Django

Code

Show
Ignore:
Timestamp:
08/02/08 00:56:57 (4 months ago)
Author:
gwilson
Message:

Fixed #7919 -- md5 and sha modules are deprecated since Python 2.5, use hashlib module when available. Patch from Karen Tracey.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • django/trunk/django/contrib/csrf/middleware.py

    r6671 r8193  
    33 
    44This module provides a middleware that implements protection 
    5 against request forgeries from other sites.  
     5against request forgeries from other sites. 
     6""" 
    67 
    7 """ 
     8import re 
     9import itertools 
     10 
    811from django.conf import settings 
    912from django.http import HttpResponseForbidden 
     13from django.utils.hashcompat import md5_constructor 
    1014from django.utils.safestring import mark_safe 
    11 import md5 
    12 import re 
    13 import itertools 
    1415 
    1516_ERROR_MSG = mark_safe('<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"><body><h1>403 Forbidden</h1><p>Cross Site Request Forgery detected. Request aborted.</p></body></html>') 
    …… 
    1718_POST_FORM_RE = \ 
    1819    re.compile(r'(<form\W[^>]*\bmethod=(\'|"|)POST(\'|"|)\b[^>]*>)', re.IGNORECASE) 
    19      
    20 _HTML_TYPES = ('text/html', 'application/xhtml+xml')     
     20 
     21_HTML_TYPES = ('text/html', 'application/xhtml+xml') 
    2122 
    2223def _make_token(session_id): 
    23     return md5.new(settings.SECRET_KEY + session_id).hexdigest() 
     24    return md5_constructor(settings.SECRET_KEY + session_id).hexdigest() 
    2425 
    2526class CsrfMiddleware(object): 
    2627    """Django middleware that adds protection against Cross Site 
    27     Request Forgeries by adding hidden form fields to POST forms and  
    28     checking requests for the correct value.   
    29      
    30     In the list of middlewares, SessionMiddleware is required, and must come  
    31     after this middleware.  CsrfMiddleWare must come after compression  
     28    Request Forgeries by adding hidden form fields to POST forms and 
     29    checking requests for the correct value. 
     30 
     31    In the list of middlewares, SessionMiddleware is required, and must come 
     32    after this middleware.  CsrfMiddleWare must come after compression 
    3233    middleware. 
    33     
    34     If a session ID cookie is present, it is hashed with the SECRET_KEY  
    35     setting to create an authentication token.  This token is added to all  
    36     outgoing POST forms and is expected on all incoming POST requests that  
     34 
     35    If a session ID cookie is present, it is hashed with the SECRET_KEY 
     36    setting to create an authentication token.  This token is added to all 
     37    outgoing POST forms and is expected on all incoming POST requests that 
    3738    have a session ID cookie. 
    38      
    39     If you are setting cookies directly, instead of using Django's session  
     39 
     40    If you are setting cookies directly, instead of using Django's session 
    4041    framework, this middleware will not work. 
    4142    """ 
    42      
     43 
    4344    def process_request(self, request): 
    4445        if request.method == 'POST': 
    …… 
    5556            except KeyError: 
    5657                return HttpResponseForbidden(_ERROR_MSG) 
    57              
     58 
    5859            if request_csrf_token != csrf_token: 
    5960                return HttpResponseForbidden(_ERROR_MSG) 
    60                  
     61 
    6162        return None 
    6263 
    …… 
    6768            csrf_token = _make_token(cookie.value) 
    6869        except KeyError: 
    69             # No outgoing cookie to set session, but  
     70            # No outgoing cookie to set session, but 
    7071            # a session might already exist. 
    7172            try: 
    …… 
    7576                # no incoming or outgoing cookie 
    7677                pass 
    77              
     78 
    7879        if csrf_token is not None and \ 
    7980                response['Content-Type'].split(';')[0] in _HTML_TYPES: 
    80              
     81 
    8182            # ensure we don't add the 'id' attribute twice (HTML validity) 
    82             idattributes = itertools.chain(("id='csrfmiddlewaretoken'",),  
     83            idattributes = itertools.chain(("id='csrfmiddlewaretoken'",), 
    8384                                            itertools.repeat('')) 
    8485            def add_csrf_field(match):