diff -r 8d941af65caf -r 77b6da96e6f1 web/lib/django/views/csrf.py --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/web/lib/django/views/csrf.py Wed Jun 02 18:57:35 2010 +0200 @@ -0,0 +1,89 @@ +from django.http import HttpResponseForbidden +from django.template import Context, Template +from django.conf import settings + +# We include the template inline since we need to be able to reliably display +# this error message, especially for the sake of developers, and there isn't any +# other way of making it available independent of what is in the settings file. + +CSRF_FAILRE_TEMPLATE = """ + + + + + + 403 Forbidden + + + +
+

Forbidden (403)

+

CSRF verification failed. Request aborted.

+
+{% if DEBUG %} +
+

Help

+ {% if reason %} +

Reason given for failure:

+ 
+    {{ reason }}
+
+ {% endif %} + +

In general, this can occur when there is a genuine Cross Site Request Forgery, or when + Django's + CSRF mechanism has not been used correctly. For POST forms, you need to + ensure:

+ + + +

You're seeing the help section of this page because you have DEBUG = + True in your Django settings file. Change that to False, + and only the initial error message will be displayed.

+ +

You can customize this page using the CSRF_FAILURE_VIEW setting.

+
+{% else %} +
+

More information is available with DEBUG=True.

+
+{% endif %} + + +""" + +def csrf_failure(request, reason=""): + """ + Default view used when request fails CSRF protection + """ + t = Template(CSRF_FAILRE_TEMPLATE) + c = Context({'DEBUG': settings.DEBUG, + 'reason': reason}) + return HttpResponseForbidden(t.render(c), mimetype='text/html')