Ticket #11362: csrf_double_quotes.diff

middleware.py

@@ -91 +91 @@
                 response['Content-Type'].split(';')[0] in _HTML_TYPES:
 
             # ensure we don't add the 'id' attribute twice (HTML validity)
-            idattributes = itertools.chain(("id='csrfmiddlewaretoken'",),
+            idattributes = itertools.chain(('id="csrfmiddlewaretoken"',),
                                             itertools.repeat(''))
             def add_csrf_field(match):
                 """Returns the matched <form> tag plus the added <input> element"""
-                return mark_safe(match.group() + "<div style='display:none;'>" + \
-                "<input type='hidden' " + idattributes.next() + \
-                " name='csrfmiddlewaretoken' value='" + csrf_token + \
-                "' /></div>")
+                return mark_safe(match.group() + '<div style="display:none;">' + \
+                '<input type="hidden" ' + idattributes.next() + \
+                ' name="csrfmiddlewaretoken" value="' + csrf_token + \
+                '" /></div>')
 
             # Modify any POST forms
             response.content = _POST_FORM_RE.sub(add_csrf_field, response.content)