From 0b174ccf0ef99b9ee887890fc5c7ac0c7a845720 Mon Sep 17 00:00:00 2001
From: Jacob Kaplan-Moss <jacob@jacobian.org>
Date: Fri, 9 Sep 2011 17:20:16 +0000
Subject: [PATCH] Fixed #16384: warn against accessing request.POST/REQUEST in
 middleware.

Thanks, Tom Christie.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@16734 bcc190cf-cafb-0310-a4f2-bffc1f526a37
---
 AUTHORS                           |  1 +
 docs/topics/http/file-uploads.txt |  2 ++
 docs/topics/http/middleware.txt   | 15 +++++++++++++++
 3 files changed, 18 insertions(+)

diff --git a/AUTHORS b/AUTHORS
index 74399f840f..d12b5fb346 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -120,6 +120,7 @@ answer newbie questions, and generally made Django that much better:
     Sengtha Chay <sengtha@e-khmer.com>
     ivan.chelubeev@gmail.com
     Bryan Chow <bryan at verdjn dot com>
+    Tom Christie <tom@tomchristie.com>
     Antonis Christofides <anthony@itia.ntua.gr>
     Michal Chruszcz <troll@pld-linux.org>
     Can Burak Çilingir <canburak@cs.bilgi.edu.tr>
diff --git a/docs/topics/http/file-uploads.txt b/docs/topics/http/file-uploads.txt
index 63454f05a4..e5298ef2cb 100644
--- a/docs/topics/http/file-uploads.txt
+++ b/docs/topics/http/file-uploads.txt
@@ -238,6 +238,8 @@ could, for example, use custom handlers to enforce user-level quotas, compress
 data on the fly, render progress bars, and even send data to another storage
 location directly without storing it locally.
 
+.. _modifying_upload_handlers_on_the_fly:
+
 Modifying upload handlers on the fly
 ------------------------------------
 
diff --git a/docs/topics/http/middleware.txt b/docs/topics/http/middleware.txt
index c9c2311b19..be2a774c95 100644
--- a/docs/topics/http/middleware.txt
+++ b/docs/topics/http/middleware.txt
@@ -97,6 +97,21 @@ calling ANY other request, view or exception middleware, or the appropriate
 view; it'll return that :class:`~django.http.HttpResponse`. Response
 middleware is always called on every response.
 
+.. note::
+    Accessing :attr:`request.POST <django.http.HttpRequest.POST>` or 
+    :attr:`request.REQUEST <django.http.HttpRequest.REQUEST>` inside 
+    middleware from ``process_request`` or ``process_view`` will prevent any
+    view running after the middleware from being able to
+    :ref:`modify the upload handlers for the 
+    request <modifying_upload_handlers_on_the_fly>`, and should normally be
+    avoided.
+
+    The :class:`~django.middleware.csrf.CsrfViewMiddleware` class can be
+    considered an exception, as it provides the
+    :func:`~django.views.decorators.csrf.csrf_exempt` and
+    :func:`~django.views.decorators.csrf.csrf_protect` decorators which allow
+    views to explicitly control at what point the CSRF validation should occur.
+
 .. _template-response-middleware:
 
 ``process_template_response``