Add specific view for handling CSRF failures

This generates the error in a bit nicer way inside our framework,
instead of throwing the default django error.

diff --git a/pgweb/core/views.py b/pgweb/core/views.py
index e78ffeb9d6e4e944a9a7ab6ec13102488bf96664..3118e7f8e05498f4197577003684dff516e473b8 100644 (file)
--- a/pgweb/core/views.py
+++ b/pgweb/core/views.py
@@ -12,7 +12,7 @@ from os import uname
 import re
 import urllib
 
-from pgweb.util.decorators import ssl_required, cache
+from pgweb.util.decorators import ssl_required, cache, nocache
 from pgweb.util.contexts import NavContext
 from pgweb.util.helpers import simple_form, PgXmlHelper, HttpServerError
 from pgweb.util.moderation import get_all_pending_moderations
@@ -149,6 +149,12 @@ def sitemap(request):
        x.endDocument()
        return resp
 
+@nocache
+def csrf_failure(request, reason=''):
+       return render_to_response('errors/csrf_failure.html', {
+                       'reason': reason,
+                       })
+
 # Basic information about the connection
 @cache(seconds=30)
 def system_information(request):

diff --git a/pgweb/settings.py b/pgweb/settings.py
index 0742d08626c44fa17485375c6c40489a96539abf..1596d6bdd07ea76a101fbb2fa06cbf9b3c7ea508 100644 (file)
--- a/pgweb/settings.py
+++ b/pgweb/settings.py
@@ -65,6 +65,8 @@ MIDDLEWARE_CLASSES = [
     'util.middleware.PgMiddleware',
 ]
 
+CSRF_FAILURE_VIEW='pgweb.core.views.csrf_failure'
+
 ROOT_URLCONF = 'pgweb.urls'
 
 TEMPLATE_DIRS = (

diff --git a/templates/errors/csrf_failure.html b/templates/errors/csrf_failure.html
new file mode 100644 (file)
index 0000000..3bca6aa
--- /dev/null
+++ b/templates/errors/csrf_failure.html
@@ -0,0 +1,19 @@
+{%extends "base/page.html"%}
+{%block title%}Cross Site Request Detected{%endblock%}
+{%block contents%}
+<h1>Cross Site Request Detected</h1>
+<p>
+Your request to access this resource failed because the system detected
+a Cross Site Request. This is either caused by a legitimiate attempt to
+inject data, or by your system not being configured to allow validation
+of the request.
+</p>
+<p>
+The most common reason for tihs error is that your browser
+<b>does not allow cookies</b> on this request. Cookies are required for the
+cross site protection to work.
+</p>
+<p>
+The internal reason given was: <i>{{reason}}</i>
+</p>
+{%endblock%}