diff options
| author | Clifford Gama <cliffygamy@gmail.com> | 2025-10-29 17:32:12 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-10-29 11:32:12 -0400 |
| commit | 01f8460653e73a8f60c98d3a37a74b28818744b6 (patch) | |
| tree | dbefe388d320ce6d33eee93a3c441142384b40f5 /docs/ref/settings.txt | |
| parent | 1aa69a7491ce7f7f1f164a26a3dfaaa1aeeab217 (diff) | |
Fixed #36329 -- Removed non-code custom link text when cross-referencing Python objects.
Thanks Bruno Alla, Sarah Boyce, and Jacob Walls for reviews.
Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
Diffstat (limited to 'docs/ref/settings.txt')
| -rw-r--r-- | docs/ref/settings.txt | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/docs/ref/settings.txt b/docs/ref/settings.txt index b0750d3a42..8ac7a194f6 100644 --- a/docs/ref/settings.txt +++ b/docs/ref/settings.txt @@ -463,9 +463,9 @@ A list of trusted origins for unsafe requests (e.g. ``POST``). For requests that include the ``Origin`` header, Django's CSRF protection requires that header match the origin present in the ``Host`` header. -For a :meth:`secure <django.http.HttpRequest.is_secure>` unsafe -request that doesn't include the ``Origin`` header, the request must have a -``Referer`` header that matches the origin present in the ``Host`` header. +For a secure (determined by :meth:`~django.http.HttpRequest.is_secure`) unsafe +request that doesn't include the ``Origin`` header, the request must include a +``Referer`` header that matches the origin in the ``Host`` header. These checks prevent, for example, a ``POST`` request from ``subdomain.example.com`` from succeeding against ``api.example.com``. If you @@ -1778,9 +1778,10 @@ Default: ``[]`` (Empty list) List of compiled regular expression objects describing URLs that should be ignored when reporting HTTP 404 errors via email (see :doc:`/howto/error-reporting`). Regular expressions are matched against -:meth:`request's full paths <django.http.HttpRequest.get_full_path>` (including -query string, if any). Use this if your site does not provide a commonly -requested file such as ``favicon.ico`` or ``robots.txt``. +request's full paths, as returned by +:meth:`~django.http.HttpRequest.get_full_path` (including any query strings). +Use this if your site does not provide a commonly requested file such as +``favicon.ico`` or ``robots.txt``. This is only used if :class:`~django.middleware.common.BrokenLinkEmailsMiddleware` is enabled (see |
