Use CSRF exceptions for API calls.

Fixes #2002

diff --git a/pithos/api/functions.py b/pithos/api/functions.py
index 19f3799..77a5abd 100644 (file)
--- a/pithos/api/functions.py
+++ b/pithos/api/functions.py
@@ -39,6 +39,7 @@ from django.template.loader import render_to_string
 from django.utils import simplejson as json
 from django.utils.http import parse_etags
 from django.utils.encoding import smart_str
+from django.views.decorators.csrf import csrf_exempt
 
 from pithos.lib.filter import parse_filters
 
@@ -59,6 +60,7 @@ import hashlib
 logger = logging.getLogger(__name__)
 
 
+@csrf_exempt
 def top_demux(request):
     if request.method == 'GET':
         if getattr(request, 'user', None) is not None:
@@ -67,6 +69,7 @@ def top_demux(request):
     else:
         return method_not_allowed(request)
 
+@csrf_exempt
 def account_demux(request, v_account):
     if request.method == 'HEAD':
         return account_meta(request, v_account)
@@ -77,6 +80,7 @@ def account_demux(request, v_account):
     else:
         return method_not_allowed(request)
 
+@csrf_exempt
 def container_demux(request, v_account, v_container):
     if request.method == 'HEAD':
         return container_meta(request, v_account, v_container)
@@ -91,6 +95,7 @@ def container_demux(request, v_account, v_container):
     else:
         return method_not_allowed(request)
 
+@csrf_exempt
 def object_demux(request, v_account, v_container, v_object):
     if request.method == 'HEAD':
         return object_meta(request, v_account, v_container, v_object)

diff --git a/pithos/api/public.py b/pithos/api/public.py
index b11a693..64c13cf 100644 (file)
--- a/pithos/api/public.py
+++ b/pithos/api/public.py
@@ -34,6 +34,7 @@
 import logging
 
 from django.http import HttpResponse
+from django.views.decorators.csrf import csrf_exempt
 
 from pithos.api.faults import (Fault, BadRequest, ItemNotFound)
 from pithos.api.util import (put_object_headers, update_manifest_meta,
@@ -45,6 +46,7 @@ from pithos.api.short_url import decode_url
 logger = logging.getLogger(__name__)
 
 
+@csrf_exempt
 def public_demux(request, v_public):
     if request.method == 'HEAD':
         return public_meta(request, v_public)