From 668d53cd125175eb708cc0af143f47b42cd42153 Mon Sep 17 00:00:00 2001 From: Grzegorz Slusarek Date: Sat, 21 Feb 2015 22:57:02 +0100 Subject: Fixed #21495 -- Added settings.CSRF_HEADER_NAME --- django/conf/global_settings.py | 1 + django/middleware/csrf.py | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) (limited to 'django') diff --git a/django/conf/global_settings.py b/django/conf/global_settings.py index 41abd4f499..d817ea8e94 100644 --- a/django/conf/global_settings.py +++ b/django/conf/global_settings.py @@ -555,6 +555,7 @@ CSRF_COOKIE_DOMAIN = None CSRF_COOKIE_PATH = '/' CSRF_COOKIE_SECURE = False CSRF_COOKIE_HTTPONLY = False +CSRF_HEADER_NAME = 'HTTP_X_CSRFTOKEN' ############ # MESSAGES # diff --git a/django/middleware/csrf.py b/django/middleware/csrf.py index f12126fa9f..8891a44109 100644 --- a/django/middleware/csrf.py +++ b/django/middleware/csrf.py @@ -183,7 +183,7 @@ class CsrfViewMiddleware(object): if request_csrf_token == "": # Fall back to X-CSRFToken, to make things easier for AJAX, # and possible for PUT/DELETE. - request_csrf_token = request.META.get('HTTP_X_CSRFTOKEN', '') + request_csrf_token = request.META.get(settings.CSRF_HEADER_NAME, '') if not constant_time_compare(request_csrf_token, csrf_token): return self._reject(request, REASON_BAD_TOKEN) -- cgit v1.3