[Django] #33409: Django logs out after a redirect with a long Cyrillic message

8 views

Skip to first unread message

Django

unread,

Jan 4, 2022, 11:49:03 AM1/4/22

to django-...@googlegroups.com

#33409: Django logs out after a redirect with a long Cyrillic message
-------------------------------------+-------------------------------------
Reporter: Dterb | Owner: nobody
Type: Bug | Status: new
Component: | Version: 3.0
contrib.messages | Keywords: messages, logout,
Severity: Normal | redirect
Triage Stage: | Has patch: 0
Unreviewed |
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-------------------------------------+-------------------------------------
I am using a redirect from the payment system's website back on my site
when the user decides to cancel the checkout:

{{{
@csrf_exempt
def payment_done(request):
if request.method == 'POST':
result = get_result(request)
if result == 'success':
return redirect(reverse('payment_successful'))
return redirect(reverse('subscribe'),
messages=payment_unsuccessful_message(request))
raise Http404
}}}

The code for getting the message added to the redirect is the following:

{{{
def payment_unsuccessful_message(request):
with translation.override(translation.get_language()):
return messages.error(
request,
render_to_string('billing/payment_unsuccessful_message.html'),
extra_tags='safe, custom',
)
}}}

Now, the problem is that the user is getting logged out when redirected
this way, but **only in the Ukrainian** (Cyrillic) interface. In all the
other (non-Cyrillic) languages, no redirect occurs and the user stays
logged in.

I thought that the problem was with incorrect encoding, render_to_string,
then with extra_tags, and so on. After several hours, I realised that the
issue is with the length of the Cyrillic characters.

So, if you try this piece of code for the message added to the redirect
(replaced the ''render_to_string'' with ''gettext'' for demonstration
purposes), everything works fine and the user is not logged out forcedly:

{{{
def payment_unsuccessful_message(request):
with translation.override(translation.get_language()):
return messages.error(
request,
_(
'<strong>Аааааа аа ааааааааа</strong>. Аааааа аа ааааааааа
аааааа '
'ааааааааа, аааааааа ааааааа ааа ааа аааа аааааааааа
ааааааа аааааааа аааааааа: '
'<em>ааааааааа аааааа ааааааааааа ааааааа аааааааааааа
аааааааа аааааааааа '
'ааааааааааа аааааа ааааааа а аааааааааа</em> аааа
ааааааааааааааа ааааааааа '
'аа ааааааа. ааааааа ааааааа ааааааааа аа'
),
extra_tags='safe, custom',
)
}}}

But add **one more Cyrillic character** in the end of the message, and the
user will be logged out (although the message will be displayed
correctly).

I believe that the reason is in the length of encoded characters but have
not found any similar issue on the web, so I am reporting it as a bug.

--
Ticket URL: <https://code.djangoproject.com/ticket/33409>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

Django

unread,

Jan 5, 2022, 12:55:16 AM1/5/22

to django-...@googlegroups.com

#33409: Django logs out after a redirect with a long Cyrillic message
-------------------------------------+-------------------------------------
Reporter: Dterb | Owner: nobody

Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------

Changes (by Mariusz Felisiak):

* cc: Florian Apolloner (added)
* status: new => closed
* resolution: => needsinfo

Comment:

Thanks for this report. Messages format was changed to the RFC-6265
compliant format in Django 3.2 (see
2d6179c819010f6a9d00835d5893c4593c0b85a0). Can you reproduce this issue in
Django 3.2+?