encode/django-rest-framework
1
1
Fork 0
mirror of https://github.com/encode/django-rest-framework.git synced 2025-01-24 16:24:18 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fix UserLoggedInAuthentication for POST requests.

Browse Source 
Fixes #78.
This commit is contained in:
Tom Christie 2012-01-24 19:26:37 +00:00
parent 863bbe7684
commit 1d9f24f60d
1 changed files with 2 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
djangorestframework/authentication.py
View File

@ -87,25 +87,12 @@ class UserLoggedInAuthentication(BaseAuthentication):
Returns a :obj:`User` if the request session currently has a logged in user. Returns a :obj:`User` if the request session currently has a logged in user.
Otherwise returns :const:`None`. Otherwise returns :const:`None`.
""" """
# TODO: Might be cleaner to switch this back to using request.POST, self.view.DATA # Make sure our generic parsing runs first
# and let FormParser/MultiPartParser deal with the consequences.
if getattr(request, 'user', None) and request.user.is_active: if getattr(request, 'user', None) and request.user.is_active:
# Enforce CSRF validation for session based authentication. # Enforce CSRF validation for session based authentication.
# Temporarily replace request.POST with .DATA, to use our generic parsing.
# If DATA is not dict-like, use an empty dict.
if request.method.upper() == 'POST':
if hasattr(self.view.DATA, 'get'):
request._post = self.view.DATA
else:
request._post = {}
resp = CsrfViewMiddleware().process_view(request, None, (), {}) resp = CsrfViewMiddleware().process_view(request, None, (), {})
# Replace request.POST
if request.method.upper() == 'POST':
del(request._post)
if resp is None: # csrf passed if resp is None: # csrf passed
return request.user return request.user
return None return None