Forbidden (403)

[Nebros]

I know this is an old problem with many answers... but no one helps me. ^^

what i have:

 

Settings--------------------------------
MIDDLEWARE_CLASSES = (
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    # Uncomment the next line for simple clickjacking protection:
    # 'django.middleware.clickjacking.XFrameOptionsMiddleware',
    )

-------------------------------------------

 

urls--------------------------------------

from django.conf.urls import patterns
from klasse.views import portal, kundendaten

urlpatterns = patterns('',
    (r'^portal/$', portal),
    (r'^kundendaten/$', kundendaten),
)
-------------------------------------------

 

views-----------------------------------

from django.shortcuts import render_to_response
from django.core.context_processors import csrf

from django.views.decorators.csrf import csrf_protect

import datetime
import pyodbc

@csrf_protect
def portal(request):
    now = datetime.datetime.now()
    return render_to_response('portal.html', {'current_date': now})

--------------------------------------------

 

portal.html------------------------------

<form method="post" action="/kundendaten/">

    {% csrf_token %}

    <fieldset>
        <legend>Anfrage</legend>
        <p>Bitte Kundennamen eingeben</p>

        <label>
            <input type="text" name="kunde" size="30" required="required">
        </label>
        <br>
        <br>
        <input type="submit" name="senden" value="Senden" href="kundendaten">

    </fieldset>

</form>

--------------------------------------------

 

I tryed a lot of variants to fix my "post" problem, but without success. can anybody help me? ^^

thx

*pls ignore my englisch fails

[Vibhu Rishi]

When is it that you are getting the 403 ? 

--
You received this message because you are subscribed to the Google Groups "Django users" group.
To view this discussion on the web visit https://groups.google.com/d/msg/django-users/-/iMXtpFVaRp8J.
To post to this group, send email to django...@googlegroups.com.
To unsubscribe from this group, send email to django-users...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/django-users?hl=en.

--
Simplicity is the ultimate sophistication. - Leonardo da Vinci
Life is really simple, but we insist on making it complicated. - Confucius

[Nebros]

When i put in a variable in my type="text" and push type="submit" (by the step to next page)...

[Tom Christie]

Could you include your 'kundendaten' view too, please.

Any error text on the 403 page would also be useful.

[Nebros]

kundendaten-----------------------------

{% include "header.html" %}

<title>Kundendaten</title>

{% include "header2.html" %}
<h1>Portal</h1>

<h2>Ausgabe Kundendaten</h2>

{% include "sql.html" %}

<table border="1">
    <tr><th>Name</th><th>E-Mail</th></tr>

    <tr><td>'.$result['t_name'].'</td><td>'.$result['t_mail'].'</td></tr>

</table>

{% include "footer.html" %}

-----------------------------------------------

 

(header , header2 and footer are only for the html tags !doctype... blabla)

 

Forbidden (403)---------------------------------

CSRF verification failed. Request aborted.

Help

Reason given for failure:

    CSRF cookie not set.
    

In general, this can occur when there is a genuine Cross Site Request Forgery, or when Django's CSRF mechanism has not been used correctly. For POST forms, you need to ensure:

• Your browser is accepting cookies.
• The view function uses RequestContext for the template, instead of Context.
• In the template, there is a {% csrf_token %} template tag inside each POST form that targets an internal URL.
• If you are not using CsrfViewMiddleware, then you must use csrf_protect on any views that use the csrf_token template tag, as well as those that accept the POST data.

You're seeing the help section of this page because you have DEBUG = True in your Django settings file. Change that to False, and only the initial error message will be displayed.

You can customize this page using the CSRF_FAILURE_VIEW setting.

---------------------------------------------------------------------

[Jirka Vejrazka]

I may be wrong, but I don't see you using {% csrf_token %} anywhere. You're posting random snippets from your code that only loosely relate - I have trouble finding full code for the view and all components of HTML templates causing you trouble.

So I'll just post a few tips:

  - before submitting the form in your browser, show the rendered HTML for the page "right click, then View Source (or similar) - does it contain the csrf_token parameter? (Just search for "csrf_token").
  - you can easily verify that your CSRF token is posted with the form by putting "print request" on the first line of the view that receives the form submission - then you should see "csrf_token" among the posted paramaters.
  - better version is to install a module to the browser you use for debugging to view what's actually being sent. For Firefox, you could use the excellent Firebug.

--

You received this message because you are subscribed to the Google Groups "Django users" group.

To view this discussion on the web visit https://groups.google.com/d/msg/django-users/-/K1p4e5lY1B4J.

[Nebros]

thanks for your answer.

by point one, it doesnt contain the csrf_token parameter, but i dont know why. ^^

 

to see the html better, i give the full now:

portal------------------------------

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">
<html lang="en">
<head>
    <!--suppress HtmlUnknownTarget -->
    <link rel="stylesheet" href="P:Daten/Projects/Vorbild/templates/css/style.css" type="text/css">

<title>Kunde</title>

 

</head>
<body>
<img src="P:/Daten/Projects/Vorbild/templates/pics/logo.png" alt="Sefar logo" width=156 height=56/>

<h1>Kunde</h1>
{% block content %}<p>Zeit der Aktualisierung {{ current_date }}.</p>{% endblock %}

 

<div class="test">

<form method="post" action="/kundendaten/">

    {% csrf_token %}

    <fieldset>
        <legend>Anfrage</legend>
        <p>Bitte Kundennamen eingeben</p>

        <label>
            <input type="text" name="kunde" size="30" required="required">
        </label>
        <br>
        <br>
        <input type="submit" name="senden" value="Senden" href="kundendaten">

    </fieldset>

</form>
</div>
    <hr>
    <p>Danke fuer die Benutzung meiner Seite.</p>
</body>
</html>

----------------------------------------------------

 

source code by right clicking...------------------------

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">
<html lang="en">
<head>
    <!--suppress HtmlUnknownTarget -->
    <link rel="stylesheet" href="P:Daten/Projects/Vorbild/templates/css/style.css" type="text/css">

<title>Kunde</title>

</head>
<body>
<img src="P:/Daten/Projects/Vorbild/templates/pics/logo.png" alt="Sefar logo" width=156 height=56/>
<h1>Kunde</h1>

<p>Zeit der Aktualisierung Nov. 13, 2012, 11:49 a.m..</p>

<div class="test">

<form method="post" action="/kundendaten/">

    <fieldset>
        <legend>Anfrage</legend>
        <p>Bitte Kundennamen eingeben</p>

        <label>
            <input type="text" name="kunde" size="30" required="required">
        </label>
        <br>
        <br>
        <input type="submit" name="senden" value="Senden" href="kundendaten">

    </fieldset>

</form>
</div>

    <hr>
    <p>Danke fuer die Benutzung meiner Seite.</p>
</body>
</html>

----------------------------------------------------------------

[Daniel Roseman]

On Tuesday, 13 November 2012 08:05:28 UTC, Nebros wrote:

<snip>

Forbidden (403)---------------------------------

CSRF verification failed. Request aborted.

Help

Reason given for failure:

    CSRF cookie not set.
    

In general, this can occur when there is a genuine Cross Site Request Forgery, or when Django's CSRF mechanism has not been used correctly. For POST forms, you need to ensure:

• Your browser is accepting cookies.
• The view function uses RequestContext for the template, instead of Context.
• In the template, there is a {% csrf_token %} template tag inside each POST form that targets an internal URL.
• If you are not using CsrfViewMiddleware, then you must use csrf_protect on any views that use the csrf_token template tag, as well as those that accept the POST data.

You're seeing the help section of this page because you have DEBUG = True in your Django settings file. Change that to False, and only the initial error message will be displayed.

You can customize this page using the CSRF_FAILURE_VIEW setting.

I don't really know how this error message could be clearer. Point 2 clearly explains what is wrong in your case, complete with a link to the documentation explaining how to fix it. 

--

DR.

[Tom Evans]

There are three steps to enabling CSRF protection:

1) Add CsrfViewMiddleware
2) Add csrf_token to the form
3) Ensure that the csrf token is in the template context, by using a
RequestContext or calling the CSRF context processor directly.

As documented here:

https://docs.djangoproject.com/en/1.4/ref/contrib/csrf/

You've done 1 and 2. You haven't done 3.

Cheers

Tom

[Nebros]

ok, i have it done. but i have now the next problem... what i have chaged:
views------------------------------------

@csrf_protect
def portal(request):
    c = {}
    c.update (csrf(request))
    now = datetime.datetime.now()
    return render_to_response('portal.html', {'current_date': now}, context_instance=RequestContext(request))

--------------------------------------------

why i did it like this: by loading the page i became an error...

TypeError at /kundendaten/

pop expected at least 1 arguments, got 0

i tryed the post from this page:
http://stackoverflow.com/questions/7678231/problems-with-csrf-token

now i have the error, when i press my send button, why is that?
here the error...--------------------------

TypeError at /kundendaten/
pop expected at least 1 arguments, got 0
Request Method:
POST
Request URL:
http://127.0.0.1:8000/kundendaten/
Django Version:
1.4.1
Exception Type:
TypeError
Exception Value:
pop expected at least 1 arguments, got 0
Exception Location:
C:\Python27\lib\site-packages\django\template\loader.py in render_to_string, line 178
Python Executable:
C:\Python27\python.exe
Python Version:
2.7.3

-----------------------------------------------------------------------------

 

and thx for your answers...

[Nebros]

Edit: first error was TypeError at /portal/... i realyzed now, the error is for the next page...