From 89ea98ca5666c0d42b3ab77fcc48f9636dde88f1 Mon Sep 17 00:00:00 2001 From: Luke Plant Date: Wed, 29 Sep 2010 16:35:34 +0000 Subject: [PATCH] Fixed #14182 - documented how to modify upload handlers when using CsrfViewMiddleware Thanks to dc for the report. git-svn-id: http://code.djangoproject.com/svn/django/trunk@13960 bcc190cf-cafb-0310-a4f2-bffc1f526a37 --- docs/topics/http/file-uploads.txt | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/docs/topics/http/file-uploads.txt b/docs/topics/http/file-uploads.txt index 6b0a4d5722..c505cac7ee 100644 --- a/docs/topics/http/file-uploads.txt +++ b/docs/topics/http/file-uploads.txt @@ -270,6 +270,30 @@ list:: Thus, you should always modify uploading handlers as early in your view as possible. + Also, ``request.POST`` is accessed by + :class:`~django.middleware.csrf.CsrfViewMiddleware` which is enabled by + default. This means you will probably need to use + :func:`~django.views.decorators.csrf.csrf_exempt` on your view to allow you + to change the upload handlers. Assuming you do need CSRF protection, you + will then need to use :func:`~django.views.decorators.csrf.csrf_protect` on + the function that actually processes the request. Note that this means that + the handlers may start receiving the file upload before the CSRF checks have + been done. Example code: + + .. code-block:: python + + from django.views.decorators.csrf import csrf_exempt, csrf_protect + + @csrf_exempt + def upload_file_view(request): + request.upload_handlers.insert(0, ProgressBarUploadHandler()) + return _upload_file_view(request) + + @csrf_protect + def _upload_file_view(request): + ... # Process request + + Writing custom upload handlers ------------------------------