Skip to content

Commit

Permalink
Fixed #16430 - Stronger wording for CSRF protection in `modifying upl…
Browse files Browse the repository at this point in the history
…oad handlers on the fly`; thanks tomchristie.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@16588 bcc190cf-cafb-0310-a4f2-bffc1f526a37
  • Loading branch information
timgraham committed Aug 6, 2011
1 parent 0350d65 commit e3c8934
Showing 1 changed file with 6 additions and 6 deletions.
12 changes: 6 additions & 6 deletions docs/topics/http/file-uploads.txt
Original file line number Original file line Diff line number Diff line change
Expand Up @@ -278,13 +278,13 @@ list::


Also, ``request.POST`` is accessed by Also, ``request.POST`` is accessed by
:class:`~django.middleware.csrf.CsrfViewMiddleware` which is enabled by :class:`~django.middleware.csrf.CsrfViewMiddleware` which is enabled by
default. This means you will probably need to use default. This means you will need to use
:func:`~django.views.decorators.csrf.csrf_exempt` on your view to allow you :func:`~django.views.decorators.csrf.csrf_exempt` on your view to allow you
to change the upload handlers. Assuming you do need CSRF protection, you to change the upload handlers. You will then need to use
will then need to use :func:`~django.views.decorators.csrf.csrf_protect` on :func:`~django.views.decorators.csrf.csrf_protect` on the function that
the function that actually processes the request. Note that this means that actually processes the request. Note that this means that the handlers may
the handlers may start receiving the file upload before the CSRF checks have start receiving the file upload before the CSRF checks have been done.
been done. Example code: Example code:


.. code-block:: python .. code-block:: python


Expand Down

0 comments on commit e3c8934

Please sign in to comment.