p15693087
/
django
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[1.8.x] Changed `action="."` to `action=""` in tests and docs. 

`action="."` strips query parameters from the URL which is not usually what
you want. Copy-paste coding of these examples could lead to difficult to
track down bugs or even data loss if the query parameter was meant to alter
the scope of a form's POST request.

Backport of 77974a684a from master
This commit is contained in:
Luke Plant 2016-01-21 15:54:13 +00:00 committed by Tim Graham
parent 8502e9f049
commit a034ced2ef
4 changed files with 4 additions and 4 deletions
docs/ref
csrf.txt
tests
forms_tests/templates/forms_tests
article_form.html
templates
form_view.htmllogin.html

2
docs/ref/csrf.txt
View File

@ -40,7 +40,7 @@ To take advantage of CSRF protection in your views, follow these steps:
2. In any template that uses a POST form, use the :ttag:`csrf_token` tag inside 2. In any template that uses a POST form, use the :ttag:`csrf_token` tag inside
the ``<form>`` element if the form is for an internal URL, e.g.:: the ``<form>`` element if the form is for an internal URL, e.g.::
<form action="." method="post">{% csrf_token %} <form action="" method="post">{% csrf_token %}
This should not be done for POST forms that target external URLs, since This should not be done for POST forms that target external URLs, since
that would cause the CSRF token to be leaked, leading to a vulnerability. that would cause the CSRF token to be leaked, leading to a vulnerability.

2
tests/forms_tests/templates/forms_tests/article_form.html
View File

@ -1,6 +1,6 @@
<html> <html>
<body> <body>
<form method="post" action=".">{% csrf_token %} <form method="post" action="">{% csrf_token %}
{{ form.as_p }}<br> {{ form.as_p }}<br>
<input id="submit" type="submit"> <input id="submit" type="submit">
</form> </form>

2
tests/templates/form_view.html
View File

@ -2,7 +2,7 @@
{% block title %}Submit data{% endblock %} {% block title %}Submit data{% endblock %}
{% block content %} {% block content %}
<h1>{{ message }}</h1> <h1>{{ message }}</h1>
<form method='post' action='.'> <form method="post" action="">
{% if form.errors %} {% if form.errors %}
<p class='warning'>Please correct the errors below:</p> <p class='warning'>Please correct the errors below:</p>
{% endif %} {% endif %}

2
tests/templates/login.html
View File

@ -5,7 +5,7 @@
<p>Your username and password didn't match. Please try again.</p> <p>Your username and password didn't match. Please try again.</p>
{% endif %} {% endif %}
<form method="post" action="."> <form method="post" action="">
<table> <table>
<tr><td><label for="id_username">Username:</label></td><td>{{ form.username }}</td></tr> <tr><td><label for="id_username">Username:</label></td><td>{{ form.username }}</td></tr>
<tr><td><label for="id_password">Password:</label></td><td>{{ form.password }}</td></tr> <tr><td><label for="id_password">Password:</label></td><td>{{ form.password }}</td></tr>