Add test for ensure_csrf_cookie

src/pretix/helpers/monkeypatching.py

@@ -27,6 +27,7 @@ from http import cookies
 
 from django.conf import settings
 from django.core.exceptions import SuspiciousFileOperation
+from django.middleware.csrf import CsrfViewMiddleware as BaseCsrfMiddleware
 from PIL import Image
 from requests.adapters import HTTPAdapter
 from urllib3.connection import HTTPConnection, HTTPSConnection
@@ -42,6 +43,7 @@ from urllib3.util.timeout import _DEFAULT_TIMEOUT
 
 from pretix.helpers.reportlab import ThumbnailingImageReader
 from pretix.helpers.ssrf import should_block_access
+from pretix.multidomain.middlewares import CsrfViewMiddleware
 
 
 def monkeypatch_vobject_performance():
@@ -242,6 +244,13 @@ def monkeypatch_reportlab_imagereader():
     utils.ImageReader.__init__ = new_init
 
 
+def monkeypatch_csrf_middleware():
+    # Some views from django or plugins use the middleware or the derived decorators directly,
+    # so we have to also patch the stock middleware
+    BaseCsrfMiddleware._get_secret = CsrfViewMiddleware._get_secret
+    BaseCsrfMiddleware._set_csrf_cookie = CsrfViewMiddleware._set_csrf_cookie
+
+
 def monkeypatch_all_at_ready():
     monkeypatch_vobject_performance()
     monkeypatch_pillow_safer()
@@ -249,3 +258,4 @@ def monkeypatch_all_at_ready():
     monkeypatch_urllib3_ssrf_protection()
     monkeypatch_cookie_morsel()
     monkeypatch_reportlab_imagereader()
+    monkeypatch_csrf_middleware()

src/pretix/multidomain/middlewares.py

@@ -302,19 +302,6 @@ class CsrfViewMiddleware(BaseCsrfMiddleware):
             # Content varies with the CSRF cookie, so set the Vary header.
             patch_vary_headers(response, ('Cookie',))
 
-    def process_response(self, request, response):
-        if (
-            not settings.CSRF_USE_SESSIONS
-            and request.is_secure()
-            and settings.CSRF_COOKIE_NAME in response.cookies
-            and response.cookies[settings.CSRF_COOKIE_NAME].value
-        ):
-            logger.warning("Usage of djangos CsrfViewMiddleware detected (legacy cookie found in response). "
-                           "This may be caused by using csrf_project or requires_csrf_token from django.views.decorators.csrf. "
-                           "Use the pretix.multidomain.middlewares equivalent instead.")
-
-        return super().process_response(request, response)
-
 
 def handle_duplicated_csrftoken(request, response):
     # Due to a Safari bug, in some browser, two csrftoken cookies can exist:

src/tests/multidomain/test_middlewares.py

@@ -242,6 +242,24 @@ def test_cookie_domain_on_main_domain(env, client):
     assert r.client.cookies['pretix_session']['domain'] == ''
 
 
+@pytest.fixture
+def csrf_client():
+    from django.test import Client
+    return Client(enforce_csrf_checks=True)
+
+
+@pytest.mark.django_db
+@pytest.mark.parametrize("url", [
+    '/mrmcd/2015/',
+    '/ensure_csrf_cookie/',
+])
+def test_csrf_secure(env, url, csrf_client):
+    r = csrf_client.get(url, secure=True, HTTP_HOST='example.com')
+    assert 'pretix_csrftoken' not in r.client.cookies
+    assert '__Host-pretix_csrftoken' in r.client.cookies
+    assert r.client.cookies['__Host-pretix_csrftoken']['secure']
+
+
 @pytest.mark.django_db
 @override_settings(USE_X_FORWARDED_HOST=True)
 def test_with_forwarded_host(env, client):

src/tests/testdummy/urls.py

@@ -21,6 +21,7 @@
 #
 from django.http import HttpResponse
 from django.urls import path
+from django.views.decorators.csrf import ensure_csrf_cookie
 
 
 def view(request):
@@ -33,6 +34,7 @@ urlpatterns = [
         view,
         name="view",
     ),
+    path('ensure_csrf_cookie/', ensure_csrf_cookie(view)),
 ]
 
 organizer_patterns = [