diff options
| author | Grzegorz Slusarek <gslusarek@gmail.com> | 2015-02-21 22:57:02 +0100 |
|---|---|---|
| committer | Tim Graham <timograham@gmail.com> | 2015-03-05 15:03:40 -0500 |
| commit | 668d53cd125175eb708cc0af143f47b42cd42153 (patch) | |
| tree | 6b1ef6d43985ba7670756f92ea2c2770b56baf53 /django | |
| parent | 8e744fa1507b6d425860c54e7673e603279367eb (diff) | |
Fixed #21495 -- Added settings.CSRF_HEADER_NAME
Diffstat (limited to 'django')
| -rw-r--r-- | django/conf/global_settings.py | 1 | ||||
| -rw-r--r-- | django/middleware/csrf.py | 2 |
2 files changed, 2 insertions, 1 deletions
diff --git a/django/conf/global_settings.py b/django/conf/global_settings.py index 41abd4f499..d817ea8e94 100644 --- a/django/conf/global_settings.py +++ b/django/conf/global_settings.py @@ -555,6 +555,7 @@ CSRF_COOKIE_DOMAIN = None CSRF_COOKIE_PATH = '/' CSRF_COOKIE_SECURE = False CSRF_COOKIE_HTTPONLY = False +CSRF_HEADER_NAME = 'HTTP_X_CSRFTOKEN' ############ # MESSAGES # diff --git a/django/middleware/csrf.py b/django/middleware/csrf.py index f12126fa9f..8891a44109 100644 --- a/django/middleware/csrf.py +++ b/django/middleware/csrf.py @@ -183,7 +183,7 @@ class CsrfViewMiddleware(object): if request_csrf_token == "": # Fall back to X-CSRFToken, to make things easier for AJAX, # and possible for PUT/DELETE. - request_csrf_token = request.META.get('HTTP_X_CSRFTOKEN', '') + request_csrf_token = request.META.get(settings.CSRF_HEADER_NAME, '') if not constant_time_compare(request_csrf_token, csrf_token): return self._reject(request, REASON_BAD_TOKEN) |