summaryrefslogtreecommitdiff
path: root/tests/regressiontests/csrf_tests
AgeCommit message (Collapse)Author
2013-02-26Merged regressiontests and modeltests into the test root.Florian Apolloner
2013-02-19Added a new required ALLOWED_HOSTS setting for HTTP host header validation.Carl Meyer
This is a security fix; disclosure and advisory coming shortly.
2013-02-07Fixed #15808 -- Added optional HttpOnly flag to the CSRF Cookie.Aymeric Augustin
Thanks Samuel Lavitt for the report and Sascha Peilicke for the patch.
2012-08-13[py3] Made csrf context processor return UnicodeClaude Paroz
2012-06-07Fixed #18269 -- Applied unicode_literals for Python 3 compatibility.Claude Paroz
Thanks Vinay Sajip for the support of his django3 branch and Jannis Leidel for the review.
2012-05-19Marked bytestrings with b prefix. Refs #18269Claude Paroz
This is a preparation for unicode literals general usage in Django (Python 3 compatibility).
2012-03-30Removed with_statement imports, useless in Python >= 2.6. Refs #17965. ↵Claude Paroz
Thanks jonash for the patch. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17828 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-02-11Fixes #16827. Adds a length check to CSRF tokens before applying the ↵Paul McMillan
santizing regex. Thanks to jedie for the report and zsiciarz for the initial patch. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17500 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-12-17Fixed some failing tests due to creation of HttpRequest._is_secure() methods ↵Adrian Holovaty
in [17209] git-svn-id: http://code.djangoproject.com/svn/django/trunk@17212 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-10-13Convert much of the regression tests to use absolute imports. There's still ↵Alex Gaynor
work to be done though. git-svn-id: http://code.djangoproject.com/svn/django/trunk@16976 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-07-13Fixed #16225 -- Removed unused imports. Many thanks to Aymeric Augustin for ↵Jannis Leidel
the work on the patch and Alex for reviewing. git-svn-id: http://code.djangoproject.com/svn/django/trunk@16539 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-05-11Fixed #16002 - test failure due to missing `from __future__ import ↵Luke Plant
with_statement` Thanks to julien for the report git-svn-id: http://code.djangoproject.com/svn/django/trunk@16213 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-05-09Fixed #15258 - Ajax CSRF protection doesn't apply to PUT or DELETE requestsLuke Plant
Thanks to brodie for the report, and further input from tow21 This is a potentially backwards incompatible change - if you were doing PUT/DELETE requests and relying on the lack of protection, you will need to update your code, as noted in the releaste notes. git-svn-id: http://code.djangoproject.com/svn/django/trunk@16201 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-05-09Fixed #14134 - ability to set cookie 'path' and 'secure' attributes of CSRF ↵Luke Plant
cookie Thanks to cfattarsi for the report and initial patch. git-svn-id: http://code.djangoproject.com/svn/django/trunk@16200 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-05-09Fixed #15354 - provide method to ensure CSRF token is always available for ↵Luke Plant
AJAX requests Thanks to sayane for the report. git-svn-id: http://code.djangoproject.com/svn/django/trunk@16192 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-04-02Updates to the test suite to allow for newly deprecated and removed featuresRussell Keith-Magee
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15990 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-03-30Cleaned up some test code.Luke Plant
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15957 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-03-30Deprecated csrf_response_exempt and csrf_view_exempt decoratorsLuke Plant
With the removal of CsrfResponseMiddleware, csrf_response_exempt serves no purposes, and csrf_exempt and csrf_view_exempt perform the same function. git-svn-id: http://code.djangoproject.com/svn/django/trunk@15956 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-03-30Removed deprecated CsrfResponseMiddleware, and corresponding tests and docsLuke Plant
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15949 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-03-30Removed Django 1.1 fallback for CSRF checks.Luke Plant
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15948 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-03-15Fixed #15617 - CSRF referer checking too strictLuke Plant
Thanks to adam for the report. git-svn-id: http://code.djangoproject.com/svn/django/trunk@15840 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-03-03Updated test assertions that have been deprecated by the move to unittest2. ↵Russell Keith-Magee
In summary, this means: assert_ -> assertTrue assertEquals -> assertEqual failUnless -> assertTrue For full details, see http://www.voidspace.org.uk/python/articles/unittest2.shtml#deprecations git-svn-id: http://code.djangoproject.com/svn/django/trunk@15728 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-02-09Fixed a security issue in the CSRF component. Disclosure and new release ↵Alex Gaynor
forthcoming. git-svn-id: http://code.djangoproject.com/svn/django/trunk@15464 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-11-11Fixed #14508 - test suite silences warnings.Luke Plant
Utility functions get_warnings_state and save_warnings_state have been added to django.test.utils, and methods to django.test.TestCase for convenience. The implementation is based on the catch_warnings context manager from Python 2.6. git-svn-id: http://code.djangoproject.com/svn/django/trunk@14526 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-10-28Fixed #14565 - No csrf_token on 404 page.Luke Plant
This solution doesn't have the negative side-effects of [14356]. git-svn-id: http://code.djangoproject.com/svn/django/trunk@14377 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-10-11Fixed #14436 -- Escalated 1.2 PendingDeprecationWarnings to ↵Russell Keith-Magee
DeprecationWarnings, and removed 1.1 deprecated code. git-svn-id: http://code.djangoproject.com/svn/django/trunk@14138 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-09-10Fixed a test so that it actually tests what it's supposed to test.Luke Plant
Previously it passed whether or not the view was 'csrf_exempt'ed. git-svn-id: http://code.djangoproject.com/svn/django/trunk@13735 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-09-10Fixed #14235 - UnicodeDecodeError in CSRF middlewareLuke Plant
Thanks to jbg for the report. This changeset essentially backs out [13698] in favour of a method that sanitizes the token rather than escaping it. git-svn-id: http://code.djangoproject.com/svn/django/trunk@13732 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-09-09Patch CSRF-protection system to deal with reported security issue. ↵James Bennett
Announcement and details to follow. git-svn-id: http://code.djangoproject.com/svn/django/trunk@13698 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-06-08Fixed #13716 - the CSRF get_token function stopped working for views with ↵Luke Plant
csrf_view_exempt This was a regression caused by the the CSRF changes in 1.2. Thanks to edevil for the report. git-svn-id: http://code.djangoproject.com/svn/django/trunk@13336 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-01-04Fixed #12053 - form examples don't validate according to w3cLuke Plant
Thanks to skyl for the report. git-svn-id: http://code.djangoproject.com/svn/django/trunk@12086 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27Moved contrib.csrf.* to core code.Luke Plant
There is stub code for backwards compatiblity with Django 1.1 imports. The documentation has been updated, but has been left in docs/contrib/csrf.txt for now, in order to avoid dead links to documentation on the website. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11661 bcc190cf-cafb-0310-a4f2-bffc1f526a37
generated by cgit v1.3 (git 2.53.0) at 2026-07-03 04:24:28 +0000