Ticket #15198: 15198-3.diff

django/contrib/admin/forms.py

@@ -29 +29 @@
                 raise forms.ValidationError(message)
             elif not self.user_cache.is_active or not self.user_cache.is_staff:
                 raise forms.ValidationError(message)
-        self.check_for_test_cookie()
         return self.cleaned_data

django/contrib/auth/forms.py

@@ -150 +150 @@
     error_messages = {
         'invalid_login': _("Please enter a correct username and password. "
                            "Note that both fields are case-sensitive."),
-        'no_cookies': _("Your Web browser doesn't appear to have cookies "
-                        "enabled. Cookies are required for logging in."),
         'inactive': _("This account is inactive."),
     }
 
     def __init__(self, request=None, *args, **kwargs):
         """
-        If request is passed in, the form will validate that cookies are
-        enabled. Note that the request (a HttpRequest object) must have set a
-        cookie with the key TEST_COOKIE_NAME and value TEST_COOKIE_VALUE before
-        running this validation.
+        The 'request' parameter was historically set to test for cookie
+        support (now obsoleted by csrf checks). It has been kept for potential
+        subclasses usage.
         """
         self.request = request
         self.user_cache = None
@@ -183 +180 @@
                     self.error_messages['invalid_login'])
             elif not self.user_cache.is_active:
                 raise forms.ValidationError(self.error_messages['inactive'])
-        self.check_for_test_cookie()
         return self.cleaned_data
 
     def check_for_test_cookie(self):
-        if self.request and not self.request.session.test_cookie_worked():
-            raise forms.ValidationError(self.error_messages['no_cookies'])
+        warnings.warn("check_for_test_cookie is deprecated; but don't forget to "
+            "CRSF-protect your login view.", PendingDeprecationWarning)
 
     def get_user_id(self):
         if self.user_cache:

django/contrib/auth/views.py

@@ -35 +35 @@
     redirect_to = request.REQUEST.get(redirect_field_name, '')
 
     if request.method == "POST":
-        form = authentication_form(data=request.POST)
+        form = authentication_form(request, data=request.POST)
         if form.is_valid():
             # Use default setting if redirect_to is empty
             if not redirect_to:
@@ -58 +58 @@
     else:
         form = authentication_form(request)
 
-    request.session.set_test_cookie()
-
     current_site = get_current_site(request)
 
     context = {