summaryrefslogtreecommitdiff
path: root/django/middleware
AgeCommit message (Collapse)Author
2011-03-15Fixed #15617 - CSRF referer checking too strictLuke Plant
Thanks to adam for the report. git-svn-id: http://code.djangoproject.com/svn/django/trunk@15840 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-03-02Fixed #4992 -- Respect the GET request query string when creating cache ↵Jannis Leidel
keys. Thanks PeterKz and guettli for the initial patch. git-svn-id: http://code.djangoproject.com/svn/django/trunk@15705 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-03-01Fixed #717 - If-Modified-Since handling should compare dates according to ↵Luke Plant
RFC 2616 Thanks to Maniac for the report, julienb for the initial patch, and especially to aaugustin for the final patch and tests. git-svn-id: http://code.djangoproject.com/svn/django/trunk@15696 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-02-21Corrected logging call in CSRF middlewareLuke Plant
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15623 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-02-17Fixed #15260 -- Ensured that CACHE_MIDDLEWARE_ANONYMOUS_ONLY is effective ↵Carl Meyer
with the cache_page decorator, not only the middleware. Thanks to brodie for report and draft patch. git-svn-id: http://code.djangoproject.com/svn/django/trunk@15559 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-02-09Fixed a security issue in the CSRF component. Disclosure and new release ↵Alex Gaynor
forthcoming. git-svn-id: http://code.djangoproject.com/svn/django/trunk@15464 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-02-01Fixed #13283 -- Corrected CACHE_MIDDLEWARE_ANONYMOUS_ONLY's bad habit of ↵Carl Meyer
setting Vary: Cookie on all responses and destroying cache efficiency. Thanks to natrius for the fix. git-svn-id: http://code.djangoproject.com/svn/django/trunk@15381 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-01-30Fixed #15187 -- Ensure that missing page emails aren't sent when running ↵Russell Keith-Magee
under debug. Thanks to Dan Carroll for the report and patch. git-svn-id: http://code.djangoproject.com/svn/django/trunk@15363 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-01-24Fixed #15012 -- Added post-rendering callbacks to TemplateResponse so that ↵Russell Keith-Magee
decorators (in particular, the cache decorator) can defer processing until after rendering has occurred. Thanks to Joshua Ginsberg for the draft patch. git-svn-id: http://code.djangoproject.com/svn/django/trunk@15295 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-01-24Fixed #15144 -- Corrected some problems with the Cache middleware when used ↵Russell Keith-Magee
with multiple cache settings. Thanks to Jim Dalton for the report, and to Jim and Joshua Ginsberg for the work on the patch. git-svn-id: http://code.djangoproject.com/svn/django/trunk@15285 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-01-04Fixed sending mail on 404s to fail silently.Luke Plant
A failure in the e-mail system should not turn a 404 into a 500. git-svn-id: http://code.djangoproject.com/svn/django/trunk@15145 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-12-22Beefed up the tests for multi-cache handling of the cache middleware and ↵Russell Keith-Magee
view decorators, and made a couple of tweaks for edge cases as a result. git-svn-id: http://code.djangoproject.com/svn/django/trunk@15021 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-12-21Fixed #11675 -- Added support for the PyLibMC cache library. In order to ↵Russell Keith-Magee
support this, and clean up some other 1.3 caching additions, this patch also includes some changes to the way caches are defined. This means you can now have multiple caches, in the same way you have multiple databases. A huge thanks to Jacob Burch for the work on the PyLibMC backend, and to Jannis for his work on the cache definition changes. git-svn-id: http://code.djangoproject.com/svn/django/trunk@15005 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-11-02Fixed #14559 -- corrected some typos and misleading docstrings. Thanks to ↵Alex Gaynor
Gabriel Hurley for the patch. git-svn-id: http://code.djangoproject.com/svn/django/trunk@14441 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-10-29Fixed #14560 -- Enable HEAD requests to be cached properly. Thanks, codemonkey!Honza Král
Introducing ability to cache HEAD requests and GET requests separately by adding the method to the cache key while preserving the functionality that HEAD requests can use cached reponses generated by a GET request. git-svn-id: http://code.djangoproject.com/svn/django/trunk@14391 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-10-28Fixed #14565 - No csrf_token on 404 page.Luke Plant
This solution doesn't have the negative side-effects of [14356]. git-svn-id: http://code.djangoproject.com/svn/django/trunk@14377 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-10-14Fixed #14445 - Use HMAC and constant-time comparison functions where needed.Luke Plant
All adhoc MAC applications have been updated to use HMAC, using SHA1 to generate unique keys for each application based on the SECRET_KEY, which is common practice for this situation. In all cases, backwards compatibility with existing hashes has been maintained, aiming to phase this out as per the normal deprecation process. In this way, under most normal circumstances the old hashes will have expired (e.g. by session expiration etc.) before they become invalid. In the case of the messages framework and the cookie backend, which was already using HMAC, there is the possibility of a backwards incompatibility if the SECRET_KEY is shorter than the default 50 bytes, but the low likelihood and low impact meant compatibility code was not worth it. All known instances where tokens/hashes were compared using simple string equality, which could potentially open timing based attacks, have also been fixed using a constant-time comparison function. There are no known practical attacks against the existing implementations, so these security improvements will not be backported. git-svn-id: http://code.djangoproject.com/svn/django/trunk@14218 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-10-11Fixed #14436 -- Escalated 1.2 PendingDeprecationWarnings to ↵Russell Keith-Magee
DeprecationWarnings, and removed 1.1 deprecated code. git-svn-id: http://code.djangoproject.com/svn/django/trunk@14138 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-10-06Fixed #14406 -- Added a Python 2.4 compatibility to the logging interface. ↵Russell Keith-Magee
Thanks to Łukasz Rekucki for the report, and to Luke Plant for original patch this was based on. git-svn-id: http://code.djangoproject.com/svn/django/trunk@13989 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-10-04Fixed #12012 -- Added support for logging. Thanks to Vinay Sajip for his ↵Russell Keith-Magee
draft patch, and to the many people who gave feedback during development of the patch. git-svn-id: http://code.djangoproject.com/svn/django/trunk@13981 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-09-10Fixed #14235 - UnicodeDecodeError in CSRF middlewareLuke Plant
Thanks to jbg for the report. This changeset essentially backs out [13698] in favour of a method that sanitizes the token rather than escaping it. git-svn-id: http://code.djangoproject.com/svn/django/trunk@13732 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-09-09Patch CSRF-protection system to deal with reported security issue. ↵James Bennett
Announcement and details to follow. git-svn-id: http://code.djangoproject.com/svn/django/trunk@13698 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-09-03Added explanatory note on CSRF failure page for the case of a missing ↵Luke Plant
Referer header. This is intended to help power users who have disabled Referer headers, or installed add-ons which have done so, and to help web site administrators with debugging, since this problem will be browser specific and not a programming error. git-svn-id: http://code.djangoproject.com/svn/django/trunk@13680 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-06-30Added proper code comments for the HTTPS CSRF protection.Luke Plant
Refs #13489 which noticed a vague comment - thanks pmclanahan git-svn-id: http://code.djangoproject.com/svn/django/trunk@13405 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-06-08Fixed #13716 - the CSRF get_token function stopped working for views with ↵Luke Plant
csrf_view_exempt This was a regression caused by the the CSRF changes in 1.2. Thanks to edevil for the report. git-svn-id: http://code.djangoproject.com/svn/django/trunk@13336 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-03-07Fixed #6228: Changed common middleware to respect request-specific urlconf. ↵Karen Tracey
Thanks trey, skevy, and mikexstudios. git-svn-id: http://code.djangoproject.com/svn/django/trunk@12704 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-01-10Removed an 'assert False' I stupidly committed in [12165]Adrian Holovaty
git-svn-id: http://code.djangoproject.com/svn/django/trunk@12166 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-01-10Fixed #6094 -- Middleware exceptions are now caught by the core handler. ↵Adrian Holovaty
Thanks, isagalaev git-svn-id: http://code.djangoproject.com/svn/django/trunk@12165 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-01-10Fixed #8049 -- Fixed inconsistency in admin site is_active checks. Thanks ↵Adrian Holovaty
for patch and tests, isagalaev git-svn-id: http://code.djangoproject.com/svn/django/trunk@12159 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-01-09Fixed #6991 -- Removed some redundant user.is_authenticated() calls in ↵Adrian Holovaty
various places. Thanks, alexkoshelev, Liang Feng and Ivan Sagalaev git-svn-id: http://code.djangoproject.com/svn/django/trunk@12142 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27Misc clarifications in csrf middleware commentsLuke Plant
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11673 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27Slight change to CSRF error messages to make debugging easier.Luke Plant
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11669 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27Removed unused import.Luke Plant
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11664 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27Moved contrib.csrf.* to core code.Luke Plant
There is stub code for backwards compatiblity with Django 1.1 imports. The documentation has been updated, but has been left in docs/contrib/csrf.txt for now, in order to avoid dead links to documentation on the website. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11661 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-07-29BACKWARDS-INCOMPATIBLE CHANGE: Removed SetRemoteAddrFromForwardedFor middleware.Jacob Kaplan-Moss
In a nutshell, it's been demonstrated that this middleware can never be made reliable enough for general-purpose use, and that (despite documentation to the contrary) its inclusion in Django may lead application developers to assume that the value of ``REMOTE_ADDR`` is "safe" or in some way reliable as a source of authentication. So it's gone. See the Django 1.1 release notes for full details, as well as upgrade instructions. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11363 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-04-12Fixed #10630 -- Be even more conservative in GZipMiddleware for IE.Malcolm Tredinnick
Patch from sebastien_noack. git-svn-id: http://code.djangoproject.com/svn/django/trunk@10541 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-10-07Fixed #9199 -- We were erroneously only prepending "www" to the domain if weMalcolm Tredinnick
also needed to append a slash (when PREPEND_WWW=True). Based on a patch and tests from gonz. Thanks. git-svn-id: http://code.djangoproject.com/svn/django/trunk@9184 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-09-30Fixed #9221 -- Small optimisation to caching middleware handling.Malcolm Tredinnick
In the slightly unusual case that CACHE_MIDDLEWARE_SECONDS is set to 0, don't bother storing a copy in the local cache. git-svn-id: http://code.djangoproject.com/svn/django/trunk@9098 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-08-27Fixed #7379: fixed a subtle corner case involving URL encoding in ↵Jacob Kaplan-Moss
`CommonMiddleware` git-svn-id: http://code.djangoproject.com/svn/django/trunk@8635 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-08-21Fixed #8381 -- Fixed a problem with appending slashes in the common middlewareMalcolm Tredinnick
when SCRIPT_NAME contains something other than '/'. Patch from jcassee. Also fixed the middleware tests to work with this patch. git-svn-id: http://code.djangoproject.com/svn/django/trunk@8456 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-08-15Fixed a typo and added a bit more ReST markup to cache middleware docstring.Gary Wilson Jr
git-svn-id: http://code.djangoproject.com/svn/django/trunk@8387 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-08-09Split CacheMiddleware up into two parts -- an update-cache and a ↵Jacob Kaplan-Moss
fetch-from-cache middleware. This lets you run each half of the cache middleware at the correct time to avoid bad interactions between the cache middleware and other middleware that must modify the cache key (like the locale middleware). CacheMiddleware itself is still around for backwards-compatibility and as a hook point for the cache decorator, but the documentation has been updated to point people towards the two-part caching middleware. Refs #730. git-svn-id: http://code.djangoproject.com/svn/django/trunk@8260 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-08-09Fixed #8121 -- Don't override the Content-Language HTTP header in the localeMalcolm Tredinnick
middleware if it's already been set. Thanks, jcassee. git-svn-id: http://code.djangoproject.com/svn/django/trunk@8259 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-08-02Fixed #7919 -- md5 and sha modules are deprecated since Python 2.5, use ↵Gary Wilson Jr
hashlib module when available. Patch from Karen Tracey. git-svn-id: http://code.djangoproject.com/svn/django/trunk@8193 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-06-30Fixed #7046 -- set the response status code correctly in ↵Malcolm Tredinnick
ConditionalGetMiddleware. git-svn-id: http://code.djangoproject.com/svn/django/trunk@7793 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-06-16Fixed #7228 -- Fixed our ETag header creation to meet the HTTP spec, by ↵Adrian Holovaty
quoting it. Thanks, skjohn@us.ibm.com git-svn-id: http://code.djangoproject.com/svn/django/trunk@7659 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-02-04Fixed #6480 -- Added application/pdf the list of content types we don't ↵Malcolm Tredinnick
compress when sending to Internet Explorer. Thanks, Bastien Kleineidam. git-svn-id: http://code.djangoproject.com/svn/django/trunk@7080 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2007-12-02Fixed #3228 -- Added new APPEND_SLASH handling behaviour in the common ↵Malcolm Tredinnick
middleware. Makes customisation a bit easier. Thanks, Mihai Preda and Andy Gayton. git-svn-id: http://code.djangoproject.com/svn/django/trunk@6852 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2007-11-29Fixed #5813 -- Taught the CacheMiddleware to respect any max-age HTTP headerMalcolm Tredinnick
when setting the expiry time. Thanks, SmileyChris. git-svn-id: http://code.djangoproject.com/svn/django/trunk@6736 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2007-11-19Made some stylistic changes in `GZipMiddleware` and added some notes about ↵Gary Wilson Jr
IE, refs #5313. git-svn-id: http://code.djangoproject.com/svn/django/trunk@6697 bcc190cf-cafb-0310-a4f2-bffc1f526a37
generated by cgit v1.3 (git 2.53.0) at 2026-10-17 07:46:06 +0000