Ticket #6925: csrf_html_fix.diff

django/conf/global_settings.py

@@ -275 +275 @@
     'django.middleware.doc.XViewMiddleware',
 )
 
+# Set CSRF middleware output (HTML or XHTML)
+CSRF_MIDDLEWARE_OUTPUT_HTML = False
+
 ############
 # SESSIONS #
 ############

django/contrib/csrf/middleware.py

@@ -83 +83 @@
                                             itertools.repeat(''))
             def add_csrf_field(match):
                 """Returns the matched <form> tag plus the added <input> element"""
-                return mark_safe(match.group() + "<div style='display:none;'>" + \
-                "<input type='hidden' " + idattributes.next() + \
-                " name='csrfmiddlewaretoken' value='" + csrf_token + \
-                "' /></div>")
+                csrf_field = "<div style='display:none;'>" + \
+                    "<input type='hidden' " + idattributes.next() + \
+                    " name='csrfmiddlewaretoken' value='" + csrf_token
 
+                if settings.CSRF_MIDDLEWARE_OUTPUT_HTML:
+                    csrf_field = csrf_field + "'></div>"
+                else:
+                    csrf_field = csrf_field + "' /></div>"
+                return mark_safe(match.group() + csrf_field)
+
             # Modify any POST forms
             response.content = _POST_FORM_RE.sub(add_csrf_field, response.content)
         return response

docs/csrf.txt

@@ -54 +54 @@
 pages that are served as 'text/html' or 'application/xml+xhtml'
 are modified.
 
+The default output for the 'csrfmiddlewaretoken' field is XHTML. For HTML set 
+''CSRF_MIDDLEWARE_OUTPUT_HTML'' to ''True''.
+
 .. _9.1.1 Safe Methods, HTTP 1.1, RFC 2616: http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html
 
 Limitations
@@ -68 +71 @@
 you might bypass the filter that adds the hidden field to the form,
 in which case form submission will always fail.  It may still be possible
 to use the middleware, provided you can find some way to get the
-CSRF token and ensure that is included when your form is submitted.
- No newline at end of file
+CSRF token and ensure that is included when your form is submitted.