miki725/Django-jQuery-File-Uploader-Integration-demo — Issue #1: AJAX's empty POST dictionary conflicts with csrf middleware
Author: seddonym
Created: 2011-10-19 16:11:45+00:00
State: open

I'm unable to get the delete buttons working with csrf middleware turned on.

Here's my analysis of the situation, I can't work out whether the bug might be seen to lie with Jquery fileupload, Django, or your implementation:

jquery.fileupload-ui.js uses the following code to post the data (l.88). The data variable passed $.ajax() does not contain any POST data but just does it with a query string at the end of the URL. (http://api.jquery.com/jQuery.ajax/ - see the 'data' argument.)

~~~
// Callback for file deletion:
destroy: function (e, data) {
var that = $(this).data('fileupload');
if (data.url) {
$.ajax(data)
.success(function () {
that._adjustMaxNumberOfFiles(1);
$(this).fadeOut(function () {
$(this).remove();
});
});
} else {
data.context.fadeOut(function () {
$(this).remove();
});
}
}
~~~

This would work fine but for Django's csrf middleware here (django.middleware.csrf, l. 199):

~~~
# check incoming token
request_csrf_token = request.POST.get('csrfmiddlewaretoken', '')
if request_csrf_token == "":
# Fall back to X-CSRFToken, to make things easier for AJAX
request_csrf_token = request.META.get('HTTP_X_CSRFTOKEN', '')
~~~

That looks like it's going to work, but request.POST.get() chokes with the following exception, because the POST data couldn't be parsed. (On django/http/__init__.py in _load_post_and_files line 269).

~~~
'NoneType' object has no attribute 'startswith'
~~~

Hope that makes sense.