Fixed #13716 - the CSRF get_token function stopped working for views with csrf_view_exempt

This was a regression caused by the the CSRF changes in 1.2.

Thanks to edevil for the report.



git-svn-id: http://code.djangoproject.com/svn/django/trunk@13336 bcc190cf-cafb-0310-a4f2-bffc1f526a37

1 files changed, 5 insertions, 3 deletions

diff --git a/django/middleware/csrf.py b/django/middleware/csrf.py
index 9ca727fca9..10fab290c9 100644
--- a/django/middleware/csrf.py
+++ b/django/middleware/csrf.py
@@ -62,9 +62,6 @@ class CsrfViewMiddleware(object):
     tag.
     """
     def process_view(self, request, callback, callback_args, callback_kwargs):
-        if getattr(callback, 'csrf_exempt', False):
-            return None
-
         if getattr(request, 'csrf_processing_done', False):
             return None
 
@@ -90,6 +87,11 @@ class CsrfViewMiddleware(object):
             # place of a CSRF cookie for this request only.
             cookie_is_new = True
 
+        # Wait until request.META["CSRF_COOKIE"] has been manipulated before
+        # bailing out, so that get_token still works
+        if getattr(callback, 'csrf_exempt', False):
+            return None
+
         if request.method == 'POST':
             if getattr(request, '_dont_enforce_csrf_checks', False):
                 # Mechanism to turn off CSRF checks for test suite.  It comes after