mirror of
https://github.com/django/django.git
synced 2025-01-12 03:15:47 +00:00
5112e65ef2
Note that the cookie is not changed every request, just the token retrieved
by the `get_token()` method (used also by the `{% csrf_token %}` tag).
While at it, made token validation strict: Where, before, any length was
accepted and non-ASCII chars were ignored, we now treat anything other than
`[A-Za-z0-9]{64}` as invalid (except for 32-char tokens, which, for
backwards-compatibility, are accepted and replaced by 64-char ones).
Thanks Trac user patrys for reporting, github user adambrenecki
for initial patch, Tim Graham for help, and Curtis Maloney,
Collin Anderson, Florian Apolloner, Markus Holtermann & Jon Dufresne
for reviews.
|
||
|---|---|---|
| .. | ||
| class-based-views | ||
| contrib | ||
| files | ||
| forms | ||
| models | ||
| templates | ||
| applications.txt | ||
| checks.txt | ||
| clickjacking.txt | ||
| csrf.txt | ||
| databases.txt | ||
| django-admin.txt | ||
| exceptions.txt | ||
| index.txt | ||
| middleware.txt | ||
| migration-operations.txt | ||
| request-response.txt | ||
| schema-editor.txt | ||
| settings.txt | ||
| signals.txt | ||
| template-response.txt | ||
| unicode.txt | ||
| urlresolvers.txt | ||
| urls.txt | ||
| utils.txt | ||
| validators.txt | ||
| views.txt | ||