diff --git a/django/contrib/staticfiles/handlers.py b/django/contrib/staticfiles/handlers.py index b51b7c8fd5..962b835fef 100644 --- a/django/contrib/staticfiles/handlers.py +++ b/django/contrib/staticfiles/handlers.py @@ -35,8 +35,7 @@ class StaticFilesHandler(WSGIHandler): * the host is provided as part of the base_url * the request's path isn't under the media path (or equal) """ - return (self.base_url[2] != path and - path.startswith(self.base_url[2]) and not self.base_url[1]) + return path.startswith(self.base_url[2]) and not self.base_url[1] def file_path(self, url): """ diff --git a/django/contrib/staticfiles/views.py b/django/contrib/staticfiles/views.py index 5df1a3eced..1a9c166ad7 100644 --- a/django/contrib/staticfiles/views.py +++ b/django/contrib/staticfiles/views.py @@ -34,6 +34,8 @@ def serve(request, path, document_root=None, insecure=False, **kwargs): normalized_path = posixpath.normpath(urllib.unquote(path)).lstrip('/') absolute_path = finders.find(normalized_path) if not absolute_path: + if path.endswith('/') or path == '': + raise Http404("Directory indexes are not allowed here.") raise Http404("'%s' could not be found" % path) document_root, path = os.path.split(absolute_path) return static.serve(request, path, document_root=document_root, **kwargs)