CGM_Public/pretix_original
2
0
Fork 1
mirror of https://github.com/pretix/pretix.git synced 2026-05-07 15:34:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

Set cookies with SameSite=None if possible (#1509)

Browse Source
This commit is contained in:
Raphael Michel
2019-12-03 14:50:18 +01:00
committed by GitHub
parent 098b7363e6
commit d46278f04f
5 changed files with 184 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
src/pretix/presale/views/__init__.py
View File

@@ -16,6 +16,7 @@ from pretix.base.models import (
CartPosition, InvoiceAddress, OrderPosition, QuestionAnswer,
)
from pretix.base.services.cart import get_fees
from pretix.helpers.cookies import set_cookie_without_samesite
from pretix.multidomain.urlreverse import eventreverse
from pretix.presale.signals import question_form_fields
@@ -305,9 +306,15 @@ def iframe_entry_view_wrapper(view_func):
with language(locale):
resp = view_func(request, *args, **kwargs)
max_age = 10 * 365 * 24 * 60 * 60
resp.set_cookie(settings.LANGUAGE_COOKIE_NAME, locale, max_age=max_age,
expires=(datetime.utcnow() + timedelta(seconds=max_age)).strftime('%a, %d-%b-%Y %H:%M:%S GMT'),
domain=settings.SESSION_COOKIE_DOMAIN)
set_cookie_without_samesite(
request,
resp,
settings.LANGUAGE_COOKIE_NAME,
locale,
max_age=max_age,
expires=(datetime.utcnow() + timedelta(seconds=max_age)).strftime('%a, %d-%b-%Y %H:%M:%S GMT'),
domain=settings.SESSION_COOKIE_DOMAIN
)
return resp
resp = view_func(request, *args, **kwargs)

15
src/pretix/presale/views/locale.py
View File

@@ -5,6 +5,8 @@ from django.http import HttpResponseRedirect
from django.utils.http import is_safe_url
from django.views.generic import View
from pretix.helpers.cookies import set_cookie_without_samesite
from .robots import NoSearchIndexViewMixin
@@ -19,9 +21,14 @@ class LocaleSet(NoSearchIndexViewMixin, View):
if locale in [lc for lc, ll in settings.LANGUAGES]:
max_age = 10 * 365 * 24 * 60 * 60
resp.set_cookie(settings.LANGUAGE_COOKIE_NAME, locale, max_age=max_age,
expires=(datetime.utcnow() + timedelta(seconds=max_age)).strftime(
'%a, %d-%b-%Y %H:%M:%S GMT'),
domain=settings.SESSION_COOKIE_DOMAIN)
set_cookie_without_samesite(
request, resp,
settings.LANGUAGE_COOKIE_NAME,
locale,
max_age=max_age,
expires=(datetime.utcnow() + timedelta(seconds=max_age)).strftime(
'%a, %d-%b-%Y %H:%M:%S GMT'),
domain=settings.SESSION_COOKIE_DOMAIN
)
return resp