From 2be2b52f632650360f5a930299fe27c1bcc71a4b Mon Sep 17 00:00:00 2001
From: e0d <ed@edx.org>
Date: Fri, 8 Apr 2016 06:09:03 -0400
Subject: [PATCH] apply the setting to the CMS too
---
cms/envs/aws.py | 6 ++++++
cms/envs/common.py | 4 +++-
2 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/cms/envs/aws.py b/cms/envs/aws.py
index 0068221147a..3bd110ff106 100644
--- a/cms/envs/aws.py
+++ b/cms/envs/aws.py
@@ -168,6 +168,12 @@ if ENV_TOKENS.get('SESSION_COOKIE_NAME', None):
EDXMKTG_LOGGED_IN_COOKIE_NAME = ENV_TOKENS.get('EDXMKTG_LOGGED_IN_COOKIE_NAME', EDXMKTG_LOGGED_IN_COOKIE_NAME)
EDXMKTG_USER_INFO_COOKIE_NAME = ENV_TOKENS.get('EDXMKTG_USER_INFO_COOKIE_NAME', EDXMKTG_USER_INFO_COOKIE_NAME)
+# Determines whether the CSRF token can be transported on
+# unencrypted channels. It is set to False here for backward compatibility,
+# but it is highly recommended that this is True for environments accessed
+# by end users.
+CSRF_COOKIE_SECURE = ENV_TOKENS.get('CSRF_COOKIE_SECURE', False)
+
#Email overrides
DEFAULT_FROM_EMAIL = ENV_TOKENS.get('DEFAULT_FROM_EMAIL', DEFAULT_FROM_EMAIL)
DEFAULT_FEEDBACK_EMAIL = ENV_TOKENS.get('DEFAULT_FEEDBACK_EMAIL', DEFAULT_FEEDBACK_EMAIL)
diff --git a/cms/envs/common.py b/cms/envs/common.py
index d1459204068..7bb4d9663fd 100644
--- a/cms/envs/common.py
+++ b/cms/envs/common.py
@@ -298,7 +298,9 @@ from lms.envs.common import (
# Forwards-compatibility with Django 1.7
CSRF_COOKIE_AGE = 60 * 60 * 24 * 7 * 52
-
+# It is highly recommended that you override this in any environment accessed by
+# end users
+CSRF_COOKIE_SECURE = False
#################### CAPA External Code Evaluation #############################
XQUEUE_INTERFACE = {
--
GitLab