From 6872f42757d7ef6a97e0b6ec5db4d2615d8a2bd8 Mon Sep 17 00:00:00 2001 From: Aymeric Augustin Date: Sun, 20 Apr 2014 16:29:06 -0400 Subject: [1.5.x] Prevented leaking the CSRF token through caching. This is a security fix. Disclosure will follow shortly. Backport of c083e3815aec23b99833da710eea574e6f2e8566 from master --- django/middleware/cache.py | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) (limited to 'django/middleware/cache.py') diff --git a/django/middleware/cache.py b/django/middleware/cache.py index 94c18eac1e..611d9f3962 100644 --- a/django/middleware/cache.py +++ b/django/middleware/cache.py @@ -50,7 +50,8 @@ More details about how the caching works: from django.conf import settings from django.core.cache import get_cache, DEFAULT_CACHE_ALIAS -from django.utils.cache import get_cache_key, learn_cache_key, patch_response_headers, get_max_age +from django.utils.cache import (get_cache_key, get_max_age, has_vary_header, + learn_cache_key, patch_response_headers) class UpdateCacheMiddleware(object): @@ -93,8 +94,15 @@ class UpdateCacheMiddleware(object): if not self._should_update_cache(request, response): # We don't need to update the cache, just return. return response + if response.streaming or response.status_code != 200: return response + + # Don't cache responses that set a user-specific (and maybe security + # sensitive) cookie in response to a cookie-less request. + if not request.COOKIES and response.cookies and has_vary_header(response, 'Cookie'): + return response + # Try to get the timeout from the "max-age" section of the "Cache- # Control" header before reverting to using the default cache_timeout # length. -- cgit v1.3