6 Commits

Author	SHA1	Message	Date
Shai Berger	5112e65ef2	Fixed #20869 -- made CSRF tokens change every request by salt-encrypting them ... Note that the cookie is not changed every request, just the token retrieved by the `get_token()` method (used also by the `{% csrf_token %}` tag). While at it, made token validation strict: Where, before, any length was accepted and non-ASCII chars were ignored, we now treat anything other than `[A-Za-z0-9]{64}` as invalid (except for 32-char tokens, which, for backwards-compatibility, are accepted and replaced by 64-char ones). Thanks Trac user patrys for reporting, github user adambrenecki for initial patch, Tim Graham for help, and Curtis Maloney, Collin Anderson, Florian Apolloner, Markus Holtermann & Jon Dufresne for reviews.	2016-05-19 05:02:19 +03:00
Simon Charette	ead36e8a47	Refs #24652 -- Made sure template backend tests call their super setUpClass.	2015-05-20 12:50:40 -04:00
Preston Timmons	adff499e47	Fixed #24119, #24120 -- Formalized debug integration for template backends.	2015-05-06 17:33:47 -05:00
Moritz Sichert	6bff343989	Refs #24469 -- Fixed escaping of forms, fields, and media in non-Django templates.	2015-03-18 09:11:01 -04:00
Aymeric Augustin	71b7668b75	Rewrapped TemplateSyntaxError in Jinja2 backend. ... Changed import style to avoid confusion between Django's and Jinja2's APIs.	2015-01-12 21:01:34 +01:00
Aymeric Augustin	332154e726	Added basic tests for template backends.	2014-12-28 16:23:00 +01:00