Add note for posterity.

pandaproject · Aug 8, 2012 · c391021 · c391021
1 parent a727b52
commit c391021
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/panda/api/utils.py b/panda/api/utils.py
@@ -132,6 +132,8 @@ def try_sessions(self, request, **kwargs):
             if not same_origin(referer, good_referer):
                 return False
 
+        # Tastypie docstring says accessing POST here isn't safe, but so far it's not causing any problems...
+        # This is necessary for downloads that post the csrf token from an iframe
         request_csrf_token = request.META.get('HTTP_X_CSRFTOKEN', '') or request.POST.get('csrfmiddlewaretoken', '')
 
         if not constant_time_compare(request_csrf_token, csrf_token):