META["CSRF_COOKIE"] = _get_new_csrf_key() request.META.update({
"CSRF_COOKIE_USED": True,
"CSRF_COOKIE": _get_new_csrf_key(),
})
def _sanitize_token(token): def _sanitize_token(token):