From fcdb444f267d9490b38c68e9b0d40be4c1d52976 Mon Sep 17 00:00:00 2001 From: Kara Engelhardt Date: Mon, 20 Jul 2026 16:47:05 +0200 Subject: [PATCH] Monkeypatch stock csrfmiddleware --- src/pretix/helpers/monkeypatching.py | 10 ++++++++++ src/pretix/multidomain/middlewares.py | 13 ------------- 2 files changed, 10 insertions(+), 13 deletions(-) diff --git a/src/pretix/helpers/monkeypatching.py b/src/pretix/helpers/monkeypatching.py index a92b3785b0..83a231e554 100644 --- a/src/pretix/helpers/monkeypatching.py +++ b/src/pretix/helpers/monkeypatching.py @@ -27,6 +27,7 @@ from http import cookies from django.conf import settings from django.core.exceptions import SuspiciousFileOperation +from django.middleware.csrf import CsrfViewMiddleware as BaseCsrfMiddleware from PIL import Image from requests.adapters import HTTPAdapter from urllib3.connection import HTTPConnection, HTTPSConnection @@ -42,6 +43,7 @@ from urllib3.util.timeout import _DEFAULT_TIMEOUT from pretix.helpers.reportlab import ThumbnailingImageReader from pretix.helpers.ssrf import should_block_access +from pretix.multidomain.middlewares import CsrfViewMiddleware def monkeypatch_vobject_performance(): @@ -242,6 +244,13 @@ def monkeypatch_reportlab_imagereader(): utils.ImageReader.__init__ = new_init +def monkeypatch_csrf_middleware(): + # Some views from django or plugins use the middleware or the derived decorators directly, + # so we have to also patch the stock middleware + BaseCsrfMiddleware._get_secret = CsrfViewMiddleware._get_secret + BaseCsrfMiddleware._set_csrf_cookie = CsrfViewMiddleware._set_csrf_cookie + + def monkeypatch_all_at_ready(): monkeypatch_vobject_performance() monkeypatch_pillow_safer() @@ -249,3 +258,4 @@ def monkeypatch_all_at_ready(): monkeypatch_urllib3_ssrf_protection() monkeypatch_cookie_morsel() monkeypatch_reportlab_imagereader() + monkeypatch_csrf_middleware() diff --git a/src/pretix/multidomain/middlewares.py b/src/pretix/multidomain/middlewares.py index 44bab7d718..2fd23fec06 100644 --- a/src/pretix/multidomain/middlewares.py +++ b/src/pretix/multidomain/middlewares.py @@ -302,19 +302,6 @@ class CsrfViewMiddleware(BaseCsrfMiddleware): # Content varies with the CSRF cookie, so set the Vary header. patch_vary_headers(response, ('Cookie',)) - def process_response(self, request, response): - if ( - not settings.CSRF_USE_SESSIONS - and request.is_secure() - and settings.CSRF_COOKIE_NAME in response.cookies - and response.cookies[settings.CSRF_COOKIE_NAME].value - ): - logger.warning("Usage of djangos CsrfViewMiddleware detected (legacy cookie found in response). " - "This may be caused by using csrf_project or requires_csrf_token from django.views.decorators.csrf. " - "Use the pretix.multidomain.middlewares equivalent instead.") - - return super().process_response(request, response) - def handle_duplicated_csrftoken(request, response): # Due to a Safari bug, in some browser, two csrftoken cookies can exist: