Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Fix request body/POST access#5590

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
carltongibson merged 3 commits intoencode:masterfromrpkilby:django-request-body
Nov 15, 2017

Conversation

@rpkilby
Copy link
Contributor

Supersedes/closes#5583 andfixes#5582.

@rpkilby
Copy link
ContributorAuthor

cc@D3X,@tomchristie.

Hi Tom, see my commenthere for context. It seems like settingrequest._post in addition torequest._files might have been the correct thing to do. Thoughts?

@D3X
Copy link
Contributor

D3X commentedNov 13, 2017

@rpkilby One thing I'm concerned about is that this changes the contract onrequest._post.

Normally, Django would set it to an emptyQueryDict if the Content-Type of the request was not "application/x-www-form-urlencoded" or "multipart/form-data".

With this PR, it gets set to parsed data even for other types, like "application/json". This could result in not-easy-to-track bugs if some middlewares depended on Django's behaviour in this case.

@xordoquy
Copy link
Contributor

This shouldn't impact middlewares as they are called with Django's request. DRF's views does the wrapping so it's really used "inside" DRF whether core or the application code.

@D3X
Copy link
Contributor

D3X commentedNov 14, 2017

@xordoquy I wrote a short test to show how the interface on request.POST changes when using DRF and posting JSON:D3X@aa6a4c4

I don't know any app that would break because of it, but it is possible some would.

@rpkilby
Copy link
ContributorAuthor

@D3X - thanks, good catch.

@carltongibson
Copy link
Collaborator

@rpkilby This looks fine to me — I'm inclined to just pull it in, but I'm not quite seeing how the commits match the conversation. (Did you rebase? What changed?)

I wrote a short test to show how the interface on request.POST changes...

OK, added, but what wasthis line in the first version?

     self._request._post = self.POST

Thanks!

@carltongibsoncarltongibson added this to thev3.7.4 milestoneNov 15, 2017
@rpkilby
Copy link
ContributorAuthor

@carltongibson - yeah, I amended the commits from earlier in the conversation. Previously was

self._request._post=self._dataself._request._files=self._files

@carltongibson
Copy link
Collaborator

@rpkilby OK, thanks. That makes perfect sense.

Copy link
Collaborator

@carltongibsoncarltongibson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

OK, let’s have this. Thanks@D3X@rpkilby@xordoquy!

@carltongibsoncarltongibson merged commit9f66e8b intoencode:masterNov 15, 2017
@rpkilbyrpkilby deleted the django-request-body branchNovember 15, 2017 19:59
@xordoquy
Copy link
Contributor

I have no idea how this PR works.
_load_data_and_files callPOST which may call_load_data_and_files.

@rpkilby
Copy link
ContributorAuthor

@xordoquy - it's definitely weird, but it won't reenter. eg, if you callrequest.POST, it will trigger the call to_load_data_and_files(). At this point,_data/_files/_full_data are set, so the inner call torequest.POST won't call_load_data_and_files() again.

pchiquet pushed a commit to pchiquet/django-rest-framework that referenced this pull requestNov 17, 2020
* Modernize middleware tests* Added a failing test forencode#5582* Set data ref on underlying django request
Techcable added a commit to Techcable/vmprof-server that referenced this pull requestApr 11, 2021
@sevdogsevdog mentioned this pull requestSep 19, 2025
3 tasks
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

@carltongibsoncarltongibsoncarltongibson approved these changes

+1 more reviewer

@D3XD3XD3X approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@carltongibsoncarltongibson

Labels

None yet

Projects

None yet

Milestone

3.7.4 Release

Development

Successfully merging this pull request may close these issues.

DRF 3.6.4/3.7.0 breaks reading request.POST if request.body was read

5 participants

@rpkilby@D3X@xordoquy@carltongibson@lovelydinosaur

[8]ページ先頭

©2009-2025 Movatter.jp