search

maccesch / cmsplugin-contact

Extendable contact plugin for django-cms with spam protection and i18n
BSD 2-Clause "Simplified" License
71 stars 62 forks source link

Add a way to disable csrf token for contact form #73

Closed Lothiraldan closed 9 years ago

Lothiraldan commented 9 years ago

Hello,

we get a 403 csrf token validation failed during some tests with cmsplugin-contact and we are looking for a way to disable csrf token for our contact form. Our site is a public site, without authentification and we don't want to add some frictions for our clients to contact us.

But we DO use online edition and we don't want to turn off CSRF for the whole site.

I've some django experience but no django-cms experience and didn't see where I could add a conditional @csrf_exempt.

maccesch commented 9 years ago

Do you use our provided template or do you use your own? What where the circumstances exactly when you got that 403?

Lothiraldan commented 9 years ago

We use custom templates and by writing this line, maybe me do not include the hidden field.

I thought that maybe the csrf token have a limited validity in time but does the csrf token expires in Django?

maccesch commented 9 years ago

Not as far as I know. I have never encountered it. Please make sure that you have the CSRF Token included in your template.

Lothiraldan commented 9 years ago

Thanks, I will double-check that, sorry for the inconvenience.