[Django] #32124: Allow individual views to opt-out of APPEND_SLASH behaviour.
Django
------------------------------------------+------------------------
Reporter: Carlton Gibson | Owner: nobody
Type: New feature | Status: new
Component: HTTP handling | Version: 3.1
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
------------------------------------------+------------------------
The URL normalisation given by APPEND_SLASH is useful.
I may wish to retain that but also have a sensitive view that opts-out of
that behavior, to avoid it being revealed in a potential URL enumeration.
I propose adjusting `CommonMiddleware` to detect a `_should_append_slash`
boolean attribute on the view itself, to allow such an opt-out.
--
Ticket URL: <https://code.djangoproject.com/ticket/32124>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
Django
Reporter: Carlton Gibson | Owner: Carlton Gibson
Type: New feature | Status: assigned
Component: HTTP handling | Version: 3.1
Keywords: | Triage Stage: Unreviewed
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
Changes (by Carlton Gibson):
* owner: nobody => Carlton Gibson
* status: new => assigned
* has_patch: 0 => 1
Comment:
[https://github.com/django/django/pull/13575 PR]
Related to #31747
--
Ticket URL: <https://code.djangoproject.com/ticket/32124#comment:1>
Django
Reporter: Carlton Gibson | Owner: Carlton Gibson
Type: New feature | Status: assigned
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
Changes (by Mariusz Felisiak):
* stage: Unreviewed => Accepted
Comment:
Agreed. I would use `should_append_slash` (without a leading underscore)
and probably add and document only a view decorator (similar to
`csrf_exempt()`).
--
Ticket URL: <https://code.djangoproject.com/ticket/32124#comment:2>
Django
Reporter: Carlton Gibson | Owner: Carlton Gibson
Type: New feature | Status: assigned
Keywords: | Triage Stage: Accepted
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
Comment (by Carlton Gibson):
> I would use `should_append_slash`
No problem. I had in mind `do_not_call_in_templates` (but, looking it up,
it doesn't have an underscore.)
--
Ticket URL: <https://code.djangoproject.com/ticket/32124#comment:3>
Django
Reporter: Carlton Gibson | Owner: Carlton Gibson
Component: HTTP handling | Version: 3.1
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
Changes (by Carlton Gibson <carlton@…>):
* status: assigned => closed
* resolution: => fixed
Comment:
In [changeset:"ad11f5b8c9cbfdb763e08c83170694abc0c5fc1e" ad11f5b8]:
{{{
#!CommitTicketReference repository=""
revision="ad11f5b8c9cbfdb763e08c83170694abc0c5fc1e"
Fixed #32124 -- Added per-view opt-out for APPEND_SLASH behavior.
}}}
--
Ticket URL: <https://code.djangoproject.com/ticket/32124#comment:4>