Merge ~blake-rouse/maas:fix-1844796 into maas:master

[Blake Rouse]

Fixes LP: #1844796 - Exempt CSRF on the CSRF post request.

[Adam Collard (adam-collard)]

+1

review: Approve

[MAAS Lander (maas-lander)]

UNIT TESTS
-b fix-1844796 lp:~blake-rouse/maas/+git/maas into -b master lp:~maas-committers/maas

STATUS: FAILED
LOG: http://maas-ci-jenkins.internal:8080/job/maas/job/branch-tester/6473/console
COMMIT: 27114089970ef34ee7f9fe98a0812685974fbc31

review: Needs Fixing

diff --git a/src/maasserver/views/account.py b/src/maasserver/views/account.py
index 8ebcf39..72a27f4 100644
--- a/src/maasserver/views/account.py
+++ b/src/maasserver/views/account.py
@@ -27,6 +27,7 @@ from django.http import (
 )
 from django.middleware.csrf import get_token
 from django.shortcuts import render
+from django.views.decorators.csrf import csrf_exempt
 from maasserver.audit import create_audit_event
 from maasserver.enum import ENDPOINT
 from maasserver.models import UserProfile
@@ -153,6 +154,7 @@ def authenticate(request):
     })
 
 
+@csrf_exempt
 def csrf(request):
     """Get the CSRF token for the authenticated user."""
     if request.method != "POST":
diff --git a/src/maasserver/views/tests/test_account.py b/src/maasserver/views/tests/test_account.py
index cbf0c2d..fe4999b 100644
--- a/src/maasserver/views/tests/test_account.py
+++ b/src/maasserver/views/tests/test_account.py
@@ -385,6 +385,9 @@ class TestCSRF(MAASServerTestCase):
         self.assertThat(response, HasStatusCode(HTTPStatus.FORBIDDEN))
 
     def test__returns_csrf(self):
+        # Force the client to test for CSRF because the view should be CSRF
+        # exempt. If not exempt then the `client.post` would fail.
+        self.client.handler.enforce_csrf_checks = True
         self.client.login(user=factory.make_User())
         response = self.client.post(reverse('csrf'))
         self.assertThat(response, HasStatusCode(HTTPStatus.OK))