[1.5.x] Fixed #19875 - Added warnings regarding DEBUG=False and empty ALLOWED_HOSTS

Backport of 4e94c84e50 from master

docs/intro/tutorial03.txt

@@ -468,6 +468,13 @@ template for all 404 errors when :setting:`DEBUG` is set to ``False`` (in your
 settings module). If you do create the template, add at least some dummy
 content like "Page not found".
 
+.. warning::
+
+    If :setting:`DEBUG` is set to ``False``, all responses will be
+    "Bad Request (400)" unless you specify the proper :setting:`ALLOWED_HOSTS`
+    as well (something like ``['localhost', '127.0.0.1']`` for
+    local development).
+
 A couple more things to note about 404 views:
 
 * If :setting:`DEBUG` is set to ``True`` (in your settings module) then your

docs/ref/settings.txt

@@ -823,6 +823,10 @@ It is also important to remember that when running with :setting:`DEBUG`
 turned on, Django will remember every SQL query it executes. This is useful
 when you're debugging, but it'll rapidly consume memory on a production server.
 
+Finally, if :setting:`DEBUG` is ``False``, you also need to properly set
+the :setting:`ALLOWED_HOSTS` setting. Failing to do so will result in all
+requests being returned as "Bad Request (400)".
+
 .. _django/views/debug.py: https://github.com/django/django/blob/master/django/views/debug.py
 
 DEBUG_PROPAGATE_EXCEPTIONS

docs/topics/settings.txt

@@ -17,6 +17,11 @@ Here are a couple of example settings::
     DEFAULT_FROM_EMAIL = 'webmaster@example.com'
     TEMPLATE_DIRS = ('/home/templates/mike', '/home/templates/john')
 
+.. note::
+
+    If you set :setting:`DEBUG` to ``False``, you also need to properly set
+    the :setting:`ALLOWED_HOSTS` setting.
+
 Because a settings file is a Python module, the following apply:
 
 * It doesn't allow for Python syntax errors.