Support CSRF_COOKIE_NAME
Added support for custom CSRF_COOKIE_NAME by refactoring the jquery.django-csrf.js file into a separate .html file that can be used as an include, passing in the CSRF_COOKIE_NAME from settings.
This commit is contained in:
@@ -8,7 +8,7 @@
|
||||
|
||||
{% if has_sortable_tabular_inlines or has_sortable_stacked_inlines %}
|
||||
<script type="text/javascript" src="{% static 'adminsortable/js/jquery-ui-django-admin.min.js' %}"></script>
|
||||
<script type="text/javascript" src="{% static 'adminsortable/js/jquery.django-csrf.js' %}"></script>
|
||||
{% include 'adminsortable/csrf/jquery.django-csrf.html' with csrf_cookie_name=csrf_cookie_name %}
|
||||
{% endif %}
|
||||
|
||||
{% if has_sortable_tabular_inlines %}
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
<script src="{% static jquery_lib_path %}"></script>
|
||||
<script src="{% static 'admin/js/jquery.init.js' %}"></script>
|
||||
<script src="{% static 'adminsortable/js/jquery-ui-django-admin.min.js' %}"></script>
|
||||
<script src="{% static 'adminsortable/js/jquery.django-csrf.js' %}"></script>
|
||||
{% include 'adminsortable/csrf/jquery.django-csrf.html' with csrf_cookie_name=csrf_cookie_name %}
|
||||
<script src="{% static 'adminsortable/js/admin.sortable.js' %}"></script>
|
||||
{% endblock %}
|
||||
|
||||
|
||||
@@ -0,0 +1,34 @@
|
||||
<script>
|
||||
// using jQuery
|
||||
function getCookie(name) {
|
||||
var cookieValue = null;
|
||||
if (document.cookie && document.cookie !== '') {
|
||||
var cookies = document.cookie.split(';');
|
||||
for (var i = 0; i < cookies.length; i++) {
|
||||
var cookie = django.jQuery.trim(cookies[i]);
|
||||
// Does this cookie string begin with the name we want?
|
||||
if (cookie.substring(0, name.length + 1) === (name + '=')) {
|
||||
cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
return cookieValue;
|
||||
}
|
||||
|
||||
var csrftoken = getCookie('{{ csrf_cookie_name }}');
|
||||
|
||||
function csrfSafeMethod(method) {
|
||||
// these HTTP methods do not require CSRF protection
|
||||
return (/^(GET|HEAD|OPTIONS|TRACE)$/.test(method));
|
||||
}
|
||||
|
||||
django.jQuery.ajaxSetup({
|
||||
crossDomain: false, // obviates need for sameOrigin test
|
||||
beforeSend: function(xhr, settings) {
|
||||
if (!csrfSafeMethod(settings.type)) {
|
||||
xhr.setRequestHeader("X-CSRFToken", csrftoken);
|
||||
}
|
||||
}
|
||||
});
|
||||
</script>
|
||||
Reference in New Issue
Block a user