Skip to content


Subversion checkout URL

You can clone with
Download ZIP
Browse files

Fixed #16384: warn against accessing request.POST/REQUEST in middleware.

Thanks, Tom Christie.

git-svn-id: bcc190cf-cafb-0310-a4f2-bffc1f526a37
  • Loading branch information...
1 parent d036b87 commit 0b174ccf0ef99b9ee887890fc5c7ac0c7a845720 @jacobian jacobian committed
1  AUTHORS
@@ -120,6 +120,7 @@ answer newbie questions, and generally made Django that much better:
Sengtha Chay <>
Bryan Chow <bryan at verdjn dot com>
+ Tom Christie <>
Antonis Christofides <>
Michal Chruszcz <>
Can Burak Çilingir <>
2  docs/topics/http/file-uploads.txt
@@ -238,6 +238,8 @@ could, for example, use custom handlers to enforce user-level quotas, compress
data on the fly, render progress bars, and even send data to another storage
location directly without storing it locally.
+.. _modifying_upload_handlers_on_the_fly:
Modifying upload handlers on the fly
15 docs/topics/http/middleware.txt
@@ -97,6 +97,21 @@ calling ANY other request, view or exception middleware, or the appropriate
view; it'll return that :class:`~django.http.HttpResponse`. Response
middleware is always called on every response.
+.. note::
+ Accessing :attr:`request.POST <django.http.HttpRequest.POST>` or
+ :attr:`request.REQUEST <django.http.HttpRequest.REQUEST>` inside
+ middleware from ``process_request`` or ``process_view`` will prevent any
+ view running after the middleware from being able to
+ :ref:`modify the upload handlers for the
+ request <modifying_upload_handlers_on_the_fly>`, and should normally be
+ avoided.
+ The :class:`~django.middleware.csrf.CsrfViewMiddleware` class can be
+ considered an exception, as it provides the
+ :func:`~django.views.decorators.csrf.csrf_exempt` and
+ :func:`~django.views.decorators.csrf.csrf_protect` decorators which allow
+ views to explicitly control at what point the CSRF validation should occur.
.. _template-response-middleware:

0 comments on commit 0b174cc

Please sign in to comment.
Something went wrong with that request. Please try again.