#NEWLINE# def process_view( self , request , callback , callback_args , callback_kwargs ) : #NEWLINE# #INDENT# if getattr ( request , 'csrf_processing_done' , False ) : #NEWLINE# #INDENT# return None #NEWLINE# #UNINDENT# try : #NEWLINE# #INDENT# csrf_token = _sanitize_token ( request . COOKIES [ settings . CSRF_COOKIE_NAME ] ) #NEWLINE# request . META [ 'CSRF_COOKIE' ] = csrf_token #NEWLINE# #UNINDENT# except KeyError : #NEWLINE# #INDENT# csrf_token = None #NEWLINE# request . META [ 'CSRF_COOKIE' ] = _get_new_csrf_key ( ) #NEWLINE# #UNINDENT# if getattr ( callback , 'csrf_exempt' , False ) : #NEWLINE# #INDENT# return None #NEWLINE# #UNINDENT# if ( request . method not in ( 'GET' , 'HEAD' , 'OPTIONS' , 'TRACE' ) ) : #NEWLINE# #INDENT# if getattr ( request , '_dont_enforce_csrf_checks' , False ) : #NEWLINE# #INDENT# return self . _accept ( request ) #NEWLINE# #UNINDENT# if request . is_secure ( ) : #NEWLINE# #INDENT# referer = request . META . get ( 'HTTP_REFERER' ) #NEWLINE# if ( referer is None ) : #NEWLINE# #INDENT# logger . warning ( 'Forbidden (%s): %s' , REASON_NO_REFERER , request . path , extra = { #NEWLINE# #INDENT# 'status_code' : 403 , #NEWLINE# 'request' : request , #NEWLINE# #UNINDENT# } ) #NEWLINE# return self . _reject ( request , REASON_NO_REFERER ) #NEWLINE# #UNINDENT# good_referer = ( 'https://%s/' % request . get_host ( ) ) #NEWLINE# if ( not same_origin ( referer , good_referer ) ) : #NEWLINE# #INDENT# reason = ( REASON_BAD_REFERER % ( referer , good_referer ) ) #NEWLINE# logger . warning ( 'Forbidden (%s): %s' , reason , request . path , extra = { #NEWLINE# #INDENT# 'status_code' : 403 , #NEWLINE# 'request' : request , #NEWLINE# #UNINDENT# } ) #NEWLINE# return self . _reject ( request , reason ) #NEWLINE# #UNINDENT# #UNINDENT# if ( csrf_token is None ) : #NEWLINE# #INDENT# logger . warning ( 'Forbidden (%s): %s' , REASON_NO_CSRF_COOKIE , request . path , extra = { #NEWLINE# #INDENT# 'status_code' : 403 , #NEWLINE# 'request' : request , #NEWLINE# #UNINDENT# } ) #NEWLINE# return self . _reject ( request , REASON_NO_CSRF_COOKIE ) #NEWLINE# #UNINDENT# request_csrf_token = '' #NEWLINE# if ( request . method == 'POST' ) : #NEWLINE# #INDENT# request_csrf_token = request . POST . get ( 'csrfmiddlewaretoken' , '' ) #NEWLINE# #UNINDENT# if ( request_csrf_token == '' ) : #NEWLINE# #INDENT# request_csrf_token = request . META . get ( 'HTTP_X_CSRFTOKEN' , '' ) #NEWLINE# #UNINDENT# if ( not constant_time_compare ( request_csrf_token , csrf_token ) ) : #NEWLINE# #INDENT# logger . warning ( 'Forbidden (%s): %s' , REASON_BAD_TOKEN , request . path , extra = { #NEWLINE# #INDENT# 'status_code' : 403 , #NEWLINE# 'request' : request , #NEWLINE# #UNINDENT# } ) #NEWLINE# return self . _reject ( request , REASON_BAD_TOKEN ) #NEWLINE# #UNINDENT# #UNINDENT# return self . _accept ( request )