1
0
mirror of https://github.com/django/django.git synced 2024-12-24 10:05:46 +00:00
django/docs/topics
Luke Plant 8e70cef9b6 Fixed #9977 - CsrfMiddleware gets template tag added, session dependency removed, and turned on by default.
This is a large change to CSRF protection for Django.  It includes:

 * removing the dependency on the session framework.
 * deprecating CsrfResponseMiddleware, and replacing with a core template tag.
 * turning on CSRF protection by default by adding CsrfViewMiddleware to
   the default value of MIDDLEWARE_CLASSES.
 * protecting all contrib apps (whatever is in settings.py)
   using a decorator.

For existing users of the CSRF functionality, it should be a seamless update,
but please note that it includes DEPRECATION of features in Django 1.1,
and there are upgrade steps which are detailed in the docs.

Many thanks to 'Glenn' and 'bthomas', who did a lot of the thinking and work
on the patch, and to lots of other people including Simon Willison and
Russell Keith-Magee who refined the ideas.

Details of the rationale for these changes is found here:

http://code.djangoproject.com/wiki/CsrfProtection

As of this commit, the CSRF code is mainly in 'contrib'.  The code will be
moved to core in a separate commit, to make the changeset as readable as
possible.



git-svn-id: http://code.djangoproject.com/svn/django/trunk@11660 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-26 23:23:07 +00:00
..
db Fixed #11931: Removed mention of nonexistent get_sql() method for arguments to limit_choices_to. Since the correct reference involves undocumented ORM internals, this simply removes the reference entirely in favor of publicly-documented use of Q objects. 2009-09-23 23:40:12 +00:00
forms Fixed #11755 -- Added documentation for an edge case of FormSet usage. Thanks to ffualo for the suggestion. 2009-09-13 03:01:04 +00:00
http Fixed #9977 - CsrfMiddleware gets template tag added, session dependency removed, and turned on by default. 2009-10-26 23:23:07 +00:00
auth.txt Fixed #9977 - CsrfMiddleware gets template tag added, session dependency removed, and turned on by default. 2009-10-26 23:23:07 +00:00
cache.txt Removed mentions of Python 2.3 support from the docs -- Django 1.2 drops support for Python 2.3 -- and added a quick FAQ about that dropping of support. 2009-10-23 19:30:23 +00:00
conditional-view-processing.txt Removed mentions of Python 2.3 support from the docs -- Django 1.2 drops support for Python 2.3 -- and added a quick FAQ about that dropping of support. 2009-10-23 19:30:23 +00:00
email.txt Fixed #8638 -- Added documentation on how to redirect email to a dummy server for testing purposes. Thanks to Rob Hudson and Marc Fargas for their work on the draft for this change. 2009-01-29 12:31:11 +00:00
files.txt Fixed #10779 -- Corrected description of an example in the files docs. Thanks to timo for the patch. 2009-04-16 12:48:46 +00:00
generic-views.txt Fixed #11873 -- Corrected typo in generic views docs. Thanks to Brett Cannon for the report. 2009-09-13 00:25:53 +00:00
i18n.txt Fixed #11364 -- Modified the jsi18n example to use the {% url %} tag rather than a placeholder. Thanks to jcassee for the suggestion. 2009-07-15 13:54:45 +00:00
index.txt Refs #11336 -- Another dummy commit to force refresh of some index pages by Sphinx, caused by file ommitted from [11025] and included in [11026]. Thanks to Peter Landry for the report, and Ramiro for the explanation. 2009-06-18 00:16:48 +00:00
install.txt Fixed a silly typo left over from removing Python 2.3 references. 2009-10-23 19:43:58 +00:00
pagination.txt
serialization.txt Fixed #10954 -- Corrected error in docs example describing extending the JSON serializer. Thanks to Glenn for the report. 2009-05-02 07:39:45 +00:00
settings.txt
signals.txt
templates.txt
testing.txt Fixed #11961: Corrected a few typos in docs/testing.txt. Thanks to timo for the patch. 2009-09-30 06:40:34 +00:00