The supposed way of doing that is setting the `DEFAULT_CHARSET` in
settings.py.
However, this setting isn't used when the `content_type` is specified when
calling `HttpResponse`.
It seems to me that this is a bug. Why accept `charset` as an option when
it only does something
when `content_type` is set.
`django.views.i18n.JavascriptCatalog` sets this `text/javascript` as the
content_type.
Whereas it should be: `text/javascript; charset=utf-8`.
--
Ticket URL: <https://code.djangoproject.com/ticket/29511>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
* component: Generic views => Internationalization
Comment:
Are you experiencing a problem due to the lack of `charset=utf-8.`?
--
Ticket URL: <https://code.djangoproject.com/ticket/29511#comment:1>
Comment (by Roland van Laar):
I am not experiencing problems directly. However it was 'strongly advised'
after a security audit of our application.
I was expecting it to be configurable, or to be able to inject. The way
the `HttpResponse` works is by not setting the charset when content_type
is specified.
That seems like a bug as well.
--
Ticket URL: <https://code.djangoproject.com/ticket/29511#comment:2>
Comment (by Claude Paroz):
I think adding the charset for `JavaScriptCatalog` makes sense.
`HttpResponse` consider that if the content_type is already set, it's the
responsability of the setter to set the charset if needed. I wouldn't
change that.
--
Ticket URL: <https://code.djangoproject.com/ticket/29511#comment:3>
* has_patch: 0 => 1
Comment:
[https://github.com/django/django/pull/10075 PR]
--
Ticket URL: <https://code.djangoproject.com/ticket/29511#comment:4>
* stage: Unreviewed => Accepted
--
Ticket URL: <https://code.djangoproject.com/ticket/29511#comment:5>
Comment (by Roland van Laar):
Thank you Tim, for picking this up so quickly.
--
Ticket URL: <https://code.djangoproject.com/ticket/29511#comment:6>
* stage: Accepted => Ready for checkin
--
Ticket URL: <https://code.djangoproject.com/ticket/29511#comment:7>
* status: new => closed
* resolution: => fixed
Comment:
In [changeset:"7cdeb23ae7ef2d125276840ff298dbb9683959f2" 7cdeb23]:
{{{
#!CommitTicketReference repository=""
revision="7cdeb23ae7ef2d125276840ff298dbb9683959f2"
Fixed #29511 -- Added charset to JavaScriptCatalog's Content-Type header.
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/29511#comment:8>
Comment (by Carlton Gibson <carlton.gibson@…>):
In [changeset:"714612a638ff02f02406553a583b2f8a1a424885" 714612a6]:
{{{
#!CommitTicketReference repository=""
revision="714612a638ff02f02406553a583b2f8a1a424885"
[2.1.x] Fixed #29511 -- Added charset to JavaScriptCatalog's Content-Type
header.
Backport of 7cdeb23ae7ef2d125276840ff298dbb9683959f2 from master
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/29511#comment:9>
Comment (by Carlton Gibson <carlton.gibson@…>):
In [changeset:"8e082a6e0b63a1cfdb0bc7b2835c6447123aa239" 8e082a6]:
{{{
#!CommitTicketReference repository=""
revision="8e082a6e0b63a1cfdb0bc7b2835c6447123aa239"
[2.0.x] Fixed #29511 -- Added charset to JavaScriptCatalog's Content-Type
header.
Backport of 7cdeb23ae7ef2d125276840ff298dbb9683959f2 from master
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/29511#comment:10>
Comment (by Tim Graham):
How doe the fix qualify for a backport? If it does, it should have a 2.0.x
release note.
--
Ticket URL: <https://code.djangoproject.com/ticket/29511#comment:11>
Comment (by Tim Graham <timograham@…>):
In [changeset:"4b3b9fab080f517b7dc41fb933f6eae3e24081ce" 4b3b9fab]:
{{{
#!CommitTicketReference repository=""
revision="4b3b9fab080f517b7dc41fb933f6eae3e24081ce"
[2.0.x] Reverted "Fixed #29511 -- Added charset to JavaScriptCatalog's
Content-Type header."
This reverts commit 8e082a6e0b63a1cfdb0bc7b2835c6447123aa239 as it
doesn't qualify for a backport.
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/29511#comment:12>