Fixes #16827. Adds a length check to CSRF tokens before applying the santizing regex. Thanks to jedie for the report and zsiciarz for the initial patch.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@17500 bcc190cf-cafb-0310-a4f2-bffc1f526a37

1 files changed, 4 insertions, 3 deletions

diff --git a/django/utils/crypto.py b/django/utils/crypto.py
index f3a0675cc6..4fe11f428c 100644
--- a/django/utils/crypto.py
+++ b/django/utils/crypto.py
@@ -36,10 +36,11 @@ def salted_hmac(key_salt, value, secret=None):
     return hmac.new(key, msg=value, digestmod=hashlib.sha1)
 
 
-def get_random_string(length=12, allowed_chars='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'):
+def get_random_string(length=12,
+                      allowed_chars='abcdefghijklmnopqrstuvwxyz'
+                                    'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'):
     """
-    Returns a random string of length characters from the set of a-z, A-Z, 0-9
-    for use as a salt.
+    Returns a random string of length characters from the set of a-z, A-Z, 0-9.
 
     The default length of 12 with the a-z, A-Z, 0-9 character set returns
     a 71-bit salt. log_2((26+26+10)^12) =~ 71 bits