Ticket #21322: csrf-cookie.diff

django/views/csrf.py

@@ -42 +42 @@
    re-enable them, at least for this site, or for HTTPS connections, or for
    'same-origin' requests.</p>
 {% endif %}
+{% if no_cookie %}
+  <p>You are seeing this message because this site requires a CSRF
+   cookie when submitting forms. This cookie is required for security
+   reasons, to ensure that your browser is not being hijacked by third
+   parties.</p>
+
+  <p>If you have configured your browser to disable cookies, please
+   re-enable them, at least for this site, or for 'same-origin' requests.</p>
+{% endif %}
 </div>
 {% if DEBUG %}
 <div id="info">
@@ -95 +104 @@
     """
     Default view used when request fails CSRF protection
     """
-    from django.middleware.csrf import REASON_NO_REFERER
+    from django.middleware.csrf import REASON_NO_REFERER, REASON_NO_CSRF_COOKIE
     t = Template(CSRF_FAILURE_TEMPLATE)
     c = Context({'DEBUG': settings.DEBUG,
                  'reason': reason,
-                 'no_referer': reason == REASON_NO_REFERER
+                 'no_referer': reason == REASON_NO_REFERER,
+                 'no_cookie': reason == REASON_NO_CSRF_COOKIE
                  })
     return HttpResponseForbidden(t.render(c), content_type='text/html')