我们从Python开源项目中，提取了以下50个代码示例，用于说明如何使用django.views.decorators.csrf.csrf_protect()。
def androidFriendly(view_func): @csrf_exempt def new_view_func(request): print('Cookies: ',request.COOKIES,'\n\n\n',request.META) if request.method == 'POST': if request.META.get('HTTP_MOBILE',False): print('\n\nData: ',request.body,'\n\n') #temp = str(request.body)[2:-1].split('&') #try: request.POST = json.loads(request.body.decode('utf-8'))#.replace('\0', '')) #except: # request.POST = { i.split('=')[0] : convert(i.split('=')[1]) for i in temp } print("%s is about to be called"%view_func.__name__) ret = csrf_protect(view_func)(request) print("%s was called"%view_func.__name__) return ret return new_view_func
def password_reset_done(request, template_name='registration/password_reset_done.html', extra_context=None): warnings.warn("The password_reset_done() view is superseded by the " "class-based PasswordResetDoneView().", RemovedInDjango21Warning, stacklevel=2) context = { 'title': _('Password reset sent'), } if extra_context is not None: context.update(extra_context) return TemplateResponse(request, template_name, context) # Doesn't need csrf_protect since no-one can guess the URL
def password_reset_done(request, template_name='registration/password_reset_done.html', current_app=None, extra_context=None): context = { 'title': _('Password reset sent'), } if extra_context is not None: context.update(extra_context) if current_app is not None: request.current_app = current_app return TemplateResponse(request, template_name, context) # Doesn't need csrf_protect since no-one can guess the URL
def csrf(func): """ Ensures csrf token cookie or checkes it based on request method type. """ @wraps(func) def wrapper(req, *args, **kwargs): if req.method in ('GET', 'HEAD', 'OPTIONS', 'TRACE'): return (ensure_csrf_cookie(func))(req, *args, **kwargs) # Default cookie by CSRF_COOKIE_NAME in settings is 'csrftoken' # submit back in either req.form['csrfmiddlewaretoken'] or req['X-CSRFToken'] # the latter often used by Ajax and can be configured by CSRF_HEADER_NAME in settings else: func.csrf_exempt = False # reset csrf_exempt set by @csrf_exempt during @service return (csrf_protect(func))(req, *args, **kwargs) # Note that we don't use requires_csrf_token() here since it was for making the 'csrf_token' tag work in django templates. return wrapper
def admin_view(self, view, cacheable=False): """ Decorator to create an admin view attached to this ``AdminSite``. This wraps the view and provides permission checking by calling ``self.has_permission``. You'll want to use this from within ``AdminSite.get_urls()``: class MyAdminSite(AdminSite): def get_urls(self): from django.conf.urls import patterns, url urls = super(MyAdminSite, self).get_urls() urls += patterns('', url(r'^my_view/$', self.admin_view(some_view)) ) return urls By default, admin_views are marked non-cacheable using the ``never_cache`` decorator. If the view can be safely cached, set cacheable=True. """ def inner(request, *args, **kwargs): if LOGIN_FORM_KEY in request.POST and request.user.is_authenticated(): auth_logout(request) if not self.has_permission(request): if request.path == reverse('admin:logout', current_app=self.name): index_path = reverse('admin:index', current_app=self.name) return HttpResponseRedirect(index_path) return self.login(request) return view(request, *args, **kwargs) if not cacheable: inner = never_cache(inner) # We add csrf_protect here so this function can be used as a utility # function for any view, without having to repeat 'csrf_protect'. if not getattr(view, 'csrf_exempt', False): inner = csrf_protect(inner) return update_wrapper(inner, view)
def create_admin(request): """ ????????????????????? :param request: :return: """ if SiteUser.has_admin(): return error_404(request) else: request.page_title = '?????' return render_to_response('accounts/create_admin.html', {'request': request}) # ?? context_instance=RequestContext(request) ????? # Model class django.contrib.auth.models. Permission doesn't declare an explicit app_label and either # isn't in an application in INSTALLED_APPS or else was imported before its application was loaded. # return render_to_response('accounts/create_admin.html', {'request': request}, # context_instance=RequestContext(request)) # ??csrf_protect????????????csrf_token # ??context_instance=RequestContext(request)
def password_reset_done(request, template_name='registration/password_reset_done.html', extra_context=None): context = { 'title': _('Password reset sent'), } if extra_context is not None: context.update(extra_context) return TemplateResponse(request, template_name, context) # Doesn't need csrf_protect since no-one can guess the URL
def admin_view(self, view, cacheable=False): def inner(request, *args, **kwargs): request.user = DummyUser() if not self.has_permission(request): return HttpResponseForbidden() return view(request, *args, **kwargs) if not getattr(view, 'csrf_exempt', False): inner = csrf_protect(inner) return update_wrapper(inner, view)
def password_reset_done(request, template_name='registration/password_reset_done.html', current_app=None, extra_context=None): context = {} if extra_context is not None: context.update(extra_context) return TemplateResponse(request, template_name, context, current_app=current_app) # Doesn't need csrf_protect since no-one can guess the URL
def admin_view(self, view, cacheable=False): """ Decorator to create an admin view attached to this ``AdminSite``. This wraps the view and provides permission checking by calling ``self.has_permission``. You'll want to use this from within ``AdminSite.get_urls()``: class MyAdminSite(AdminSite): def get_urls(self): from django.conf.urls import url urls = super(MyAdminSite, self).get_urls() urls += [ url(r'^my_view/$', self.admin_view(some_view)) ] return urls By default, admin_views are marked non-cacheable using the ``never_cache`` decorator. If the view can be safely cached, set cacheable=True. """ def inner(request, *args, **kwargs): if not self.has_permission(request): if request.path == reverse('admin:logout', current_app=self.name): index_path = reverse('admin:index', current_app=self.name) return HttpResponseRedirect(index_path) # Inner import to prevent django.contrib.admin (app) from # importing django.contrib.auth.models.User (unrelated model). from django.contrib.auth.views import redirect_to_login return redirect_to_login( request.get_full_path(), reverse('admin:login', current_app=self.name) ) return view(request, *args, **kwargs) if not cacheable: inner = never_cache(inner) # We add csrf_protect here so this function can be used as a utility # function for any view, without having to repeat 'csrf_protect'. if not getattr(view, 'csrf_exempt', False): inner = csrf_protect(inner) return update_wrapper(inner, view)
def admin_view(self, view, cacheable=False): """ Decorator to create an admin view attached to this ``AdminSite``. This wraps the view and provides permission checking by calling ``self.has_permission``. You'll want to use this from within ``AdminSite.get_urls()``: class MyAdminSite(AdminSite): def get_urls(self): from django.conf.urls import url urls = super(MyAdminSite, self).get_urls() urls += [ url(r'^my_view/$', self.admin_view(some_view)) ] return urls By default, admin_views are marked non-cacheable using the ``never_cache`` decorator. If the view can be safely cached, set cacheable=True. """ def inner(request, *args, **kwargs): if not self.has_permission(request): if request.path == reverse('admin:logout', current_app=self.name): index_path = reverse('admin:index', current_app=self.name) return HttpResponseRedirect(URL_PREFIX_RESOURCE + index_path) # Inner import to prevent django.contrib.admin (app) from # importing django.contrib.auth.models.User (unrelated model). from django.contrib.auth.views import redirect_to_login return redirect_to_login( request.get_full_path(), reverse('admin:login', current_app=self.name) ) return view(request, *args, **kwargs) if not cacheable: inner = never_cache(inner) # We add csrf_protect here so this function can be used as a utility # function for any view, without having to repeat 'csrf_protect'. if not getattr(view, 'csrf_exempt', False): inner = csrf_protect(inner) return update_wrapper(inner, view)
