Ticket #5898: remove_unallowed_content.diff

django/middleware/http.py

@@ -6 +6 @@
     Last-Modified header, and the request has If-None-Match or
     If-Modified-Since, the response is replaced by an HttpNotModified.
 
-    Removes the content from any response to a HEAD request.
-
     Also sets the Date and Content-Length response-headers.
     """
     def process_response(self, request, response):
@@ -19 +17 @@
             if_none_match = request.META.get('HTTP_IF_NONE_MATCH', None)
             if if_none_match == response['ETag']:
                 response.status_code = 304
-                response.content = ''
-                response['Content-Length'] = '0'
 
         if response.has_header('Last-Modified'):
             if_modified_since = request.META.get('HTTP_IF_MODIFIED_SINCE', None)
             if if_modified_since == response['Last-Modified']:
                 response.status_code = 304
-                response.content = ''
-                response['Content-Length'] = '0'
 
-        if request.method == 'HEAD':
-            response.content = ''
-
         return response
 
 class SetRemoteAddrFromForwardedFor(object):
@@ -57 +48 @@
             # client's IP will be the first one.
             real_ip = real_ip.split(",")[0].strip()
             request.META['REMOTE_ADDR'] = real_ip
+
+class RemoveUnallowedResponseContent(object):
+    """
+    Middleware that removes the content of responses to HEAD requests, and
+    of responses with the status codes 1xx (Informational), 204 (No Content),
+    and 304 (Not Modified) that must not have content.  In this last case, the
+    Content-Length header is set to zero.  This is required by RFC 2616,
+    sections 4.3 and 4.13.
+    """
+    def process_response(self, request, response):
+        if 100 <= response.status_code < 200 or response.status_code in (204, 304):
+            response.content = ''
+            response['Content-Length'] = 0
+        if request.method == 'HEAD':
+            response.content = ''
+        return response