encode/django-rest-framework
1
1
Fork 0
mirror of https://github.com/encode/django-rest-framework.git synced 2025-03-28 05:44:28 +03:00
Code Issues Packages Projects Releases Wiki Activity

CSRF for non-dict like .DATA. Fixes #85

Browse Source
This commit is contained in:
Tom Christie 2011-12-14 20:19:17 +00:00
parent 67b13bd1bc
commit 8cabab2703
1 changed files with 18 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
djangorestframework/authentication.py
View File

@ -88,18 +88,27 @@ class UserLoggedInAuthentication(BaseAuthentication):
Returns a :obj:`User` if the request session currently has a logged in user.
Otherwise returns :const:`None`.
"""
# TODO: Switch this back to request.POST, and let FormParser/MultiPartParser deal with the consequences.
# TODO: Might be cleaner to switch this back to using request.POST,
# and let FormParser/MultiPartParser deal with the consequences.
if getattr(request, 'user', None) and request.user.is_active:
# If this is a POST request we enforce CSRF validation.
# Enforce CSRF validation for session based authentication.
# Temporarily replace request.POST with .DATA, to use our generic parsing.
# If DATA is not dict-like, use an empty dict.
if request.method.upper() == 'POST':
if hasattr(self.view.DATA, 'get'):
request._post = self.view.DATA
else:
request._post = {}
resp = CsrfViewMiddleware().process_view(request, None, (), {})
# Replace request.POST
if request.method.upper() == 'POST':
# Temporarily replace request.POST with .DATA,
# so that we use our more generic request parsing
request._post = self.view.DATA
resp = CsrfViewMiddleware().process_view(request, None, (), {})
del(request._post)
if resp is not None: # csrf failed
return None
return request.user
if resp is None: # csrf passed
return request.user
return None