Shai Berger 5112e65ef2 Fixed #20869 -- made CSRF tokens change every request by salt-encrypting them ... Note that the cookie is not changed every request, just the token retrieved by the `get_token()` method (used also by the `{% csrf_token %}` tag). While at it, made token validation strict: Where, before, any length was accepted and non-ASCII chars were ignored, we now treat anything other than `[A-Za-z0-9]{64}` as invalid (except for 32-char tokens, which, for backwards-compatibility, are accepted and replaced by 64-char ones). Thanks Trac user patrys for reporting, github user adambrenecki for initial patch, Tim Graham for help, and Curtis Maloney, Collin Anderson, Florian Apolloner, Markus Holtermann & Jon Dufresne for reviews.		2016-05-19 05:02:19 +03:00
..
__init__.py
test_context_processor.py	Fixed #20869 -- made CSRF tokens change every request by salt-encrypting them	2016-05-19 05:02:19 +03:00
tests.py	Fixed #20869 -- made CSRF tokens change every request by salt-encrypting them	2016-05-19 05:02:19 +03:00