Django

Code

Show
Ignore:
Timestamp:
08/05/08 12:15:33 (5 months ago)
Author:
jbronn
Message:

gis: Merged revisions 7981-8001,8003-8011,8013-8033,8035-8036,8038-8039,8041-8063,8065-8076,8078-8139,8141-8154,8156-8214 via svnmerge from trunk.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • django/branches/gis

    • Property svnmerge-integrated changed from /django/trunk:1-7978 to /django/trunk:1-8214

  • django/branches/gis/docs/csrf.txt

    r7354 r8215  
    55The CsrfMiddleware class provides easy-to-use protection against 
    66`Cross Site Request Forgeries`_.  This type of attack occurs when a malicious 
    7 web site creates a link or form button that is intended to perform some action 
    8 on your web site, using the credentials of a logged-in user who is tricked 
     7Web site creates a link or form button that is intended to perform some action 
     8on your Web site, using the credentials of a logged-in user who is tricked 
    99into clicking on the link in their browser. 
    1010 
    …… 
    3939   isn't, the user will get a 403 error. 
    4040 
    41 This ensures that only forms that have originated from your web site 
     41This ensures that only forms that have originated from your Web site 
    4242can be used to POST data back. 
    4343 
    …… 
    4848 
    4949POST requests that are not accompanied by a session cookie are not protected, 
    50 but they do not need to be protected, since the 'attacking' web site 
     50but they do not need to be protected, since the 'attacking' Web site 
    5151could make these kind of requests anyway. 
    5252 
    …… 
    6565 
    6666If your app creates HTML pages and forms in some unusual way, (e.g. 
    67 it sends fragments of HTML in javascript document.write statements) 
     67it sends fragments of HTML in JavaScript document.write statements) 
    6868you might bypass the filter that adds the hidden field to the form, 
    6969in which case form submission will always fail.  It may still be possible