mirror of
https://github.com/django/django.git
synced 2025-10-24 14:16:09 +00:00
Changed action="." to action="" in tests and docs.
`action="."` strips query parameters from the URL which is not usually what you want. Copy-paste coding of these examples could lead to difficult to track down bugs or even data loss if the query parameter was meant to alter the scope of a form's POST request.
This commit is contained in:
@@ -40,7 +40,7 @@ To take advantage of CSRF protection in your views, follow these steps:
|
||||
2. In any template that uses a POST form, use the :ttag:`csrf_token` tag inside
|
||||
the ``<form>`` element if the form is for an internal URL, e.g.::
|
||||
|
||||
<form action="." method="post">{% csrf_token %}
|
||||
<form action="" method="post">{% csrf_token %}
|
||||
|
||||
This should not be done for POST forms that target external URLs, since
|
||||
that would cause the CSRF token to be leaked, leading to a vulnerability.
|
||||
|
||||
Reference in New Issue
Block a user