[Django] #29785: Using {{ csrf_token }} throws exception (AttributeError: 'dict' object has no attribute 'META') if no render context

[Django]

#29785: Using {{ csrf_token }} throws exception (AttributeError: 'dict' object has
no attribute 'META') if no render context
---------------------------------------------+------------------------
Reporter: jeffrey k eliasen | Owner: nobody
Type: Bug | Status: new
Component: CSRF | Version: master
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 1
UI/UX: 0 |
---------------------------------------------+------------------------
Using calling `render()` with no context on a template that uses {{
csrf_token }} results in an exception being thrown.

I believe the appropriate fix is to change:

if "CSRF_COOKIE" not in request.META:

to:

if not request or not request.META or "CSRF_COOKIE" not in
request.META:

I am happy to create a PR for this issue once I know it is a desired fix.

--
Ticket URL: <https://code.djangoproject.com/ticket/29785>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

[Django]

#29785: Using {{ csrf_token }} throws exception (AttributeError: 'dict' object has
no attribute 'META') if no render context

-----------------------------------+--------------------------------------

Reporter: jeffrey k eliasen | Owner: nobody
Type: Bug | Status: new
Component: CSRF | Version: master

Severity: Normal | Resolution:

Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 1 | UI/UX: 0

-----------------------------------+--------------------------------------
Description changed by jeffrey k eliasen:

Old description:

> Using calling `render()` with no context on a template that uses {{
> csrf_token }} results in an exception being thrown.
>
> I believe the appropriate fix is to change:
>
> if "CSRF_COOKIE" not in request.META:
>
> to:
>
> if not request or not request.META or "CSRF_COOKIE" not in
> request.META:
>
> I am happy to create a PR for this issue once I know it is a desired fix.

New description:

Using calling `render()` with no context on a template that uses `{{
csrf_token }}` results in an exception being thrown.

I believe the appropriate fix is to change:

`if "CSRF_COOKIE" not in request.META:`

to:

`if not request or not request.META or "CSRF_COOKIE" not in request.META:`

I am happy to create a PR for this issue once I know it is a desired fix.

--

--
Ticket URL: <https://code.djangoproject.com/ticket/29785#comment:1>

[Django]

#29785: Using {{ csrf_token }} throws exception (AttributeError: 'dict' object has
no attribute 'META') if no render context

-----------------------------------+--------------------------------------

Reporter: jeffrey k eliasen | Owner: nobody
Type: Bug | Status: new
Component: CSRF | Version: master

Severity: Normal | Resolution:

Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 1 | UI/UX: 0

-----------------------------------+--------------------------------------
Description changed by jeffrey k eliasen:

Old description:

> Using calling `render()` with no context on a template that uses `{{

> csrf_token }}` results in an exception being thrown.
>
> I believe the appropriate fix is to change:
>
> `if "CSRF_COOKIE" not in request.META:`
>
> to:
>
> `if not request or not request.META or "CSRF_COOKIE" not in
> request.META:`
>
> I am happy to create a PR for this issue once I know it is a desired fix.

New description:

Calling `render()` with no context on a template that uses `{{ csrf_token

}}` results in an exception being thrown.

I believe the appropriate fix is to change:

`if "CSRF_COOKIE" not in request.META:`

to:

`if not request or not request.META or "CSRF_COOKIE" not in request.META:`

I am happy to create a PR for this issue once I know it is a desired fix.

--

--
Ticket URL: <https://code.djangoproject.com/ticket/29785#comment:2>

[Django]

#29785: Using {{ csrf_token }} throws exception (AttributeError: 'dict' object has
no attribute 'META') if no render context

-----------------------------------+--------------------------------------

Reporter: jeffrey k eliasen | Owner: nobody

Type: Bug | Status: closed
Component: CSRF | Version: master
Severity: Normal | Resolution: invalid

Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 1 | UI/UX: 0

-----------------------------------+--------------------------------------
Changes (by Carlton Gibson):

* status: new => closed
* resolution: => invalid

Comment:

From the [https://docs.djangoproject.com/en/2.1/ref/csrf/#how-to-use-it
CSRF docs]:

> In the corresponding view functions, ensure that RequestContext is used
to render the response so that {% csrf_token %} will work properly.

The `request` is required in the context.

(If you're looking to render your template in a true non-request context,
you can use `RequestFactory` to generate a placeholder and add `
'csrf_token': 'NOTPROVIDED'` to the context in order to short circuit the
CSRF input rendering.)

--
Ticket URL: <https://code.djangoproject.com/ticket/29785#comment:3>