innov
/
django1
1
0
Fork 0
Code Issues Pull Requests 1 Projects Releases Wiki Activity

Fixed #15469 - CSRF token is inserted on GET requests 

Thanks to goran for report.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@16191 bcc190cf-cafb-0310-a4f2-bffc1f526a37
This commit is contained in:
Luke Plant 2011-05-09 19:06:57 +00:00
parent 7c648ea4aa
commit e9342e9b32
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
docs/ref/contrib/csrf.txt
View File

@ -114,7 +114,11 @@ that allow headers to be set on every request. In jQuery, you can use the
// or any other URL that isn't scheme relative or absolute i.e relative.
!(/^(\/\/|http:|https:).*/.test(url));
}
if (sameOrigin(settings.url)) {
function safeMethod(method) {
return (method === 'GET' || method === 'HEAD');
}
if (!safeMethod(settings.type) && sameOrigin(settings.url)) {
xhr.setRequestHeader("X-CSRFToken", getCookie('csrftoken'));
}
});