[Bug]: CSRF failure view does not correctly resolve or pass program context

[Vipeen-Kumar]

Description

While looking into the csrf_failure view, I noticed that it tries to extract a Program object from the request path, but the logic doesn’t seem to behave as expected.

The regex used for parsing doesn’t account for the leading / in request.path, so it may fail to match in normal cases. On top of that, even if a program is successfully resolved, it isn’t added to the template context, so it doesn’t actually affect the rendered response.

I also noticed that prog isn’t currently used anywhere in 403_csrf_failure.html, which makes this logic feel a bit incomplete or possibly leftover from an earlier implementation. Would it make sense to pass prog into the template and use it there, or should this lookup be removed entirely if it’s no longer needed?

One thought I had was to simplify the parsing by using request.path.strip('/').split('/'), which is easier to read and maintain. That said, I realize the current regex does provide some basic validation (restricting characters before hitting the database), so it might be preferable to keep the regex and just adjust it to handle the leading / properly.

Overall, just wanted to flag this in case it’s unintended behavior or something that could be cleaned up 👍

Steps to Reproduce

1. Trigger a CSRF failure on a URL that includes a program path (e.g. /something/program1/session1/...)
2. Observe the behavior inside csrf_failure view
3. Check whether:
   The regex successfully matches the path
   The resolved prog is passed to the template

Expected Behavior

The program should be correctly extracted from the request path
The resolved Program object should be passed into the template context
The CSRF failure page should have access to program-specific data (if needed)

Actual Behavior

The regex may fail due to the leading / in request.path
Even when a program is found, it is not added to the context
The computed prog variable is effectively unused

Screenshots

No response

Operating System

Windows 11

Browser

Chrome

Additional Context

A simple improvement could be:

Replacing regex parsing with request.path.strip('/').split('/')
Adding prog to the context (c['prog'] = prog)

Happy to work on a fix if this approach looks good.

[github-actions]

👋 Thanks for opening this issue!

To keep the tracker focused, new issues are locked for conversation until a maintainer has reviewed them. This helps us avoid duplicates and ensure issues are actionable.

What happens next:

• A maintainer will review this issue shortly.
• If approved, the conversation will be unlocked and the needs-triage label removed.
• If this is a duplicate or out of scope, a maintainer will close it with an explanation.

Please don't worry — your issue hasn't been rejected, it's just waiting for review. 🙏

[Vipeen-Kumar]

Hi @willgearty! Thanks for taking a look at this issue.

I was thinking of working on a fix for this and wanted to confirm the expected direction before proceeding.

My current understanding is:

Fix the path parsing so it correctly handles the leading /
Ensure that if a Program is resolved, it’s added to the template context

One thing I’m unsure about is whether the prog lookup is actually still needed, since it doesn’t seem to be used in 403_csrf_failure.html right now. Would you prefer:

passing it into the template and using it there, or
removing this logic entirely if it’s no longer relevant?

I was also considering simplifying the parsing using request.path.strip('/').split('/'), but I understand the current regex adds some validation, so happy to keep that and just adjust it if preferred.

If this approach sounds good, I’d be happy to take this up and open a PR 🙂

[workonlly]

sounds good you are reasearching on the repo need any help can ask any time

[Vipeen-Kumar]

Thanks @workonlly! I’ll start working on this and open a PR soon.

[Vipeen-Kumar]

/assign

[github-actions]

✅ @Vipeen-Kumar has been assigned to this issue. You have 1/5 issue(s) assigned.

📖 Getting Started · Contribution Rules · Code of Conduct