From 5b984a0262c42ef5ac8f05a687978235a12a6e28 Mon Sep 17 00:00:00 2001 From: Jeremy Kerr Date: Tue, 10 Aug 2010 12:11:40 +0800 Subject: [PATCH] views: implement CSRF protection Since we've got the csrf token present, we may as well check it for requests. We're using RequestContext already (via PatchworkRequestContext), so we just need to switch it on in the settings, and add an exemption on the xmlrpc interface. Signed-off-by: Jeremy Kerr --- apps/patchwork/views/xmlrpc.py | 2 ++ apps/settings.py | 1 + 2 files changed, 3 insertions(+) diff --git a/apps/patchwork/views/xmlrpc.py b/apps/patchwork/views/xmlrpc.py index 23e58bf2..0d3321fc 100644 --- a/apps/patchwork/views/xmlrpc.py +++ b/apps/patchwork/views/xmlrpc.py @@ -29,6 +29,7 @@ from django.core import urlresolvers from django.shortcuts import render_to_response from django.contrib.auth import authenticate from patchwork.models import Patch, Project, Person, Bundle, State +from django.views.decorators.csrf import csrf_exempt import sys import base64 @@ -120,6 +121,7 @@ class PatchworkXMLRPCDispatcher(SimpleXMLRPCDispatcher): dispatcher = PatchworkXMLRPCDispatcher() # XMLRPC view function +@csrf_exempt def xmlrpc(request): if request.method != 'POST': return HttpResponseRedirect( diff --git a/apps/settings.py b/apps/settings.py index 20c8db3f..68837b3d 100644 --- a/apps/settings.py +++ b/apps/settings.py @@ -62,6 +62,7 @@ MIDDLEWARE_CLASSES = ( 'django.contrib.sessions.middleware.SessionMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'django.middleware.doc.XViewMiddleware', + 'django.middleware.csrf.CsrfViewMiddleware', ) ROOT_URLCONF = 'apps.urls' -- 2.47.3