From 5b984a0262c42ef5ac8f05a687978235a12a6e28 Mon Sep 17 00:00:00 2001 From: Jeremy Kerr Date: Tue, 10 Aug 2010 12:11:40 +0800 Subject: views: implement CSRF protection Since we've got the csrf token present, we may as well check it for requests. We're using RequestContext already (via PatchworkRequestContext), so we just need to switch it on in the settings, and add an exemption on the xmlrpc interface. Signed-off-by: Jeremy Kerr --- apps/patchwork/views/xmlrpc.py | 2 ++ apps/settings.py | 1 + 2 files changed, 3 insertions(+) diff --git a/apps/patchwork/views/xmlrpc.py b/apps/patchwork/views/xmlrpc.py index 23e58bf..0d3321f 100644 --- a/apps/patchwork/views/xmlrpc.py +++ b/apps/patchwork/views/xmlrpc.py @@ -29,6 +29,7 @@ from django.core import urlresolvers from django.shortcuts import render_to_response from django.contrib.auth import authenticate from patchwork.models import Patch, Project, Person, Bundle, State +from django.views.decorators.csrf import csrf_exempt import sys import base64 @@ -120,6 +121,7 @@ class PatchworkXMLRPCDispatcher(SimpleXMLRPCDispatcher): dispatcher = PatchworkXMLRPCDispatcher() # XMLRPC view function +@csrf_exempt def xmlrpc(request): if request.method != 'POST': return HttpResponseRedirect( diff --git a/apps/settings.py b/apps/settings.py index 20c8db3..68837b3 100644 --- a/apps/settings.py +++ b/apps/settings.py @@ -62,6 +62,7 @@ MIDDLEWARE_CLASSES = ( 'django.contrib.sessions.middleware.SessionMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'django.middleware.doc.XViewMiddleware', + 'django.middleware.csrf.CsrfViewMiddleware', ) ROOT_URLCONF = 'apps.urls' -- cgit v1.2.3