Ticket #15637: add-require-safe-http-decorator.patch

docs/topics/http/decorators.txt

@@ -36 +36 @@
 
 Decorator to require that a view only accept the POST method.
 
+.. function:: require_safe()
+
+Decorator to require that a view only accept the GET and HEAD methods. It is similar to require_GET, but does not break software relying on HEAD requests, like link checkers.
+
+
 Conditional view processing
 ===========================
 

tests/regressiontests/decorators/tests.py

@@ -10 +10 @@
 from django.utils.decorators import method_decorator
 from django.utils.functional import allow_lazy, lazy, memoize
 from django.utils.unittest import TestCase
-from django.views.decorators.http import require_http_methods, require_GET, require_POST
+from django.views.decorators.http import require_http_methods, require_GET, require_POST, require_safe
 from django.views.decorators.vary import vary_on_headers, vary_on_cookie
 from django.views.decorators.cache import cache_page, never_cache, cache_control
 
@@ -24 +24 @@
 fully_decorated = require_http_methods(["GET"])(fully_decorated)
 fully_decorated = require_GET(fully_decorated)
 fully_decorated = require_POST(fully_decorated)
+fully_decorated = require_safe(fully_decorated)
 
 # django.views.decorators.vary
 fully_decorated = vary_on_headers('Accept-language')(fully_decorated)

django/views/decorators/http.py

@@ -52 +52 @@
 require_POST = require_http_methods(["POST"])
 require_POST.__doc__ = "Decorator to require that a view only accept the POST method."
 
+require_safe = require_http_methods(["GET", "HEAD"])
+require_safe.__doc__ = "Decorator to require that a view only accept the GET and HEAD methods."
+
 def condition(etag_func=None, last_modified_func=None):
     """
     Decorator to support conditional retrieval (or change) for a view