diff options
| author | Thomas Chaumeny <t.chaumeny@gmail.com> | 2014-10-31 23:39:46 +0100 |
|---|---|---|
| committer | Tim Graham <timograham@gmail.com> | 2014-11-03 07:47:39 -0500 |
| commit | d3db878e4beff057400dd780c24f3601a5d31f95 (patch) | |
| tree | 093a397322edb251987ebdd4119ac1ec3e029046 /docs/topics/forms | |
| parent | d968bd5258438694b000b347a482ddcd33a9b395 (diff) | |
Moved CSRF docs out of contrib.
Diffstat (limited to 'docs/topics/forms')
| -rw-r--r-- | docs/topics/forms/index.txt | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/docs/topics/forms/index.txt b/docs/topics/forms/index.txt index 215b0d74c2..c20acde52f 100644 --- a/docs/topics/forms/index.txt +++ b/docs/topics/forms/index.txt @@ -81,7 +81,7 @@ or for binary data, such as an image. A Web application that uses ``GET`` requests for admin forms is a security risk: it can be easy for an attacker to mimic a form's request to gain access to sensitive parts of the system. ``POST``, coupled with other protections like Django's :doc:`CSRF protection -</ref/contrib/csrf/>` offers more control over access. +</ref/csrf/>` offers more control over access. On the other hand, ``GET`` is suitable for things like a web search form, because the URLs that represent a ``GET`` request can easily be bookmarked, @@ -335,7 +335,7 @@ from that ``{{ form }}`` by Django's template language. .. admonition:: Forms and Cross Site Request Forgery protection Django ships with an easy-to-use :doc:`protection against Cross Site Request - Forgeries </ref/contrib/csrf>`. When submitting a form via ``POST`` with + Forgeries </ref/csrf>`. When submitting a form via ``POST`` with CSRF protection enabled you must use the :ttag:`csrf_token` template tag as in the preceding example. However, since CSRF protection is not directly tied to forms in templates, this tag is omitted from the |