auth.crsf_on = False

VERSION

@@ -1 +1 @@
-Version 2.6.0-development+timestamp.2013.09.05.09.47.48
+Version 2.6.0-development+timestamp.2013.09.05.17.22.51

gluon/tools.py

@@ -1120,7 +1120,8 @@ class Auth(object):
 
     def __init__(self, environment=None, db=None, mailer=True,
                  hmac_key=None, controller='default', function='user',
-                 cas_provider=None, signature=True, secure=False):
+                 cas_provider=None, signature=True, secure=False,
+                 csrf_on=True):
         """
         auth=Auth(db)
 
@@ -1136,6 +1137,7 @@ class Auth(object):
             db = environment
         self.db = db
         self.environment = current
+        self.csrf_on = csrf_on
         request = current.request
         session = current.session
         auth = session.auth
@@ -2267,7 +2269,7 @@ class Auth(object):
                        settings.formstyle, 'captcha__row')
             accepted_form = False
 
-            if form.accepts(request, session,
+            if form.accepts(request, session if self.csrf_on else None,
                             formname='login', dbio=False,
                             onvalidation=onvalidation,
                             hideerror=settings.hideerror):
@@ -2509,8 +2511,10 @@ class Auth(object):
                    captcha.comment, self.settings.formstyle, 'captcha__row')
 
         table_user.registration_key.default = key = web2py_uuid()
-        if form.accepts(request, session, formname='register',
-                        onvalidation=onvalidation, hideerror=self.settings.hideerror):
+        if form.accepts(request, session if self.csrf_on else None, 
+                        formname='register',
+                        onvalidation=onvalidation, 
+                        hideerror=self.settings.hideerror):
             description = self.messages.group_description % form.vars
             if self.settings.create_user_groups:
                 group_id = self.add_group(
@@ -2653,7 +2657,7 @@ class Auth(object):
             addrow(form, captcha.label, captcha,
                    captcha.comment, self.settings.formstyle, 'captcha__row')
 
-        if form.accepts(request, session,
+        if form.accepts(request, session if self.csrf_on else None,
                         formname='retrieve_username', dbio=False,
                         onvalidation=onvalidation, hideerror=self.settings.hideerror):
             user = table_user(email=form.vars.email)
@@ -2731,7 +2735,7 @@ class Auth(object):
                        formstyle=self.settings.formstyle,
                        separator=self.settings.label_separator
                        )
-        if form.accepts(request, session,
+        if form.accepts(request, session if self.csrf_on else None,
                         formname='retrieve_password', dbio=False,
                         onvalidation=onvalidation, hideerror=self.settings.hideerror):
             user = table_user(email=form.vars.email)
@@ -2876,7 +2880,7 @@ class Auth(object):
         if captcha:
             addrow(form, captcha.label, captcha,
                    captcha.comment, self.settings.formstyle, 'captcha__row')
-        if form.accepts(request, session,
+        if form.accepts(request, session if self.csrf_on else None,
                         formname='reset_password', dbio=False,
                         onvalidation=onvalidation,
                         hideerror=self.settings.hideerror):