import re

from .view_error import *

class JSONPMiddleware(object):
    def process_response(self, request, response):
        # If the response is a redirect, the callback will be dealt
        # on the next request:
        if response.status_code == 302:
            return response
        else:
            if request.GET.get('callback') and re.match('[a-zA-Z0-9_$.]+$', request.GET.get('callback')):
                response.content = request.GET.get('callback').encode('utf-8') + b'(' + response.content + b')'
                response.status_code = 200 # Must return OK for JSONP to be processed
            return response


import re

from .view_error import *

class JSONPMiddleware(object):
    def process_response(self, request, response):
        # If the response is a redirect, the callback will be dealt
        # on the next request:
        if response.status_code == 302:
            return response
        else:
            cb = request.GET.get('callback')
            if cb and re.match('[a-zA-Z0-9_$.]+$', cb):
                cb = cb.encode('utf-8')
                response.content = b'typeof ' + cb + b" === 'function' && " + cb + b'(' + response.content + b')'
                response.status_code = 200 # Must return OK for JSONP to be processed
            return response


Include typeof check in JSONP callback response.
Include typeof check in JSONP callback response.

This is more robust, and helps against attacks such as Rosetta Flash:
https://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/
