Documentation (and some small source code) edits from [17432] - [17537]

git-svn-id: http://code.djangoproject.com/svn/django/trunk@17540 bcc190cf-cafb-0310-a4f2-bffc1f526a37

2 files changed, 14 insertions, 15 deletions

diff --git a/django/core/management/validation.py b/django/core/management/validation.py
index f0b5b1c7c2..4833337445 100644
--- a/django/core/management/validation.py
+++ b/django/core/management/validation.py
@@ -283,9 +283,8 @@ def get_validation_errors(outfile, app=None):
                 # this format would be nice, but it's a little fiddly).
                 if '__' in field_name:
                     continue
-                # Skip ordering on pk, this is always a valid order_by field
-                # but is an alias and therefore won't be found by
-                # opts.get_field.
+                # Skip ordering on pk. This is always a valid order_by field
+                # but is an alias and therefore won't be found by opts.get_field.
                 if field_name == 'pk':
                     continue
                 try:
diff --git a/django/middleware/csrf.py b/django/middleware/csrf.py
index 1a4e06bbec..fd8ff30303 100644
--- a/django/middleware/csrf.py
+++ b/django/middleware/csrf.py
@@ -110,23 +110,23 @@ class CsrfViewMiddleware(object):
                 # Mechanism to turn off CSRF checks for test suite.
                 # It comes after the creation of CSRF cookies, so that
                 # everything else continues to work exactly the same
-                # (e.g. cookies are sent etc), but before the any
-                # branches that call reject()
+                # (e.g. cookies are sent, etc.), but before any
+                # branches that call reject().
                 return self._accept(request)
 
             if request.is_secure():
                 # Suppose user visits http://example.com/
-                # An active network attacker,(man-in-the-middle, MITM) sends a
-                # POST form which targets https://example.com/detonate-bomb/ and
-                # submits it via javascript.
+                # An active network attacker (man-in-the-middle, MITM) sends a
+                # POST form that targets https://example.com/detonate-bomb/ and
+                # submits it via JavaScript.
                 #
                 # The attacker will need to provide a CSRF cookie and token, but
-                # that is no problem for a MITM and the session independent
-                # nonce we are using. So the MITM can circumvent the CSRF
+                # that's no problem for a MITM and the session-independent
+                # nonce we're using. So the MITM can circumvent the CSRF
                 # protection. This is true for any HTTP connection, but anyone
-                # using HTTPS expects better!  For this reason, for
+                # using HTTPS expects better! For this reason, for
                 # https://example.com/ we need additional protection that treats
-                # http://example.com/ as completely untrusted.  Under HTTPS,
+                # http://example.com/ as completely untrusted. Under HTTPS,
                 # Barth et al. found that the Referer header is missing for
                 # same-domain requests in only about 0.2% of cases or less, so
                 # we can use strict Referer checking.
@@ -141,7 +141,7 @@ class CsrfViewMiddleware(object):
                     )
                     return self._reject(request, REASON_NO_REFERER)
 
-                # Note that request.get_host() includes the port
+                # Note that request.get_host() includes the port.
                 good_referer = 'https://%s/' % request.get_host()
                 if not same_origin(referer, good_referer):
                     reason = REASON_BAD_REFERER % (referer, good_referer)
@@ -166,14 +166,14 @@ class CsrfViewMiddleware(object):
                 )
                 return self._reject(request, REASON_NO_CSRF_COOKIE)
 
-            # check non-cookie token for match
+            # Check non-cookie token for match.
             request_csrf_token = ""
             if request.method == "POST":
                 request_csrf_token = request.POST.get('csrfmiddlewaretoken', '')
 
             if request_csrf_token == "":
                 # Fall back to X-CSRFToken, to make things easier for AJAX,
-                # and possible for PUT/DELETE
+                # and possible for PUT/DELETE.
                 request_csrf_token = request.META.get('HTTP_X_CSRFTOKEN', '')
 
             if not constant_time_compare(request_csrf_token, csrf_token):