143ff5fb53
SuspiciousOperations have been differentiated into subclasses, and are now logged to a 'django.security.*' logger. SuspiciousOperations that reach django.core.handlers.base.BaseHandler will now return a 400 instead of a 500. Thanks to tiwoc for the report, and Carl Meyer and Donald Stufft for review.
34 lines
1.0 KiB
Python
34 lines
1.0 KiB
Python
import json
|
|
|
|
from django.core.signing import BadSignature
|
|
|
|
from django.contrib.formtools.exceptions import WizardViewCookieModified
|
|
from django.contrib.formtools.wizard import storage
|
|
|
|
|
|
class CookieStorage(storage.BaseStorage):
|
|
encoder = json.JSONEncoder(separators=(',', ':'))
|
|
|
|
def __init__(self, *args, **kwargs):
|
|
super(CookieStorage, self).__init__(*args, **kwargs)
|
|
self.data = self.load_data()
|
|
if self.data is None:
|
|
self.init_data()
|
|
|
|
def load_data(self):
|
|
try:
|
|
data = self.request.get_signed_cookie(self.prefix)
|
|
except KeyError:
|
|
data = None
|
|
except BadSignature:
|
|
raise WizardViewCookieModified('WizardView cookie manipulated')
|
|
if data is None:
|
|
return None
|
|
return json.loads(data, cls=json.JSONDecoder)
|
|
|
|
def update_response(self, response):
|
|
if self.data:
|
|
response.set_signed_cookie(self.prefix, self.encoder.encode(self.data))
|
|
else:
|
|
response.delete_cookie(self.prefix)
|