1
0
mirror of https://github.com/django/django.git synced 2025-03-09 00:42:40 +00:00
Shai Berger 5112e65ef2 Fixed #20869 -- made CSRF tokens change every request by salt-encrypting them
Note that the cookie is not changed every request, just the token retrieved
by the `get_token()` method (used also by the `{% csrf_token %}` tag).

While at it, made token validation strict: Where, before, any length was
accepted and non-ASCII chars were ignored, we now treat anything other than
`[A-Za-z0-9]{64}` as invalid (except for 32-char tokens, which, for
backwards-compatibility, are accepted and replaced by 64-char ones).

Thanks Trac user patrys for reporting, github user adambrenecki
for initial patch, Tim Graham for help, and Curtis Maloney,
Collin Anderson, Florian Apolloner, Markus Holtermann & Jon Dufresne
for reviews.
2016-05-19 05:02:19 +03:00
..
2016-05-02 11:43:03 -04:00
2016-04-04 17:14:26 -04:00

To run the test suite::

    $ cd tests
    $ pip install -r requirements/py3.txt  # or py2.txt
    $ PYTHONPATH=..:$PYTHONPATH ./runtests.py

For more information about the test suite, see
https://docs.djangoproject.com/en/dev/internals/contributing/writing-code/unit-tests/.