web/lib/django/views/csrf.py
author ymh <ymh.work@gmail.com>
Wed, 02 Jun 2010 18:57:35 +0200
changeset 38 77b6da96e6f1
permissions -rw-r--r--
update django
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
38
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
     1
from django.http import HttpResponseForbidden
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
     2
from django.template import Context, Template
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
     3
from django.conf import settings
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
     4
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
     5
# We include the template inline since we need to be able to reliably display
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
     6
# this error message, especially for the sake of developers, and there isn't any
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
     7
# other way of making it available independent of what is in the settings file.
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
     8
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
     9
CSRF_FAILRE_TEMPLATE = """
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    10
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    11
<html lang="en">
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    12
<head>
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    13
  <meta http-equiv="content-type" content="text/html; charset=utf-8">
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    14
  <meta name="robots" content="NONE,NOARCHIVE">
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    15
  <title>403 Forbidden</title>
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    16
  <style type="text/css">
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    17
    html * { padding:0; margin:0; }
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    18
    body * { padding:10px 20px; }
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    19
    body * * { padding:0; }
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    20
    body { font:small sans-serif; background:#eee; }
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    21
    body>div { border-bottom:1px solid #ddd; }
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    22
    h1 { font-weight:normal; margin-bottom:.4em; }
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    23
    h1 span { font-size:60%; color:#666; font-weight:normal; }
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    24
    #info { background:#f6f6f6; }
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    25
    #info ul { margin: 0.5em 4em; }
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    26
    #info p { padding-top:10px; }
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    27
    #summary { background: #ffc; }
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    28
    #explanation { background:#eee; border-bottom: 0px none; }
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    29
  </style>
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    30
</head>
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    31
<body>
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    32
<div id="summary">
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    33
  <h1>Forbidden <span>(403)</span></h1>
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    34
  <p>CSRF verification failed. Request aborted.</p>
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    35
</div>
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    36
{% if DEBUG %}
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    37
<div id="info">
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    38
  <h2>Help</h2>
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    39
    {% if reason %}
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    40
    <p>Reason given for failure:</p>
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    41
    <pre>
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    42
    {{ reason }}
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    43
    </pre>
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    44
    {% endif %}
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    45
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    46
  <p>In general, this can occur when there is a genuine Cross Site Request Forgery, or when
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    47
  <a
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    48
  href='http://docs.djangoproject.com/en/dev/ref/contrib/csrf/#ref-contrib-csrf'>Django's
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    49
  CSRF mechanism</a> has not been used correctly.  For POST forms, you need to
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    50
  ensure:</p>
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    51
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    52
  <ul>
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    53
    <li>The view function uses <a
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    54
    href='http://docs.djangoproject.com/en/dev/ref/templates/api/#subclassing-context-requestcontext'><code>RequestContext</code></a>
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    55
    for the template, instead of <code>Context</code>.</li>
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    56
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    57
    <li>In the template, there is a <code>{% templatetag openblock %} csrf_token
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    58
    {% templatetag closeblock %}</code> template tag inside each POST form that
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    59
    targets an internal URL.</li>
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    60
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    61
    <li>If you are not using <code>CsrfViewMiddleware</code>, then you must use
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    62
    <code>csrf_protect</code> on any views that use the <code>csrf_token</code>
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    63
    template tag, as well as those that accept the POST data.</li>
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    64
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    65
  </ul>
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    66
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    67
  <p>You're seeing the help section of this page because you have <code>DEBUG =
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    68
  True</code> in your Django settings file. Change that to <code>False</code>,
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    69
  and only the initial error message will be displayed.  </p>
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    70
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    71
  <p>You can customize this page using the CSRF_FAILURE_VIEW setting.</p>
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    72
</div>
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    73
{% else %}
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    74
<div id="explanation">
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    75
  <p><small>More information is available with DEBUG=True.</small></p>
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    76
</div>
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    77
{% endif %}
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    78
</body>
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    79
</html>
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    80
"""
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    81
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    82
def csrf_failure(request, reason=""):
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    83
    """
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    84
    Default view used when request fails CSRF protection
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    85
    """
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    86
    t = Template(CSRF_FAILRE_TEMPLATE)
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    87
    c = Context({'DEBUG': settings.DEBUG,
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    88
                 'reason': reason})
77b6da96e6f1 update django
ymh <ymh.work@gmail.com>
parents:
diff changeset
    89
    return HttpResponseForbidden(t.render(c), mimetype='text/html')