From ac8b7ff02133f3d9112574e3660fd5ad042bc751 Mon Sep 17 00:00:00 2001 From: Luke Plant Date: Tue, 8 Jun 2010 14:35:48 +0000 Subject: Fixed #13716 - the CSRF get_token function stopped working for views with csrf_view_exempt This was a regression caused by the the CSRF changes in 1.2. Thanks to edevil for the report. git-svn-id: http://code.djangoproject.com/svn/django/trunk@13336 bcc190cf-cafb-0310-a4f2-bffc1f526a37 --- django/middleware/csrf.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'django') diff --git a/django/middleware/csrf.py b/django/middleware/csrf.py index 9ca727fca9..10fab290c9 100644 --- a/django/middleware/csrf.py +++ b/django/middleware/csrf.py @@ -62,9 +62,6 @@ class CsrfViewMiddleware(object): tag. """ def process_view(self, request, callback, callback_args, callback_kwargs): - if getattr(callback, 'csrf_exempt', False): - return None - if getattr(request, 'csrf_processing_done', False): return None @@ -90,6 +87,11 @@ class CsrfViewMiddleware(object): # place of a CSRF cookie for this request only. cookie_is_new = True + # Wait until request.META["CSRF_COOKIE"] has been manipulated before + # bailing out, so that get_token still works + if getattr(callback, 'csrf_exempt', False): + return None + if request.method == 'POST': if getattr(request, '_dont_enforce_csrf_checks', False): # Mechanism to turn off CSRF checks for test suite. It comes after -- cgit v1.3