rduplain/flask-wtf — Issue #7: CSRF fails if there are only FileFields in the form
Author: rduplain
Created: 2012-02-29 16:44:52+00:00
State: open
Labels: bug, import

In <>, a change was introduced to make CSRF validation only happen if there was formdata. However, for a form with only a FileField, this change seems to cause CSRF validation to fail. Maybe it would make sense for validation to be skipped when there is no formdata -- //maybe// -- but it shouldn't fail.

An example form:

#!python
class UploadForm(wtf.Form):
sheet = wtf.FileField('Character Sheet')
submit = wtf.SubmitField("Upload")

Perhaps there should be a configurable setting for whether or not forms without formdata should be CSRF validated?

---------------------------------------
- Bitbucket: https://bitbucket.org/danjac/flask-wtf/issue/7
- Originally Reported By: [David Baumgold](http://bitbucket.org/singingwolfboy)
- Originally Created At: 2010-11-16 02:31:22