diff options
| -rw-r--r-- | pyramid/session.py | 3 | ||||
| -rw-r--r-- | pyramid/testing.py | 3 | ||||
| -rw-r--r-- | pyramid/tests/test_session.py | 7 |
3 files changed, 11 insertions, 2 deletions
diff --git a/pyramid/session.py b/pyramid/session.py index b3be68705..a4cdf910d 100644 --- a/pyramid/session.py +++ b/pyramid/session.py @@ -126,7 +126,8 @@ def check_csrf_token(request, .. versionadded:: 1.4a2 """ supplied_token = request.params.get(token, request.headers.get(header, "")) - if strings_differ(request.session.get_csrf_token(), supplied_token): + expected_token = request.session.get_csrf_token() + if strings_differ(bytes_(expected_token), bytes_(supplied_token)): if raises: raise BadCSRFToken('check_csrf_token(): Invalid token') return False diff --git a/pyramid/testing.py b/pyramid/testing.py index 58dcb0b59..14432b01f 100644 --- a/pyramid/testing.py +++ b/pyramid/testing.py @@ -16,6 +16,7 @@ from pyramid.compat import ( PY3, PYPY, class_types, + text_, ) from pyramid.config import Configurator @@ -274,7 +275,7 @@ class DummySession(dict): return storage def new_csrf_token(self): - token = '0123456789012345678901234567890123456789' + token = text_('0123456789012345678901234567890123456789') self['_csrft_'] = token return token diff --git a/pyramid/tests/test_session.py b/pyramid/tests/test_session.py index 82e4fb001..914d28a83 100644 --- a/pyramid/tests/test_session.py +++ b/pyramid/tests/test_session.py @@ -695,6 +695,13 @@ class Test_check_csrf_token(unittest.TestCase): result = self._callFUT(request, 'csrf_token', raises=False) self.assertEqual(result, False) + def test_token_differing_types(self): + from pyramid.compat import text_ + request = testing.DummyRequest() + request.session['_csrft_'] = text_('foo') + request.params['csrf_token'] = b'foo' + self.assertEqual(self._callFUT(request, token='csrf_token'), True) + class DummySerializer(object): def dumps(self, value): return base64.b64encode(json.dumps(value).encode('utf-8')) |