Most likely, I do not see something obvious, but nevertheless I ask for your help.

Error: Forbidden (403) CSRF verification failed. Request aborted.

views.py

def addCom(request): if request.method == "POST": message = request.POST["addcom"] print("-->" + str(message) + "<--") else: print(print("-->" "ЧТО-ТО НЕ ПОЛУЧИЛОСЬ" + "<--")) s = str(request) pos = s.find("ID=") + 3 pos1 = s.rfind("%7D") pos2 = s.find("!")+1 pos3 = s.rfind("??") ip = s[pos:pos1] objID = s[pos2:pos3] con = sqlite3.connect('users.db') cur = con.cursor() cur.execute('SELECT objName FROM objID_objName WHERE objID = "{}"'.format(objID)) name = cur.fetchall() name = name[0][0] print("-->" + str(name) + "<--") print("-->" + str(objID) + "<--") cur.execute('SELECT * FROM ip_ipINT_port_stat_prot_serv_objID WHERE ip = "{}"'.format(ip)) table_test = [] for row in cur.fetchall(): table_test.append(row) f = open("viewInfo/static/assets/{}-XML".format(name), "r") file = f.read() date = file[file.find("initiated")+9:file.find(" as: ")] context = {'ip': ip, 'name': name, 'objID': objID, 'table_test': table_test, 'date': date} return render_to_response("info.html", context)

Logic can not be considered, the essence is not in it. Just look at the first lines.

.html

  <form action="/viewInfo/addCom?projectID={{ip}}}!{{objID}}??" method="post"> {% csrf_token %} <label for="addcom">Добавить комментарий: </label> <p><textarea id="addcom" rows="8" cols="50" name="addcom"></textarea></p> <button type="submit" value="Добавить", class="btn btn-primary">Добавить</button> </form>

What could be the problem? In other places I do likewise and everything works ...

    2 answers 2

    Try replacing render_to_response() (which is deprecated ) with render() , which accepts request as the first argument.

    The documentation states that for the CSRF protection to work correctly, you need to render the response using RequestContext() . The render() function uses it by default.

     from django.shortcuts import render def addCom(request): .... return render(request, "info.html", context)
    • Alas, it did not help - Ivan Ermilov February
    • @ Ivanermilov MIDDLEWARE there django.middleware.csrf.CsrfViewMiddleware in settings.py in the list of django.middleware.csrf.CsrfViewMiddleware ? - Andrey
    • Yes, I added. Doesn't work anyway - Ivan Ermilov
    • No other ideas. - Andrey

    In my opinion, you have an extra curly bracket in the form of html, in action after ip, try to fix it.

    • Unfortunately, not superfluous. I use it to parse the request for the extraction of proprietary information. - Ivan Ermilov