diff --git a/src/pretix/helpers/monkeypatching.py b/src/pretix/helpers/monkeypatching.py index 39150e3341..0e3814fea0 100644 --- a/src/pretix/helpers/monkeypatching.py +++ b/src/pretix/helpers/monkeypatching.py @@ -42,6 +42,8 @@ from urllib3.util.connection import ( from urllib3.util.timeout import _DEFAULT_TIMEOUT from pretix.helpers.reportlab import ThumbnailingImageReader +from pretix.multidomain.middlewares import CsrfViewMiddleware +from django.middleware.csrf import CsrfViewMiddleware as BaseCsrfMiddleware _cgnat_net = ipaddress.ip_network('100.64.0.0/10') @@ -251,6 +253,13 @@ def monkeypatch_reportlab_imagereader(): utils.ImageReader.__init__ = new_init +def monkeypatch_csrf_middleware(): + # Some views from django or plugins use the middleware or the derived decorators directly, + # so we have to also patch the stock middleware + BaseCsrfMiddleware._get_secret = CsrfViewMiddleware._get_secret + BaseCsrfMiddleware._set_csrf_cookie = CsrfViewMiddleware._set_csrf_cookie + + def monkeypatch_all_at_ready(): monkeypatch_vobject_performance() monkeypatch_pillow_safer() @@ -258,3 +267,4 @@ def monkeypatch_all_at_ready(): monkeypatch_urllib3_ssrf_protection() monkeypatch_cookie_morsel() monkeypatch_reportlab_imagereader() + monkeypatch_csrf_middleware() diff --git a/src/pretix/multidomain/middlewares.py b/src/pretix/multidomain/middlewares.py index 44bab7d718..2fd23fec06 100644 --- a/src/pretix/multidomain/middlewares.py +++ b/src/pretix/multidomain/middlewares.py @@ -302,19 +302,6 @@ class CsrfViewMiddleware(BaseCsrfMiddleware): # Content varies with the CSRF cookie, so set the Vary header. patch_vary_headers(response, ('Cookie',)) - def process_response(self, request, response): - if ( - not settings.CSRF_USE_SESSIONS - and request.is_secure() - and settings.CSRF_COOKIE_NAME in response.cookies - and response.cookies[settings.CSRF_COOKIE_NAME].value - ): - logger.warning("Usage of djangos CsrfViewMiddleware detected (legacy cookie found in response). " - "This may be caused by using csrf_project or requires_csrf_token from django.views.decorators.csrf. " - "Use the pretix.multidomain.middlewares equivalent instead.") - - return super().process_response(request, response) - def handle_duplicated_csrftoken(request, response): # Due to a Safari bug, in some browser, two csrftoken cookies can exist: