Made templates compatible with session-based CSRF. (#6207)

seawolf42 · carltongibson · commit eb3180173ed1 · 2019-02-19T12:15:03.000+01:00
diff --git a/rest_framework/static/rest_framework/js/csrf.js b/rest_framework/static/rest_framework/js/csrf.js
@@ -38,7 +38,7 @@ function sameOrigin(url) {
     !(/^(\/\/|http:|https:).*/.test(url));
 }
 
-var csrftoken = getCookie(window.drf.csrfCookieName);
+var csrftoken = window.drf.csrfToken;
 
 $.ajaxSetup({
   beforeSend: function(xhr, settings) {
diff --git a/rest_framework/templates/rest_framework/admin.html b/rest_framework/templates/rest_framework/admin.html
@@ -247,7 +247,7 @@ <h4 class="modal-title" id="myModalLabel">{{ error_title }}</h4>
         <script>
           window.drf = {
             csrfHeaderName: "{{ csrf_header_name|default:'X-CSRFToken' }}",
-            csrfCookieName: "{{ csrf_cookie_name|default:'csrftoken' }}"
+            csrfToken: "{{ csrf_token }}"
           };
         </script>
         <script src="{% static "rest_framework/js/jquery-3.3.1.min.js" %}"></script>
diff --git a/rest_framework/templates/rest_framework/base.html b/rest_framework/templates/rest_framework/base.html
@@ -290,7 +290,7 @@ <h1>{{ name }}</h1>
       <script>
         window.drf = {
           csrfHeaderName: "{{ csrf_header_name|default:'X-CSRFToken' }}",
-          csrfCookieName: "{{ csrf_cookie_name|default:'csrftoken' }}"
+          csrfToken: "{% if request %}{{ csrf_token }}{% endif %}"
         };
       </script>
       <script src="{% static "rest_framework/js/jquery-3.3.1.min.js" %}"></script>
diff --git a/tests/test_templates.py b/tests/test_templates.py
@@ -1,7 +1,17 @@
+import re
+
 from django.shortcuts import render
 
 
+def test_base_template_with_context():
+    context = {'request': True, 'csrf_token': 'TOKEN'}
+    result = render({}, 'rest_framework/base.html', context=context)
+    assert re.search(r'\bcsrfToken: "TOKEN"', result.content.decode('utf-8'))
+
+
 def test_base_template_with_no_context():
     # base.html should be renderable with no context,
     # so it can be easily extended.
-    render({}, 'rest_framework/base.html')
+    result = render({}, 'rest_framework/base.html')
+    # note that this response will not include a valid CSRF token
+    assert re.search(r'\bcsrfToken: ""', result.content.decode('utf-8'))

Original file line number	Diff line number	Diff line change
`@@ -38,7 +38,7 @@ function sameOrigin(url) {`
`38`	`38`	`!(/^(\/\/\|http:\|https:).*/.test(url));`
`39`	`39`	`}`
`40`	`40`
`41`		`-var csrftoken = getCookie(window.drf.csrfCookieName);`
	`41`	`+var csrftoken = window.drf.csrfToken;`
`42`	`42`
`43`	`43`	`$.ajaxSetup({`
`44`	`44`	`beforeSend: function(xhr, settings) {`