python - Django CSRF_TOKEN 问题仅与 Edge 相关

Question

我正在尝试我的 django通过不同的浏览器(Chrome、Firefox、IE11 和 Edge)运行应用程序，我遇到了 csrf_token 的问题。和Edge仅。

这个问题引用了我的django表单。

我的 View 文件:

class ManageDocView(AdminRequiredMixin, View):
    """ Render the Admin Manage documents to update year in the filename"""

    template_name = 'omcl/manage_doc_form.html'
    form_class = ManageDocForm
    success_url = 'omcl/manage_doc_form.html'

    @staticmethod
    def get_title():
        return 'Change Document Title'

    def get(self, request):
        form = self.form_class()
        context = {
            "form": form,
            "title": self.get_title()
        }
        return render(request, self.template_name, context)

    def post(self, request):
        form = self.form_class()
        query_document_updated = None
        query_omcl = None
        query_document = None

        if "submitButton" in request.POST:
            omcl_list = request.POST.get('omcl_list', False)
            query_omcl = Omcl.objects.get(id=omcl_list)
            query_document = Document.objects.filter(omcl=omcl_list)
            form.fields['omcl_list'].initial = query_omcl

        elif "UpdateDocument" in request.POST:
            checkbox_id = request.POST['DocumentChoice']
            checkbox_id_minus_1 = int(checkbox_id) - 1
            query_document_updated = Document.objects.get(id=checkbox_id)

            omclcode = query_document_updated.omcl.code
            src_filename = query_document_updated.src_filename
            filename, file_extension = os.path.splitext(src_filename)
            category = query_document_updated.category

            if category == "ANNUAL":
                category = "ANNUAL_REPORT"

            year = self.request.POST['pts_years']

            # Create the new document title updated by the new year
            new_document_title = f"{year}_{category}_{omclcode}_{checkbox_id_minus_1} - {src_filename}"

            # Create the new document file updated by the new year
            new_document_file = f"omcl_docs/{omclcode}/{year}_{category}_{omclcode}_{checkbox_id_minus_1}{file_extension}"

            # Get file.name in order to rename document file in /media/
            document_path = query_document_updated.file.name

            try:
                actual_document_path = os.path.join(settings.MEDIA_ROOT, document_path)
                new_document_path_temp = f"{settings.MEDIA_ROOT}/{new_document_file}"
                new_document_path = os.rename(actual_document_path, new_document_path_temp)
            except FileNotFoundError:
                messages.error(self.request, _(f"Document {src_filename} doesn't exist on the server"))
                return redirect('manage_doc')
            else:
                # Assign modifications to selected document and save it into the database
                query_document_updated.title = new_document_title
                query_document_updated.file = new_document_file
                query_document_updated.save()
                messages.success(self.request, _(f"The modification has been taken into account"))

        context = {
            'form': form,
            'query_omcl': query_omcl,
            'query_document': query_document,
            'query_document_updated': query_document_updated,
            'title': self.get_title(),
        }
        return render(request, self.template_name, context)

我的表单文件:

class ManageDocForm(forms.Form):

    def __init__(self, *args, **kwargs):
        super(ManageDocForm, self).__init__(*args, **kwargs)

    omcl_list = forms.ModelChoiceField(
        queryset=Omcl.objects.filter(is_obsolete=False),
        label=_('OMCL Choice'),
        widget=ModelSelect2Widget(
            model=Omcl,
            search_fields=['code__icontains', 'name__icontains'],
            attrs={'data-placeholder': "Please select an OMCL"}
        )
    )

    now = datetime.today().year
    year_choices = ((i, str(i)) for i in range(now, now - 30, -1))
    pts_years = forms.ChoiceField(
        label='PTS years',
        choices=year_choices,
        required=True,
        widget=Select2Widget(
            attrs={'data-placeholder': "Please select a new year"}),
    )

我的模板文件，其中包含一小部分 javascript :

{% block extra_script %}
  <!-- Submit OMCL list with change and not submit button + Previous/Next pagination button -->
  <script>
    $('#select-omcl-form').on('change', function () {
      $(this).submit();
    });
  </script>
{% endblock %}

{% block main %}

  <h2>{{ title }}</h2>

  <div class="row manage-doc">

    <div class="col-md-12">
      <form id="select-omcl-form" name="select-omcl-form" action="" method="POST">
        {% csrf_token %}
        <fieldset>
          <legend><span class="name">{% trans 'Select an OMCL' %}</span></legend>
          {{ form.omcl_list }}
          <input type="hidden" name="submitButton">
        </fieldset>
      </form>
    </div>
  </div>
  <br/>

  <div class="row manage-doc">
    <div class="col-md-12">
      <fieldset>
        <legend><span class="name">{% trans 'Select a document' %}</span></legend>
        <form action="" method="POST">
          {% csrf_token %}
          <div id="table-document">
            <table id="document-table" class="table table-bordered table-striped table-condensed table_model">
              <thead>
              <tr>
                <th id="radio-column"></th>
                <th id="document-title-column">{% trans 'Document title' %}</th>
              </tr>
              </thead>
              <tbody>
              {% for document in query_document|dictsortreversed:'title' %}
                <tr>
                  <td><input type="radio" class="radio-document" id="document-radiobox" name="DocumentChoice"
                             value="{{ document.id }}"></td>
                  <td>{{ document.title }}</td>
                </tr>
              {% endfor %}
              </tbody>
            </table>
          </div>
          <br><br>

          <legend><span class="name">{% trans 'Select a new year' %}</span></legend>

          {{ form.pts_years }}

          <button class="btn btn-default" id="document-button" type="submit"
                  name="UpdateDocument">{% trans "Change year" %}</button>
        </form>
      </fieldset>
      <br>
    </div>
  </div>

{% endblock main %}

gif 演示:

这是一个小 gif，根据 csrf_token 解释了过程和问题。仅适用于 Edge 浏览器:

Link to my gif

我尝试过的:

我尝试添加CSRF_COOKIE_DOMAIN在我的 settings.py 文件中，但它不起作用。

你有什么想法吗？这很奇怪，因为我对其他浏览器没有任何问题。 Ony 与 Microsoft Edge。我的浏览器允许使用 Cookie。

Answer 1

感谢我的同事，我发现了这个问题。我使用了redirect，但我必须使用render，因为如果我重定向，CSRF_TOKEN 不会实现，它会发送第二个POST 使用之前的 token 进行请求。

所以应该是:

except FileNotFoundError:
    messages.error(self.request, _(f"Document {src_filename} doesn't exist on the server"))
    context = {
          'form': form,
          'query_omcl': query_omcl,
          'query_document': query_document,
          'query_document_updated': query_document_updated,
          'title': self.get_title(),
          }
    return render(request, self.template_name, context)

而不是:

except FileNotFoundError:
    messages.error(self.request, _(f"Document {src_filename} doesn't exist on the server"))
    return redirect('manage_doc')