Fixed #11340 -- Prevented HttpResponseNotModified to have content/content-type

The HTTP 1.1 spec tells that the 304 response MUST NOT contain a
message body.
Thanks aparajita for the report.

1 files changed, 10 insertions, 0 deletions

diff --git a/django/http/__init__.py b/django/http/__init__.py
index 701e76f7fa..7782ebe648 100644
--- a/django/http/__init__.py
+++ b/django/http/__init__.py
@@ -744,6 +744,16 @@ class HttpResponsePermanentRedirect(HttpResponseRedirectBase):
 class HttpResponseNotModified(HttpResponse):
     status_code = 304
 
+    def __init__(self, *args, **kwargs):
+        super(HttpResponseNotModified, self).__init__(*args, **kwargs)
+        del self['content-type']
+
+    @HttpResponse.content.setter
+    def content(self, value):
+        if value:
+            raise AttributeError("You cannot set content to a 304 (Not Modified) response")
+        self._container = []
+
 class HttpResponseBadRequest(HttpResponse):
     status_code = 400