Fixed #3651 -- Changed set_language_view() to require POST request is used, in accordance with the HTTP spec (it changes the user's state). Thanks, Fraser Nevett.

This is a backwards incompatible change for anybody previously using this view.


git-svn-id: http://code.djangoproject.com/svn/django/trunk@6177 bcc190cf-cafb-0310-a4f2-bffc1f526a37

1 files changed, 13 insertions, 7 deletions

diff --git a/django/views/i18n.py b/django/views/i18n.py
index 320caf37d7..5b50f75d23 100644
--- a/django/views/i18n.py
+++ b/django/views/i18n.py
@@ -9,20 +9,26 @@ def set_language(request):
     """
     Redirect to a given url while setting the chosen language in the
     session or cookie. The url and the language code need to be
-    specified in the GET parameters.
+    specified in the request parameters.
+
+    Since this view changes how the user will see the rest of the site, it must
+    only be accessed as a POST request. If called as a GET request, it will
+    redirect to the page in the request (the 'next' parameter) without changing
+    any state.
     """
-    lang_code = request.GET.get('language', None)
     next = request.GET.get('next', None)
     if not next:
         next = request.META.get('HTTP_REFERER', None)
     if not next:
         next = '/'
     response = http.HttpResponseRedirect(next)
-    if lang_code and check_for_language(lang_code):
-        if hasattr(request, 'session'):
-            request.session['django_language'] = lang_code
-        else:
-            response.set_cookie('django_language', lang_code)
+    if request.method == 'POST':
+        lang_code = request.POST.get('language', None)
+        if lang_code and check_for_language(lang_code):
+            if hasattr(request, 'session'):
+                request.session['django_language'] = lang_code
+            else:
+                response.set_cookie('django_language', lang_code)
     return response
 
 NullSource = """