search

diefenbach / django-lfs

An online-shop based on Django
http://www.getlfs.com
BSD 3-Clause "New" or "Revised" License
622 stars 222 forks source link

CSRF problem #35

Closed naro closed 11 years ago

naro commented 12 years ago

Sometimes customers get CSRF error when adding a product to the cart or switching ordering on categories listing page.

The problem is caused by cached version of product_inline and other templates. product_inline caches generated HTML including csrf_token and if the token is changed on server for any reason, the cached HTML is not updated.

Related code: https://github.com/diefenbach/django-lfs/blob/master/lfs/catalog/views.py#L486 or https://github.com/diefenbach/django-lfs/blob/master/lfs/catalog/views.py#L365

The problem can appear everywhere full HTML including csrf_token is cached.

pigletto commented 11 years ago

fixed with commit https://github.com/diefenbach/lfs-theme/commit/c8ed9e88c5995df7a622912090ed2559e7c16e19