py_tasks_melange: app/django/contrib/csrf/middleware.py@8203c805edc7 (annotated)

54 03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	1	"""
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	2	Cross Site Request Forgery Middleware.
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	3
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	4	This module provides a middleware that implements protection
323 ff1a9aa48cfd Load ../vendor/django into trunk/app/django. Pawel Solyga <Pawel.Solyga@gmail.com> parents: 54 diff changeset	5	against request forgeries from other sites.
ff1a9aa48cfd Load ../vendor/django into trunk/app/django. Pawel Solyga <Pawel.Solyga@gmail.com> parents: 54 diff changeset	6	"""
54 03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	7
323 ff1a9aa48cfd Load ../vendor/django into trunk/app/django. Pawel Solyga <Pawel.Solyga@gmail.com> parents: 54 diff changeset	8	import re
ff1a9aa48cfd Load ../vendor/django into trunk/app/django. Pawel Solyga <Pawel.Solyga@gmail.com> parents: 54 diff changeset	9	import itertools
ff1a9aa48cfd Load ../vendor/django into trunk/app/django. Pawel Solyga <Pawel.Solyga@gmail.com> parents: 54 diff changeset	10
54 03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	11	from django.conf import settings
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	12	from django.http import HttpResponseForbidden
323 ff1a9aa48cfd Load ../vendor/django into trunk/app/django. Pawel Solyga <Pawel.Solyga@gmail.com> parents: 54 diff changeset	13	from django.utils.hashcompat import md5_constructor
54 03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	14	from django.utils.safestring import mark_safe
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	15
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	16	_ERROR_MSG = mark_safe('<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><body><h1>403 Forbidden</h1><p>Cross Site Request Forgery detected. Request aborted.</p></body></html>')
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	17
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	18	_POST_FORM_RE = \
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	19	re.compile(r'(<form\W[^>]\bmethod=(\'\|"\|)POST(\'\|"\|)\b[^>]>)', re.IGNORECASE)
323 ff1a9aa48cfd Load ../vendor/django into trunk/app/django. Pawel Solyga <Pawel.Solyga@gmail.com> parents: 54 diff changeset	20
ff1a9aa48cfd Load ../vendor/django into trunk/app/django. Pawel Solyga <Pawel.Solyga@gmail.com> parents: 54 diff changeset	21	_HTML_TYPES = ('text/html', 'application/xhtml+xml')
54 03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	22
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	23	def _make_token(session_id):
323 ff1a9aa48cfd Load ../vendor/django into trunk/app/django. Pawel Solyga <Pawel.Solyga@gmail.com> parents: 54 diff changeset	24	return md5_constructor(settings.SECRET_KEY + session_id).hexdigest()
54 03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	25
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	26	class CsrfMiddleware(object):
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	27	"""Django middleware that adds protection against Cross Site
323 ff1a9aa48cfd Load ../vendor/django into trunk/app/django. Pawel Solyga <Pawel.Solyga@gmail.com> parents: 54 diff changeset	28	Request Forgeries by adding hidden form fields to POST forms and
ff1a9aa48cfd Load ../vendor/django into trunk/app/django. Pawel Solyga <Pawel.Solyga@gmail.com> parents: 54 diff changeset	29	checking requests for the correct value.
ff1a9aa48cfd Load ../vendor/django into trunk/app/django. Pawel Solyga <Pawel.Solyga@gmail.com> parents: 54 diff changeset	30
ff1a9aa48cfd Load ../vendor/django into trunk/app/django. Pawel Solyga <Pawel.Solyga@gmail.com> parents: 54 diff changeset	31	In the list of middlewares, SessionMiddleware is required, and must come
ff1a9aa48cfd Load ../vendor/django into trunk/app/django. Pawel Solyga <Pawel.Solyga@gmail.com> parents: 54 diff changeset	32	after this middleware. CsrfMiddleWare must come after compression
54 03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	33	middleware.
323 ff1a9aa48cfd Load ../vendor/django into trunk/app/django. Pawel Solyga <Pawel.Solyga@gmail.com> parents: 54 diff changeset	34
ff1a9aa48cfd Load ../vendor/django into trunk/app/django. Pawel Solyga <Pawel.Solyga@gmail.com> parents: 54 diff changeset	35	If a session ID cookie is present, it is hashed with the SECRET_KEY
ff1a9aa48cfd Load ../vendor/django into trunk/app/django. Pawel Solyga <Pawel.Solyga@gmail.com> parents: 54 diff changeset	36	setting to create an authentication token. This token is added to all
ff1a9aa48cfd Load ../vendor/django into trunk/app/django. Pawel Solyga <Pawel.Solyga@gmail.com> parents: 54 diff changeset	37	outgoing POST forms and is expected on all incoming POST requests that
54 03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	38	have a session ID cookie.
323 ff1a9aa48cfd Load ../vendor/django into trunk/app/django. Pawel Solyga <Pawel.Solyga@gmail.com> parents: 54 diff changeset	39
ff1a9aa48cfd Load ../vendor/django into trunk/app/django. Pawel Solyga <Pawel.Solyga@gmail.com> parents: 54 diff changeset	40	If you are setting cookies directly, instead of using Django's session
54 03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	41	framework, this middleware will not work.
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	42	"""
323 ff1a9aa48cfd Load ../vendor/django into trunk/app/django. Pawel Solyga <Pawel.Solyga@gmail.com> parents: 54 diff changeset	43
54 03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	44	def process_request(self, request):
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	45	if request.method == 'POST':
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	46	try:
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	47	session_id = request.COOKIES[settings.SESSION_COOKIE_NAME]
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	48	except KeyError:
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	49	# No session, no check required
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	50	return None
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	51
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	52	csrf_token = _make_token(session_id)
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	53	# check incoming token
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	54	try:
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	55	request_csrf_token = request.POST['csrfmiddlewaretoken']
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	56	except KeyError:
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	57	return HttpResponseForbidden(_ERROR_MSG)
323 ff1a9aa48cfd Load ../vendor/django into trunk/app/django. Pawel Solyga <Pawel.Solyga@gmail.com> parents: 54 diff changeset	58
54 03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	59	if request_csrf_token != csrf_token:
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	60	return HttpResponseForbidden(_ERROR_MSG)
323 ff1a9aa48cfd Load ../vendor/django into trunk/app/django. Pawel Solyga <Pawel.Solyga@gmail.com> parents: 54 diff changeset	61
54 03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	62	return None
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	63
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	64	def process_response(self, request, response):
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	65	csrf_token = None
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	66	try:
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	67	cookie = response.cookies[settings.SESSION_COOKIE_NAME]
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	68	csrf_token = _make_token(cookie.value)
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	69	except KeyError:
323 ff1a9aa48cfd Load ../vendor/django into trunk/app/django. Pawel Solyga <Pawel.Solyga@gmail.com> parents: 54 diff changeset	70	# No outgoing cookie to set session, but
54 03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	71	# a session might already exist.
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	72	try:
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	73	session_id = request.COOKIES[settings.SESSION_COOKIE_NAME]
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	74	csrf_token = _make_token(session_id)
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	75	except KeyError:
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	76	# no incoming or outgoing cookie
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	77	pass
323 ff1a9aa48cfd Load ../vendor/django into trunk/app/django. Pawel Solyga <Pawel.Solyga@gmail.com> parents: 54 diff changeset	78
54 03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	79	if csrf_token is not None and \
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	80	response['Content-Type'].split(';')[0] in _HTML_TYPES:
323 ff1a9aa48cfd Load ../vendor/django into trunk/app/django. Pawel Solyga <Pawel.Solyga@gmail.com> parents: 54 diff changeset	81
54 03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	82	# ensure we don't add the 'id' attribute twice (HTML validity)
323 ff1a9aa48cfd Load ../vendor/django into trunk/app/django. Pawel Solyga <Pawel.Solyga@gmail.com> parents: 54 diff changeset	83	idattributes = itertools.chain(("id='csrfmiddlewaretoken'",),
54 03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	84	itertools.repeat(''))
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	85	def add_csrf_field(match):
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	86	"""Returns the matched <form> tag plus the added <input> element"""
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	87	return mark_safe(match.group() + "<div style='display:none;'>" + \
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	88	"<input type='hidden' " + idattributes.next() + \
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	89	" name='csrfmiddlewaretoken' value='" + csrf_token + \
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	90	"' /></div>")
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	91
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	92	# Modify any POST forms
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	93	response.content = _POST_FORM_RE.sub(add_csrf_field, response.content)
03e267d67478 Major reorganization of the soc svn repo, to merge into a single App Engine Todd Larsen <tlarsen@google.com> parents: diff changeset	94	return response

author	Lennard de Rijk <ljvderijk@gmail.com>
	Fri, 06 Mar 2009 15:52:12 +0000
changeset 1687	8203c805edc7
parent 323	ff1a9aa48cfd
permissions	-rw-r--r--