          resp2 = CsrfMiddleware().process_response(req, resp)
          self.assertNotEqual(resp_content, resp2.content)
          self._check_token_present(resp2)
  
      # Check the request processing
      def test_process_request_no_session(self):
          """
          Check that if no session is present, the middleware does nothing.
          to the incoming request.
          """
 
</s> remove         resp_content = resp.content
 </s> add 	resp_content = resp.content # needed because process_response modifies resp </s> remove         resp_content = resp.content
 </s> add 	resp_content = resp.content # needed because process_response modifies resp </s> remove         resp_content = resp.content
 </s> add 	resp_content = resp.content # needed because process_response modifies resp </s> remove You don't have to worry about doing this for most AJAX views. Any request sent
with "X-Requested-With: XMLHttpRequest" is automatically exempt. (See the next
section.)
 </s> add Like the middleware itself, the ``csrf_exempt`` decorator is composed
of two parts: a ``csrf_view_exempt`` decorator and a
``csrf_response_exempt`` decorator, found in the same module.  These
disable the view protection mechanism (``CsrfViewMiddleware``) and the
response post-processing (``CsrfResponseMiddleware``) respectively.
They can be used individually if required.

You don't have to worry about doing this for most AJAX views. Any
request sent with "X-Requested-With: XMLHttpRequest" is automatically
exempt. (See the next section.) </s> remove         Check the AJAX requests are automatically exempted.
 </s> add         Check that AJAX requests are automatically exempted.
    def test_process_response_exempt_view(self):
	"""
	Check that no post processing is done for an exempt view
	"""
        req = self._get_POST_session_request()
	resp = csrf_exempt(self.get_view())(req)
	resp_content = resp.content
        resp2 = CsrfMiddleware().process_response(req, resp)
        self.assertEquals(resp_content, resp2.content)

          resp2 = CsrfMiddleware().process_response(req, resp)
          self.assertNotEqual(resp_content, resp2.content)
          self._check_token_present(resp2)
  
    def test_process_response_exempt_view(self):
	"""
	Check that no post processing is done for an exempt view
	"""
        req = self._get_POST_session_request()
	resp = csrf_exempt(self.get_view())(req)
	resp_content = resp.content
        resp2 = CsrfMiddleware().process_response(req, resp)
        self.assertEquals(resp_content, resp2.content)

      # Check the request processing
      def test_process_request_no_session(self):
          """
          Check that if no session is present, the middleware does nothing.
          to the incoming request.
          """
keep keep keep add keep keep keep keep keep keep
 Made CSRF middleware skip post-processing for 'csrf_exempt' decorated views.

This commit also decomposes the decorator into two decorators which can be
used separately, adds some tests, updates docs and fixes some code comments.



git-svn-id: http://code.djangoproject.com/svn/django/trunk@9815 bcc190cf-cafb-0310-a4f2-bffc1f526a37 
django/contrib/csrf/tests.py