decode to unicode before loading in json again, for py3

[mediagoblin.git] / mediagoblin / meddleware / csrf.py

diff --git a/mediagoblin/meddleware/csrf.py b/mediagoblin/meddleware/csrf.py
index 2984ebb9cb8ba55b9eea1d7c2950d8b763189895..6cad6fa76d1a161ed6982b4adb8cbd668c5471ac 100644 (file)
--- a/mediagoblin/meddleware/csrf.py
+++ b/mediagoblin/meddleware/csrf.py
@@ -22,6 +22,7 @@ from wtforms import Form, HiddenField, validators
 
 from mediagoblin import mg_globals
 from mediagoblin.meddleware import BaseMeddleware
+from mediagoblin.tools.translate import lazy_pass_to_ugettext as _
 
 _log = logging.getLogger(__name__)
 
@@ -45,7 +46,7 @@ class CsrfForm(Form):
     is included in the POST."""
 
     csrf_token = HiddenField("",
-                             [validators.Required()])
+                             [validators.InputRequired()])
 
 
 def render_csrf_form_token(request):
@@ -110,7 +111,7 @@ class CsrfMeddleware(BaseMeddleware):
             httponly=True)
 
         # update the Vary header
-        response.vary = (getattr(response, 'vary', None) or []) + ['Cookie']
+        response.vary = list(getattr(response, 'vary', None) or []) + ['Cookie']
 
     def _make_token(self, request):
         """Generate a new token to use for CSRF protection."""
@@ -127,10 +128,13 @@ class CsrfMeddleware(BaseMeddleware):
             None)
 
         if cookie_token is None:
-            # the CSRF cookie must be present in the request
-            errstr = 'CSRF cookie not present'
-            _log.error(errstr)
-            raise Forbidden(errstr)
+            # the CSRF cookie must be present in the request, if not a
+            # cookie blocker might be in action (in the best case)
+            _log.error('CSRF cookie not present')
+            raise Forbidden(_('CSRF cookie not present. This is most likely '
+                              'the result of a cookie blocker or somesuch.<br/>'
+                              'Make sure to permit the settings of cookies for '
+                              'this domain.'))
 
         # get the form token and confirm it matches
         form = CsrfForm(request.form)