2013-11-02 16:30:39 +08:00
|
|
|
|
from django.conf import settings
|
Fixed #9977 - CsrfMiddleware gets template tag added, session dependency removed, and turned on by default.
This is a large change to CSRF protection for Django. It includes:
* removing the dependency on the session framework.
* deprecating CsrfResponseMiddleware, and replacing with a core template tag.
* turning on CSRF protection by default by adding CsrfViewMiddleware to
the default value of MIDDLEWARE_CLASSES.
* protecting all contrib apps (whatever is in settings.py)
using a decorator.
For existing users of the CSRF functionality, it should be a seamless update,
but please note that it includes DEPRECATION of features in Django 1.1,
and there are upgrade steps which are detailed in the docs.
Many thanks to 'Glenn' and 'bthomas', who did a lot of the thinking and work
on the patch, and to lots of other people including Simon Willison and
Russell Keith-Magee who refined the ideas.
Details of the rationale for these changes is found here:
http://code.djangoproject.com/wiki/CsrfProtection
As of this commit, the CSRF code is mainly in 'contrib'. The code will be
moved to core in a separate commit, to make the changeset as readable as
possible.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11660 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27 07:23:07 +08:00
|
|
|
|
from django.http import HttpResponseForbidden
|
2015-11-07 21:18:06 +08:00
|
|
|
|
from django.template import Context, Engine, TemplateDoesNotExist, loader
|
2017-01-27 03:58:33 +08:00
|
|
|
|
from django.utils.translation import gettext as _
|
2014-12-25 20:30:37 +08:00
|
|
|
|
from django.utils.version import get_docs_version
|
Fixed #9977 - CsrfMiddleware gets template tag added, session dependency removed, and turned on by default.
This is a large change to CSRF protection for Django. It includes:
* removing the dependency on the session framework.
* deprecating CsrfResponseMiddleware, and replacing with a core template tag.
* turning on CSRF protection by default by adding CsrfViewMiddleware to
the default value of MIDDLEWARE_CLASSES.
* protecting all contrib apps (whatever is in settings.py)
using a decorator.
For existing users of the CSRF functionality, it should be a seamless update,
but please note that it includes DEPRECATION of features in Django 1.1,
and there are upgrade steps which are detailed in the docs.
Many thanks to 'Glenn' and 'bthomas', who did a lot of the thinking and work
on the patch, and to lots of other people including Simon Willison and
Russell Keith-Magee who refined the ideas.
Details of the rationale for these changes is found here:
http://code.djangoproject.com/wiki/CsrfProtection
As of this commit, the CSRF code is mainly in 'contrib'. The code will be
moved to core in a separate commit, to make the changeset as readable as
possible.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11660 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27 07:23:07 +08:00
|
|
|
|
|
|
|
|
|
|
# We include the template inline since we need to be able to reliably display
|
|
|
|
|
|
# this error message, especially for the sake of developers, and there isn't any
|
|
|
|
|
|
# other way of making it available independent of what is in the settings file.
|
|
|
|
|
|
|
2013-11-02 16:30:39 +08:00
|
|
|
|
# Only the text appearing with DEBUG=False is translated. Normal translation
|
|
|
|
|
|
# tags cannot be used with this inline templates as makemessages would not be
|
|
|
|
|
|
# able to discover the strings.
|
|
|
|
|
|
|
2011-05-12 11:03:16 +08:00
|
|
|
|
CSRF_FAILURE_TEMPLATE = """
|
2011-04-21 01:40:53 +08:00
|
|
|
|
<!DOCTYPE html>
|
Fixed #9977 - CsrfMiddleware gets template tag added, session dependency removed, and turned on by default.
This is a large change to CSRF protection for Django. It includes:
* removing the dependency on the session framework.
* deprecating CsrfResponseMiddleware, and replacing with a core template tag.
* turning on CSRF protection by default by adding CsrfViewMiddleware to
the default value of MIDDLEWARE_CLASSES.
* protecting all contrib apps (whatever is in settings.py)
using a decorator.
For existing users of the CSRF functionality, it should be a seamless update,
but please note that it includes DEPRECATION of features in Django 1.1,
and there are upgrade steps which are detailed in the docs.
Many thanks to 'Glenn' and 'bthomas', who did a lot of the thinking and work
on the patch, and to lots of other people including Simon Willison and
Russell Keith-Magee who refined the ideas.
Details of the rationale for these changes is found here:
http://code.djangoproject.com/wiki/CsrfProtection
As of this commit, the CSRF code is mainly in 'contrib'. The code will be
moved to core in a separate commit, to make the changeset as readable as
possible.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11660 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27 07:23:07 +08:00
|
|
|
|
<html lang="en">
|
|
|
|
|
|
<head>
|
|
|
|
|
|
<meta http-equiv="content-type" content="text/html; charset=utf-8">
|
2010-05-23 02:42:16 +08:00
|
|
|
|
<meta name="robots" content="NONE,NOARCHIVE">
|
Fixed #9977 - CsrfMiddleware gets template tag added, session dependency removed, and turned on by default.
This is a large change to CSRF protection for Django. It includes:
* removing the dependency on the session framework.
* deprecating CsrfResponseMiddleware, and replacing with a core template tag.
* turning on CSRF protection by default by adding CsrfViewMiddleware to
the default value of MIDDLEWARE_CLASSES.
* protecting all contrib apps (whatever is in settings.py)
using a decorator.
For existing users of the CSRF functionality, it should be a seamless update,
but please note that it includes DEPRECATION of features in Django 1.1,
and there are upgrade steps which are detailed in the docs.
Many thanks to 'Glenn' and 'bthomas', who did a lot of the thinking and work
on the patch, and to lots of other people including Simon Willison and
Russell Keith-Magee who refined the ideas.
Details of the rationale for these changes is found here:
http://code.djangoproject.com/wiki/CsrfProtection
As of this commit, the CSRF code is mainly in 'contrib'. The code will be
moved to core in a separate commit, to make the changeset as readable as
possible.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11660 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27 07:23:07 +08:00
|
|
|
|
<title>403 Forbidden</title>
|
2010-05-23 02:42:16 +08:00
|
|
|
|
<style type="text/css">
|
|
|
|
|
|
html * { padding:0; margin:0; }
|
|
|
|
|
|
body * { padding:10px 20px; }
|
|
|
|
|
|
body * * { padding:0; }
|
2017-09-21 22:23:23 +08:00
|
|
|
|
body { font:small sans-serif; background:#eee; color:#000; }
|
2010-05-23 02:42:16 +08:00
|
|
|
|
body>div { border-bottom:1px solid #ddd; }
|
|
|
|
|
|
h1 { font-weight:normal; margin-bottom:.4em; }
|
|
|
|
|
|
h1 span { font-size:60%; color:#666; font-weight:normal; }
|
|
|
|
|
|
#info { background:#f6f6f6; }
|
|
|
|
|
|
#info ul { margin: 0.5em 4em; }
|
2010-09-04 00:28:10 +08:00
|
|
|
|
#info p, #summary p { padding-top:10px; }
|
2010-05-23 02:42:16 +08:00
|
|
|
|
#summary { background: #ffc; }
|
|
|
|
|
|
#explanation { background:#eee; border-bottom: 0px none; }
|
|
|
|
|
|
</style>
|
Fixed #9977 - CsrfMiddleware gets template tag added, session dependency removed, and turned on by default.
This is a large change to CSRF protection for Django. It includes:
* removing the dependency on the session framework.
* deprecating CsrfResponseMiddleware, and replacing with a core template tag.
* turning on CSRF protection by default by adding CsrfViewMiddleware to
the default value of MIDDLEWARE_CLASSES.
* protecting all contrib apps (whatever is in settings.py)
using a decorator.
For existing users of the CSRF functionality, it should be a seamless update,
but please note that it includes DEPRECATION of features in Django 1.1,
and there are upgrade steps which are detailed in the docs.
Many thanks to 'Glenn' and 'bthomas', who did a lot of the thinking and work
on the patch, and to lots of other people including Simon Willison and
Russell Keith-Magee who refined the ideas.
Details of the rationale for these changes is found here:
http://code.djangoproject.com/wiki/CsrfProtection
As of this commit, the CSRF code is mainly in 'contrib'. The code will be
moved to core in a separate commit, to make the changeset as readable as
possible.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11660 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27 07:23:07 +08:00
|
|
|
|
</head>
|
|
|
|
|
|
<body>
|
2010-05-23 02:42:16 +08:00
|
|
|
|
<div id="summary">
|
2013-11-02 16:30:39 +08:00
|
|
|
|
<h1>{{ title }} <span>(403)</span></h1>
|
|
|
|
|
|
<p>{{ main }}</p>
|
2010-09-04 00:28:10 +08:00
|
|
|
|
{% if no_referer %}
|
2013-11-02 16:30:39 +08:00
|
|
|
|
<p>{{ no_referer1 }}</p>
|
|
|
|
|
|
<p>{{ no_referer2 }}</p>
|
2017-05-25 07:36:45 +08:00
|
|
|
|
<p>{{ no_referer3 }}</p>
|
2010-09-04 00:28:10 +08:00
|
|
|
|
{% endif %}
|
2013-11-03 16:18:48 +08:00
|
|
|
|
{% if no_cookie %}
|
|
|
|
|
|
<p>{{ no_cookie1 }}</p>
|
|
|
|
|
|
<p>{{ no_cookie2 }}</p>
|
|
|
|
|
|
{% endif %}
|
2010-05-23 02:42:16 +08:00
|
|
|
|
</div>
|
|
|
|
|
|
{% if DEBUG %}
|
|
|
|
|
|
<div id="info">
|
Fixed #9977 - CsrfMiddleware gets template tag added, session dependency removed, and turned on by default.
This is a large change to CSRF protection for Django. It includes:
* removing the dependency on the session framework.
* deprecating CsrfResponseMiddleware, and replacing with a core template tag.
* turning on CSRF protection by default by adding CsrfViewMiddleware to
the default value of MIDDLEWARE_CLASSES.
* protecting all contrib apps (whatever is in settings.py)
using a decorator.
For existing users of the CSRF functionality, it should be a seamless update,
but please note that it includes DEPRECATION of features in Django 1.1,
and there are upgrade steps which are detailed in the docs.
Many thanks to 'Glenn' and 'bthomas', who did a lot of the thinking and work
on the patch, and to lots of other people including Simon Willison and
Russell Keith-Magee who refined the ideas.
Details of the rationale for these changes is found here:
http://code.djangoproject.com/wiki/CsrfProtection
As of this commit, the CSRF code is mainly in 'contrib'. The code will be
moved to core in a separate commit, to make the changeset as readable as
possible.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11660 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27 07:23:07 +08:00
|
|
|
|
<h2>Help</h2>
|
|
|
|
|
|
{% if reason %}
|
|
|
|
|
|
<p>Reason given for failure:</p>
|
|
|
|
|
|
<pre>
|
|
|
|
|
|
{{ reason }}
|
|
|
|
|
|
</pre>
|
|
|
|
|
|
{% endif %}
|
|
|
|
|
|
|
|
|
|
|
|
<p>In general, this can occur when there is a genuine Cross Site Request Forgery, or when
|
|
|
|
|
|
<a
|
2014-12-25 20:56:16 +08:00
|
|
|
|
href="https://docs.djangoproject.com/en/{{ docs_version }}/ref/csrf/">Django's
|
Fixed #9977 - CsrfMiddleware gets template tag added, session dependency removed, and turned on by default.
This is a large change to CSRF protection for Django. It includes:
* removing the dependency on the session framework.
* deprecating CsrfResponseMiddleware, and replacing with a core template tag.
* turning on CSRF protection by default by adding CsrfViewMiddleware to
the default value of MIDDLEWARE_CLASSES.
* protecting all contrib apps (whatever is in settings.py)
using a decorator.
For existing users of the CSRF functionality, it should be a seamless update,
but please note that it includes DEPRECATION of features in Django 1.1,
and there are upgrade steps which are detailed in the docs.
Many thanks to 'Glenn' and 'bthomas', who did a lot of the thinking and work
on the patch, and to lots of other people including Simon Willison and
Russell Keith-Magee who refined the ideas.
Details of the rationale for these changes is found here:
http://code.djangoproject.com/wiki/CsrfProtection
As of this commit, the CSRF code is mainly in 'contrib'. The code will be
moved to core in a separate commit, to make the changeset as readable as
possible.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11660 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27 07:23:07 +08:00
|
|
|
|
CSRF mechanism</a> has not been used correctly. For POST forms, you need to
|
|
|
|
|
|
ensure:</p>
|
|
|
|
|
|
|
|
|
|
|
|
<ul>
|
2012-02-22 07:54:02 +08:00
|
|
|
|
<li>Your browser is accepting cookies.</li>
|
|
|
|
|
|
|
2015-02-22 22:40:04 +08:00
|
|
|
|
<li>The view function passes a <code>request</code> to the template's <a
|
|
|
|
|
|
href="https://docs.djangoproject.com/en/dev/topics/templates/#django.template.backends.base.Template.render"><code>render</code></a>
|
|
|
|
|
|
method.</li>
|
Fixed #9977 - CsrfMiddleware gets template tag added, session dependency removed, and turned on by default.
This is a large change to CSRF protection for Django. It includes:
* removing the dependency on the session framework.
* deprecating CsrfResponseMiddleware, and replacing with a core template tag.
* turning on CSRF protection by default by adding CsrfViewMiddleware to
the default value of MIDDLEWARE_CLASSES.
* protecting all contrib apps (whatever is in settings.py)
using a decorator.
For existing users of the CSRF functionality, it should be a seamless update,
but please note that it includes DEPRECATION of features in Django 1.1,
and there are upgrade steps which are detailed in the docs.
Many thanks to 'Glenn' and 'bthomas', who did a lot of the thinking and work
on the patch, and to lots of other people including Simon Willison and
Russell Keith-Magee who refined the ideas.
Details of the rationale for these changes is found here:
http://code.djangoproject.com/wiki/CsrfProtection
As of this commit, the CSRF code is mainly in 'contrib'. The code will be
moved to core in a separate commit, to make the changeset as readable as
possible.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11660 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27 07:23:07 +08:00
|
|
|
|
|
2009-10-29 22:17:39 +08:00
|
|
|
|
<li>In the template, there is a <code>{% templatetag openblock %} csrf_token
|
|
|
|
|
|
{% templatetag closeblock %}</code> template tag inside each POST form that
|
Fixed #9977 - CsrfMiddleware gets template tag added, session dependency removed, and turned on by default.
This is a large change to CSRF protection for Django. It includes:
* removing the dependency on the session framework.
* deprecating CsrfResponseMiddleware, and replacing with a core template tag.
* turning on CSRF protection by default by adding CsrfViewMiddleware to
the default value of MIDDLEWARE_CLASSES.
* protecting all contrib apps (whatever is in settings.py)
using a decorator.
For existing users of the CSRF functionality, it should be a seamless update,
but please note that it includes DEPRECATION of features in Django 1.1,
and there are upgrade steps which are detailed in the docs.
Many thanks to 'Glenn' and 'bthomas', who did a lot of the thinking and work
on the patch, and to lots of other people including Simon Willison and
Russell Keith-Magee who refined the ideas.
Details of the rationale for these changes is found here:
http://code.djangoproject.com/wiki/CsrfProtection
As of this commit, the CSRF code is mainly in 'contrib'. The code will be
moved to core in a separate commit, to make the changeset as readable as
possible.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11660 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27 07:23:07 +08:00
|
|
|
|
targets an internal URL.</li>
|
2009-11-03 22:40:37 +08:00
|
|
|
|
|
|
|
|
|
|
<li>If you are not using <code>CsrfViewMiddleware</code>, then you must use
|
|
|
|
|
|
<code>csrf_protect</code> on any views that use the <code>csrf_token</code>
|
|
|
|
|
|
template tag, as well as those that accept the POST data.</li>
|
|
|
|
|
|
|
2016-04-03 17:35:24 +08:00
|
|
|
|
<li>The form has a valid CSRF token. After logging in in another browser
|
|
|
|
|
|
tab or hitting the back button after a login, you may need to reload the
|
|
|
|
|
|
page with the form, because the token is rotated after a login.</li>
|
Fixed #9977 - CsrfMiddleware gets template tag added, session dependency removed, and turned on by default.
This is a large change to CSRF protection for Django. It includes:
* removing the dependency on the session framework.
* deprecating CsrfResponseMiddleware, and replacing with a core template tag.
* turning on CSRF protection by default by adding CsrfViewMiddleware to
the default value of MIDDLEWARE_CLASSES.
* protecting all contrib apps (whatever is in settings.py)
using a decorator.
For existing users of the CSRF functionality, it should be a seamless update,
but please note that it includes DEPRECATION of features in Django 1.1,
and there are upgrade steps which are detailed in the docs.
Many thanks to 'Glenn' and 'bthomas', who did a lot of the thinking and work
on the patch, and to lots of other people including Simon Willison and
Russell Keith-Magee who refined the ideas.
Details of the rationale for these changes is found here:
http://code.djangoproject.com/wiki/CsrfProtection
As of this commit, the CSRF code is mainly in 'contrib'. The code will be
moved to core in a separate commit, to make the changeset as readable as
possible.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11660 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27 07:23:07 +08:00
|
|
|
|
</ul>
|
|
|
|
|
|
|
|
|
|
|
|
<p>You're seeing the help section of this page because you have <code>DEBUG =
|
|
|
|
|
|
True</code> in your Django settings file. Change that to <code>False</code>,
|
|
|
|
|
|
and only the initial error message will be displayed. </p>
|
|
|
|
|
|
|
|
|
|
|
|
<p>You can customize this page using the CSRF_FAILURE_VIEW setting.</p>
|
2010-05-23 02:42:16 +08:00
|
|
|
|
</div>
|
|
|
|
|
|
{% else %}
|
|
|
|
|
|
<div id="explanation">
|
2013-11-02 16:30:39 +08:00
|
|
|
|
<p><small>{{ more }}</small></p>
|
2010-05-23 02:42:16 +08:00
|
|
|
|
</div>
|
|
|
|
|
|
{% endif %}
|
Fixed #9977 - CsrfMiddleware gets template tag added, session dependency removed, and turned on by default.
This is a large change to CSRF protection for Django. It includes:
* removing the dependency on the session framework.
* deprecating CsrfResponseMiddleware, and replacing with a core template tag.
* turning on CSRF protection by default by adding CsrfViewMiddleware to
the default value of MIDDLEWARE_CLASSES.
* protecting all contrib apps (whatever is in settings.py)
using a decorator.
For existing users of the CSRF functionality, it should be a seamless update,
but please note that it includes DEPRECATION of features in Django 1.1,
and there are upgrade steps which are detailed in the docs.
Many thanks to 'Glenn' and 'bthomas', who did a lot of the thinking and work
on the patch, and to lots of other people including Simon Willison and
Russell Keith-Magee who refined the ideas.
Details of the rationale for these changes is found here:
http://code.djangoproject.com/wiki/CsrfProtection
As of this commit, the CSRF code is mainly in 'contrib'. The code will be
moved to core in a separate commit, to make the changeset as readable as
possible.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11660 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27 07:23:07 +08:00
|
|
|
|
</body>
|
|
|
|
|
|
</html>
|
|
|
|
|
|
"""
|
2015-11-07 21:18:06 +08:00
|
|
|
|
CSRF_FAILURE_TEMPLATE_NAME = "403_csrf.html"
|
Fixed #9977 - CsrfMiddleware gets template tag added, session dependency removed, and turned on by default.
This is a large change to CSRF protection for Django. It includes:
* removing the dependency on the session framework.
* deprecating CsrfResponseMiddleware, and replacing with a core template tag.
* turning on CSRF protection by default by adding CsrfViewMiddleware to
the default value of MIDDLEWARE_CLASSES.
* protecting all contrib apps (whatever is in settings.py)
using a decorator.
For existing users of the CSRF functionality, it should be a seamless update,
but please note that it includes DEPRECATION of features in Django 1.1,
and there are upgrade steps which are detailed in the docs.
Many thanks to 'Glenn' and 'bthomas', who did a lot of the thinking and work
on the patch, and to lots of other people including Simon Willison and
Russell Keith-Magee who refined the ideas.
Details of the rationale for these changes is found here:
http://code.djangoproject.com/wiki/CsrfProtection
As of this commit, the CSRF code is mainly in 'contrib'. The code will be
moved to core in a separate commit, to make the changeset as readable as
possible.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11660 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27 07:23:07 +08:00
|
|
|
|
|
2013-11-02 16:30:39 +08:00
|
|
|
|
|
2015-11-07 21:18:06 +08:00
|
|
|
|
def csrf_failure(request, reason="", template_name=CSRF_FAILURE_TEMPLATE_NAME):
|
Fixed #9977 - CsrfMiddleware gets template tag added, session dependency removed, and turned on by default.
This is a large change to CSRF protection for Django. It includes:
* removing the dependency on the session framework.
* deprecating CsrfResponseMiddleware, and replacing with a core template tag.
* turning on CSRF protection by default by adding CsrfViewMiddleware to
the default value of MIDDLEWARE_CLASSES.
* protecting all contrib apps (whatever is in settings.py)
using a decorator.
For existing users of the CSRF functionality, it should be a seamless update,
but please note that it includes DEPRECATION of features in Django 1.1,
and there are upgrade steps which are detailed in the docs.
Many thanks to 'Glenn' and 'bthomas', who did a lot of the thinking and work
on the patch, and to lots of other people including Simon Willison and
Russell Keith-Magee who refined the ideas.
Details of the rationale for these changes is found here:
http://code.djangoproject.com/wiki/CsrfProtection
As of this commit, the CSRF code is mainly in 'contrib'. The code will be
moved to core in a separate commit, to make the changeset as readable as
possible.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11660 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27 07:23:07 +08:00
|
|
|
|
"""
|
|
|
|
|
|
Default view used when request fails CSRF protection
|
|
|
|
|
|
"""
|
2013-11-03 16:18:48 +08:00
|
|
|
|
from django.middleware.csrf import REASON_NO_REFERER, REASON_NO_CSRF_COOKIE
|
2016-12-29 05:03:20 +08:00
|
|
|
|
c = {
|
2013-11-02 16:30:39 +08:00
|
|
|
|
'title': _("Forbidden"),
|
|
|
|
|
|
'main': _("CSRF verification failed. Request aborted."),
|
|
|
|
|
|
'reason': reason,
|
|
|
|
|
|
'no_referer': reason == REASON_NO_REFERER,
|
|
|
|
|
|
'no_referer1': _(
|
2019-06-28 00:39:47 +08:00
|
|
|
|
'You are seeing this message because this HTTPS site requires a '
|
|
|
|
|
|
'“Referer header” to be sent by your Web browser, but none was '
|
|
|
|
|
|
'sent. This header is required for security reasons, to ensure '
|
|
|
|
|
|
'that your browser is not being hijacked by third parties.'),
|
2013-11-02 16:30:39 +08:00
|
|
|
|
'no_referer2': _(
|
2019-06-28 00:39:47 +08:00
|
|
|
|
'If you have configured your browser to disable “Referer” headers, '
|
|
|
|
|
|
'please re-enable them, at least for this site, or for HTTPS '
|
|
|
|
|
|
'connections, or for “same-origin” requests.'),
|
2017-05-25 07:36:45 +08:00
|
|
|
|
'no_referer3': _(
|
2019-06-28 00:39:47 +08:00
|
|
|
|
'If you are using the <meta name="referrer" '
|
|
|
|
|
|
'content=\"no-referrer\"> tag or including the “Referrer-Policy: '
|
|
|
|
|
|
'no-referrer” header, please remove them. The CSRF protection '
|
|
|
|
|
|
'requires the “Referer” header to do strict referer checking. If '
|
|
|
|
|
|
'you’re concerned about privacy, use alternatives like '
|
|
|
|
|
|
'<a rel=\"noreferrer\" …> for links to third-party sites.'),
|
2013-11-03 16:18:48 +08:00
|
|
|
|
'no_cookie': reason == REASON_NO_CSRF_COOKIE,
|
|
|
|
|
|
'no_cookie1': _(
|
|
|
|
|
|
"You are seeing this message because this site requires a CSRF "
|
|
|
|
|
|
"cookie when submitting forms. This cookie is required for "
|
|
|
|
|
|
"security reasons, to ensure that your browser is not being "
|
|
|
|
|
|
"hijacked by third parties."),
|
|
|
|
|
|
'no_cookie2': _(
|
2019-06-28 00:39:47 +08:00
|
|
|
|
'If you have configured your browser to disable cookies, please '
|
|
|
|
|
|
're-enable them, at least for this site, or for “same-origin” '
|
|
|
|
|
|
'requests.'),
|
2013-11-02 16:30:39 +08:00
|
|
|
|
'DEBUG': settings.DEBUG,
|
2014-12-25 20:30:37 +08:00
|
|
|
|
'docs_version': get_docs_version(),
|
2013-11-02 16:30:39 +08:00
|
|
|
|
'more': _("More information is available with DEBUG=True."),
|
2016-12-29 05:03:20 +08:00
|
|
|
|
}
|
2015-11-07 21:18:06 +08:00
|
|
|
|
try:
|
|
|
|
|
|
t = loader.get_template(template_name)
|
|
|
|
|
|
except TemplateDoesNotExist:
|
|
|
|
|
|
if template_name == CSRF_FAILURE_TEMPLATE_NAME:
|
|
|
|
|
|
# If the default template doesn't exist, use the string template.
|
|
|
|
|
|
t = Engine().from_string(CSRF_FAILURE_TEMPLATE)
|
2016-12-29 05:03:20 +08:00
|
|
|
|
c = Context(c)
|
2015-11-07 21:18:06 +08:00
|
|
|
|
else:
|
|
|
|
|
|
# Raise if a developer-specified template doesn't exist.
|
|
|
|
|
|
raise
|
2012-07-01 03:19:07 +08:00
|
|
|
|
return HttpResponseForbidden(t.render(c), content_type='text/html')
|
