Refs #26601 -- Removed support for old-style middleware using settings.MIDDLEWARE_CLASSES.

django/conf/global_settings.py

@@ -447,12 +447,7 @@ SECURE_PROXY_SSL_HEADER = None
 # List of middleware to use. Order is important; in the request phase, these
 # middleware will be applied in the order given, and in the response
 # phase the middleware will be applied in reverse order.
-MIDDLEWARE_CLASSES = [
-    'django.middleware.common.CommonMiddleware',
-    'django.middleware.csrf.CsrfViewMiddleware',
-]
-
-MIDDLEWARE = None
+MIDDLEWARE = []
 
 ############
 # SESSIONS #

django/contrib/flatpages/forms.py

@@ -29,9 +29,8 @@ class FlatpageForm(forms.ModelForm):
                 ugettext("URL is missing a leading slash."),
                 code='missing_leading_slash',
             )
-        if (settings.APPEND_SLASH and (
-                (settings.MIDDLEWARE and 'django.middleware.common.CommonMiddleware' in settings.MIDDLEWARE) or
-                'django.middleware.common.CommonMiddleware' in settings.MIDDLEWARE_CLASSES) and
+        if (settings.APPEND_SLASH and
+                'django.middleware.common.CommonMiddleware' in settings.MIDDLEWARE and
                 not url.endswith('/')):
             raise forms.ValidationError(
                 ugettext("URL is missing a trailing slash."),

django/core/checks/compatibility/django_1_10.py

 from __future__ import unicode_literals
 
-from django.conf import global_settings, settings
+from django.conf import settings
 
 from .. import Tags, Warning, register
 
 
 @register(Tags.compatibility)
 def check_duplicate_middleware_settings(app_configs, **kwargs):
-    if settings.MIDDLEWARE is not None and settings.MIDDLEWARE_CLASSES != global_settings.MIDDLEWARE_CLASSES:
+    if settings.MIDDLEWARE is not None and hasattr(settings, 'MIDDLEWARE_CLASSES'):
         return [Warning(
             "The MIDDLEWARE_CLASSES setting is deprecated in Django 1.10 "
             "and the MIDDLEWARE setting takes precedence. Since you've set "

django/core/checks/security/base.py

 from django.conf import settings
 
 from .. import Tags, Warning, register
-from ..utils import patch_middleware_message
 
 SECRET_KEY_MIN_LENGTH = 50
 SECRET_KEY_MIN_UNIQUE_CHARACTERS = 5
@@ -109,25 +108,23 @@ W021 = Warning(
 
 
 def _security_middleware():
-    return ("django.middleware.security.SecurityMiddleware" in settings.MIDDLEWARE_CLASSES or
-            settings.MIDDLEWARE and "django.middleware.security.SecurityMiddleware" in settings.MIDDLEWARE)
+    return 'django.middleware.security.SecurityMiddleware' in settings.MIDDLEWARE
 
 
 def _xframe_middleware():
-    return ("django.middleware.clickjacking.XFrameOptionsMiddleware" in settings.MIDDLEWARE_CLASSES or
-            settings.MIDDLEWARE and "django.middleware.clickjacking.XFrameOptionsMiddleware" in settings.MIDDLEWARE)
+    return 'django.middleware.clickjacking.XFrameOptionsMiddleware' in settings.MIDDLEWARE
 
 
 @register(Tags.security, deploy=True)
 def check_security_middleware(app_configs, **kwargs):
     passed_check = _security_middleware()
-    return [] if passed_check else [patch_middleware_message(W001)]
+    return [] if passed_check else [W001]
 
 
 @register(Tags.security, deploy=True)
 def check_xframe_options_middleware(app_configs, **kwargs):
     passed_check = _xframe_middleware()
-    return [] if passed_check else [patch_middleware_message(W002)]
+    return [] if passed_check else [W002]
 
 
 @register(Tags.security, deploy=True)
@@ -205,7 +202,7 @@ def check_xframe_deny(app_configs, **kwargs):
         not _xframe_middleware() or
         settings.X_FRAME_OPTIONS == 'DENY'
     )
-    return [] if passed_check else [patch_middleware_message(W019)]
+    return [] if passed_check else [W019]
 
 
 @register(Tags.security, deploy=True)

django/core/checks/security/csrf.py

 from django.conf import settings
 
 from .. import Tags, Warning, register
-from ..utils import patch_middleware_message
 
 W003 = Warning(
     "You don't appear to be using Django's built-in "
@@ -22,14 +21,13 @@ W016 = Warning(
 
 
 def _csrf_middleware():
-    return ("django.middleware.csrf.CsrfViewMiddleware" in settings.MIDDLEWARE_CLASSES or
-            settings.MIDDLEWARE and "django.middleware.csrf.CsrfViewMiddleware" in settings.MIDDLEWARE)
+    return 'django.middleware.csrf.CsrfViewMiddleware' in settings.MIDDLEWARE
 
 
 @register(Tags.security, deploy=True)
 def check_csrf_middleware(app_configs, **kwargs):
     passed_check = _csrf_middleware()
-    return [] if passed_check else [patch_middleware_message(W003)]
+    return [] if passed_check else [W003]
 
 
 @register(Tags.security, deploy=True)
@@ -39,4 +37,4 @@ def check_csrf_cookie_secure(app_configs, **kwargs):
         not _csrf_middleware() or
         settings.CSRF_COOKIE_SECURE
     )
-    return [] if passed_check else [patch_middleware_message(W016)]
+    return [] if passed_check else [W016]

django/core/checks/security/sessions.py

 from django.conf import settings
 
 from .. import Tags, Warning, register
-from ..utils import patch_middleware_message
 
 
 def add_session_cookie_message(message):
@@ -71,7 +70,7 @@ def check_session_cookie_secure(app_configs, **kwargs):
         if _session_app():
             errors.append(W010)
         if _session_middleware():
-            errors.append(patch_middleware_message(W011))
+            errors.append(W011)
         if len(errors) > 1:
             errors = [W012]
     return errors
@@ -84,15 +83,14 @@ def check_session_cookie_httponly(app_configs, **kwargs):
         if _session_app():
             errors.append(W013)
         if _session_middleware():
-            errors.append(patch_middleware_message(W014))
+            errors.append(W014)
         if len(errors) > 1:
             errors = [W015]
     return errors
 
 
 def _session_middleware():
-    return ("django.contrib.sessions.middleware.SessionMiddleware" in settings.MIDDLEWARE_CLASSES or
-            settings.MIDDLEWARE and "django.contrib.sessions.middleware.SessionMiddleware" in settings.MIDDLEWARE)
+    return 'django.contrib.sessions.middleware.SessionMiddleware' in settings.MIDDLEWARE
 
 
 def _session_app():

django/core/checks/utils.py

-import copy
-
-from django.conf import settings
-
-
-def patch_middleware_message(error):
-    if settings.MIDDLEWARE is None:
-        error = copy.copy(error)
-        error.msg = error.msg.replace('MIDDLEWARE', 'MIDDLEWARE_CLASSES')
-    return error

django/core/handlers/base.py

 from __future__ import unicode_literals
 
 import logging
-import sys
 import types
-import warnings
 
 from django.conf import settings
-from django.core import signals
 from django.core.exceptions import ImproperlyConfigured, MiddlewareNotUsed
 from django.db import connections, transaction
-from django.urls import get_resolver, get_urlconf, set_urlconf
+from django.urls import get_resolver, set_urlconf
 from django.utils import six
-from django.utils.deprecation import RemovedInDjango20Warning
 from django.utils.module_loading import import_string
 
-from .exception import (
-    convert_exception_to_response, get_exception_response,
-    handle_uncaught_exception,
-)
+from .exception import convert_exception_to_response, get_exception_response
 
 logger = logging.getLogger('django.request')
 
@@ -34,8 +27,7 @@ class BaseHandler(object):
 
     def load_middleware(self):
         """
-        Populate middleware lists from settings.MIDDLEWARE (or the deprecated
-        MIDDLEWARE_CLASSES).
+        Populate middleware lists from settings.MIDDLEWARE.
 
         Must be called after the environment is fixed (see __call__ in subclasses).
         """
@@ -45,62 +37,32 @@ class BaseHandler(object):
         self._response_middleware = []
         self._exception_middleware = []
 
-        if settings.MIDDLEWARE is None:
-            warnings.warn(
-                "Old-style middleware using settings.MIDDLEWARE_CLASSES is "
-                "deprecated. Update your middleware and use settings.MIDDLEWARE "
-                "instead.", RemovedInDjango20Warning
-            )
-            handler = convert_exception_to_response(self._legacy_get_response)
-            for middleware_path in settings.MIDDLEWARE_CLASSES:
-                mw_class = import_string(middleware_path)
-                try:
-                    mw_instance = mw_class()
-                except MiddlewareNotUsed as exc:
-                    if settings.DEBUG:
-                        if six.text_type(exc):
-                            logger.debug('MiddlewareNotUsed(%r): %s', middleware_path, exc)
-                        else:
-                            logger.debug('MiddlewareNotUsed: %r', middleware_path)
-                    continue
-
-                if hasattr(mw_instance, 'process_request'):
-                    self._request_middleware.append(mw_instance.process_request)
-                if hasattr(mw_instance, 'process_view'):
-                    self._view_middleware.append(mw_instance.process_view)
-                if hasattr(mw_instance, 'process_template_response'):
-                    self._template_response_middleware.insert(0, mw_instance.process_template_response)
-                if hasattr(mw_instance, 'process_response'):
-                    self._response_middleware.insert(0, mw_instance.process_response)
-                if hasattr(mw_instance, 'process_exception'):
-                    self._exception_middleware.insert(0, mw_instance.process_exception)
-        else:
-            handler = convert_exception_to_response(self._get_response)
-            for middleware_path in reversed(settings.MIDDLEWARE):
-                middleware = import_string(middleware_path)
-                try:
-                    mw_instance = middleware(handler)
-                except MiddlewareNotUsed as exc:
-                    if settings.DEBUG:
-                        if six.text_type(exc):
-                            logger.debug('MiddlewareNotUsed(%r): %s', middleware_path, exc)
-                        else:
-                            logger.debug('MiddlewareNotUsed: %r', middleware_path)
-                    continue
-
-                if mw_instance is None:
-                    raise ImproperlyConfigured(
-                        'Middleware factory %s returned None.' % middleware_path
-                    )
-
-                if hasattr(mw_instance, 'process_view'):
-                    self._view_middleware.insert(0, mw_instance.process_view)
-                if hasattr(mw_instance, 'process_template_response'):
-                    self._template_response_middleware.append(mw_instance.process_template_response)
-                if hasattr(mw_instance, 'process_exception'):
-                    self._exception_middleware.append(mw_instance.process_exception)
-
-                handler = convert_exception_to_response(mw_instance)
+        handler = convert_exception_to_response(self._get_response)
+        for middleware_path in reversed(settings.MIDDLEWARE):
+            middleware = import_string(middleware_path)
+            try:
+                mw_instance = middleware(handler)
+            except MiddlewareNotUsed as exc:
+                if settings.DEBUG:
+                    if six.text_type(exc):
+                        logger.debug('MiddlewareNotUsed(%r): %s', middleware_path, exc)
+                    else:
+                        logger.debug('MiddlewareNotUsed: %r', middleware_path)
+                continue
+
+            if mw_instance is None:
+                raise ImproperlyConfigured(
+                    'Middleware factory %s returned None.' % middleware_path
+                )
+
+            if hasattr(mw_instance, 'process_view'):
+                self._view_middleware.insert(0, mw_instance.process_view)
+            if hasattr(mw_instance, 'process_template_response'):
+                self._template_response_middleware.append(mw_instance.process_template_response)
+            if hasattr(mw_instance, 'process_exception'):
+                self._exception_middleware.append(mw_instance.process_exception)
+
+            handler = convert_exception_to_response(mw_instance)
 
         # We only assign to this when initialization is complete as it is used
         # as a flag for initialization being complete.
@@ -123,22 +85,6 @@ class BaseHandler(object):
 
         response = self._middleware_chain(request)
 
-        # This block is only needed for legacy MIDDLEWARE_CLASSES; if
-        # MIDDLEWARE is used, self._response_middleware will be empty.
-        try:
-            # Apply response middleware, regardless of the response
-            for middleware_method in self._response_middleware:
-                response = middleware_method(request, response)
-                # Complain if the response middleware returned None (a common error).
-                if response is None:
-                    raise ValueError(
-                        "%s.process_response didn't return an "
-                        "HttpResponse object. It returned None instead."
-                        % (middleware_method.__self__.__class__.__name__))
-        except Exception:  # Any exception should be gathered and handled
-            signals.got_request_exception.send(sender=self.__class__, request=request)
-            response = self.handle_uncaught_exception(request, get_resolver(get_urlconf()), sys.exc_info())
-
         response._closable_objects.append(request)
 
         # If the exception handler returns a TemplateResponse that has not
@@ -228,23 +174,3 @@ class BaseHandler(object):
             if response:
                 return response
         raise
-
-    def handle_uncaught_exception(self, request, resolver, exc_info):
-        """Allow subclasses to override uncaught exception handling."""
-        return handle_uncaught_exception(request, resolver, exc_info)
-
-    def _legacy_get_response(self, request):
-        """
-        Apply process_request() middleware and call the main _get_response(),
-        if needed. Used only for legacy MIDDLEWARE_CLASSES.
-        """
-        response = None
-        # Apply request middleware
-        for middleware_method in self._request_middleware:
-            response = middleware_method(request)
-            if response:
-                break
-
-        if response is None:
-            response = self._get_response(request)
-        return response

django/views/debug.py

@@ -867,8 +867,8 @@ Python Version: {{ sys_version_info }}
 Installed Applications:
 {{ settings.INSTALLED_APPS|pprint }}
 Installed Middleware:
-{% if settings.MIDDLEWARE is not None %}{{ settings.MIDDLEWARE|pprint }}"""
-"""{% else %}{{ settings.MIDDLEWARE_CLASSES|pprint }}{% endif %}
+{{ settings.MIDDLEWARE|pprint }}"""
+"""
 
 {% if template_does_not_exist %}Template loader postmortem
 {% if postmortem %}Django tried loading these templates, in this order:
@@ -1075,8 +1075,8 @@ Server time: {{server_time|date:"r"}}
 Installed Applications:
 {{ settings.INSTALLED_APPS|pprint }}
 Installed Middleware:
-{% if settings.MIDDLEWARE is not None %}{{ settings.MIDDLEWARE|pprint }}"""
-"""{% else %}{{ settings.MIDDLEWARE_CLASSES|pprint }}{% endif %}
+{{ settings.MIDDLEWARE|pprint }}"""
+"""
 {% if template_does_not_exist %}Template loader postmortem
 {% if postmortem %}Django tried loading these templates, in this order:
 {% for entry in postmortem %}

docs/internals/deprecation.txt

@@ -571,7 +571,7 @@ details on these changes.
 
 * The ``SEND_BROKEN_LINK_EMAILS`` setting will be removed. Add the
   :class:`django.middleware.common.BrokenLinkEmailsMiddleware` middleware to
-  your :setting:`MIDDLEWARE_CLASSES` setting instead.
+  your ``MIDDLEWARE_CLASSES`` setting instead.
 
 * ``django.middleware.doc.XViewMiddleware`` will be removed. Use
   ``django.contrib.admindocs.middleware.XViewMiddleware`` instead.

docs/ref/checks.txt

@@ -323,19 +323,19 @@ The following checks are run if you use the :option:`check --deploy` option:
 
 * **security.W001**: You do not have
   :class:`django.middleware.security.SecurityMiddleware` in your
-  :setting:`MIDDLEWARE`/:setting:`MIDDLEWARE_CLASSES` so the :setting:`SECURE_HSTS_SECONDS`,
+  :setting:`MIDDLEWARE` so the :setting:`SECURE_HSTS_SECONDS`,
   :setting:`SECURE_CONTENT_TYPE_NOSNIFF`, :setting:`SECURE_BROWSER_XSS_FILTER`,
   and :setting:`SECURE_SSL_REDIRECT` settings will have no effect.
 * **security.W002**: You do not have
   :class:`django.middleware.clickjacking.XFrameOptionsMiddleware` in your
-  :setting:`MIDDLEWARE`/:setting:`MIDDLEWARE_CLASSES`, so your pages will not be served with an
+  :setting:`MIDDLEWARE`, so your pages will not be served with an
   ``'x-frame-options'`` header. Unless there is a good reason for your
   site to be served in a frame, you should consider enabling this
   header to help prevent clickjacking attacks.
 * **security.W003**: You don't appear to be using Django's built-in cross-site
   request forgery protection via the middleware
   (:class:`django.middleware.csrf.CsrfViewMiddleware` is not in your
-  :setting:`MIDDLEWARE`/:setting:`MIDDLEWARE_CLASSES`). Enabling the middleware is the safest
+  :setting:`MIDDLEWARE`). Enabling the middleware is the safest
   approach to ensure you don't leave any holes.
 * **security.W004**: You have not set a value for the
   :setting:`SECURE_HSTS_SECONDS` setting. If your entire site is served only
@@ -372,10 +372,9 @@ The following checks are run if you use the :option:`check --deploy` option:
   sessions.
 * **security.W011**: You have
   :class:`django.contrib.sessions.middleware.SessionMiddleware` in your
-  :setting:`MIDDLEWARE`/:setting:`MIDDLEWARE_CLASSES`, but you have not set
-  :setting:`SESSION_COOKIE_SECURE` to ``True``. Using a secure-only session
-  cookie makes it more difficult for network traffic sniffers to hijack user
-  sessions.
+  :setting:`MIDDLEWARE`, but you have not set :setting:`SESSION_COOKIE_SECURE`
+  to ``True``. Using a secure-only session cookie makes it more difficult for
+  network traffic sniffers to hijack user sessions.
 * **security.W012**: :setting:`SESSION_COOKIE_SECURE` is not set to ``True``.
   Using a secure-only session cookie makes it more difficult for network traffic
   sniffers to hijack user sessions.
@@ -386,10 +385,9 @@ The following checks are run if you use the :option:`check --deploy` option:
   sessions.
 * **security.W014**: You have
   :class:`django.contrib.sessions.middleware.SessionMiddleware` in your
-  :setting:`MIDDLEWARE`/:setting:`MIDDLEWARE_CLASSES`, but you have not set
-  :setting:`SESSION_COOKIE_HTTPONLY` to ``True``. Using an ``HttpOnly`` session
-  cookie makes it more difficult for cross-site scripting attacks to hijack user
-  sessions.
+  :setting:`MIDDLEWARE`, but you have not set :setting:`SESSION_COOKIE_HTTPONLY`
+  to ``True``. Using an ``HttpOnly`` session cookie makes it more difficult for
+  cross-site scripting attacks to hijack user sessions.
 * **security.W015**: :setting:`SESSION_COOKIE_HTTPONLY` is not set to ``True``.
   Using an ``HttpOnly`` session cookie makes it more difficult for cross-site
   scripting attacks to hijack user sessions.
@@ -405,7 +403,7 @@ The following checks are run if you use the :option:`check --deploy` option:
   deployment.
 * **security.W019**: You have
   :class:`django.middleware.clickjacking.XFrameOptionsMiddleware` in your
-  :setting:`MIDDLEWARE`/:setting:`MIDDLEWARE_CLASSES`, but :setting:`X_FRAME_OPTIONS` is not set to
+  :setting:`MIDDLEWARE`, but :setting:`X_FRAME_OPTIONS` is not set to
   ``'DENY'``. The default is ``'SAMEORIGIN'``, but unless there is a good reason
   for your site to serve other parts of itself in a frame, you should change
   it to ``'DENY'``.

docs/ref/settings.txt

@@ -9,9 +9,9 @@ Settings
 .. warning::
 
     Be careful when you override settings, especially when the default value
-    is a non-empty list or dictionary, such as :setting:`MIDDLEWARE_CLASSES`
-    and :setting:`STATICFILES_FINDERS`. Make sure you keep the components
-    required by the features of Django you wish to use.
+    is a non-empty list or dictionary, such as :setting:`STATICFILES_FINDERS`.
+    Make sure you keep the components required by the features of Django you
+    wish to use.
 
 Core Settings
 =============
@@ -1900,30 +1900,6 @@ Default:: ``None``
 
 A list of middleware to use. See :doc:`/topics/http/middleware`.
 
-.. setting:: MIDDLEWARE_CLASSES
-
-``MIDDLEWARE_CLASSES``
-----------------------
-
-.. deprecated:: 1.10
-
-    Old-style middleware that uses  ``settings.MIDDLEWARE_CLASSES`` are
-    deprecated. :ref:`Adapt old, custom middleware <upgrading-middleware>` and
-    use the :setting:`MIDDLEWARE` setting.
-
-Default::
-
-    [
-        'django.middleware.common.CommonMiddleware',
-        'django.middleware.csrf.CsrfViewMiddleware',
-    ]
-
-A list of middleware classes to use. This was the default setting used in
-Django 1.9 and earlier. Django 1.10 introduced a new style of middleware. If
-you have an older project using this setting you should :ref:`update any
-middleware you've written yourself <upgrading-middleware>` to the new style
-and then use the :setting:`MIDDLEWARE` setting.
-
 .. setting:: MIGRATION_MODULES
 
 ``MIGRATION_MODULES``
@@ -3411,7 +3387,6 @@ HTTP
 * :setting:`FORCE_SCRIPT_NAME`
 * :setting:`INTERNAL_IPS`
 * :setting:`MIDDLEWARE`
-* :setting:`MIDDLEWARE_CLASSES`
 * Security
 
   * :setting:`SECURE_BROWSER_XSS_FILTER`

docs/releases/1.2.txt

@@ -434,7 +434,7 @@ should be aware of:
      The upgrade notes have been removed in current Django docs. Please refer
      to the docs for Django 1.3 or older to find these instructions.
 
-* ``CsrfViewMiddleware`` is included in :setting:`MIDDLEWARE_CLASSES` by
+* ``CsrfViewMiddleware`` is included in ``MIDDLEWARE_CLASSES`` by
   default. This turns on CSRF protection by default, so views that accept
   POST requests need to be written to work with the middleware. Instructions
   on how to do this are found in the CSRF docs.

docs/releases/1.6.txt

@@ -1060,7 +1060,7 @@ out into a new middleware:
 
 If you're relying on this feature, you should add
 ``'django.middleware.common.BrokenLinkEmailsMiddleware'`` to your
-:setting:`MIDDLEWARE_CLASSES` setting and remove ``SEND_BROKEN_LINK_EMAILS``
+``MIDDLEWARE_CLASSES`` setting and remove ``SEND_BROKEN_LINK_EMAILS``
 from your settings.
 
 ``_has_changed`` method on widgets

docs/releases/1.7.txt

@@ -1271,13 +1271,13 @@ in a test class which is a subclass of
 :class:`~django.test.TransactionTestCase` rather than
 :class:`~django.test.TestCase`.
 
-Contrib middleware removed from default :setting:`MIDDLEWARE_CLASSES`
----------------------------------------------------------------------
+Contrib middleware removed from default ``MIDDLEWARE_CLASSES``
+--------------------------------------------------------------
 
 The :ref:`app-loading refactor <app-loading-refactor-17-release-note>`
 deprecated using models from apps which are not part of the
 :setting:`INSTALLED_APPS` setting. This exposed an incompatibility between
-the default :setting:`INSTALLED_APPS` and :setting:`MIDDLEWARE_CLASSES` in the
+the default :setting:`INSTALLED_APPS` and ``MIDDLEWARE_CLASSES`` in the
 global defaults (``django.conf.global_settings``). To bring these settings in
 sync and prevent deprecation warnings when doing things like testing reusable
 apps with minimal settings,
@@ -1287,7 +1287,7 @@ apps with minimal settings,
 from the defaults. These classes will still be included in the default settings
 generated by :djadmin:`startproject`. Most projects will not be affected by
 this change but if you were not previously declaring the
-:setting:`MIDDLEWARE_CLASSES` in your project settings and relying on the
+``MIDDLEWARE_CLASSES`` in your project settings and relying on the
 global default you should ensure that the new defaults are in line with your
 project's needs. You should also check for any code that accesses
 ``django.conf.global_settings.MIDDLEWARE_CLASSES`` directly.

docs/releases/1.8.txt

@@ -1641,7 +1641,7 @@ Using ``AuthenticationMiddleware`` without ``SessionAuthenticationMiddleware``
 added in Django 1.7. In Django 1.7.2, its functionality was moved to
 ``auth.get_user()`` and, for backwards compatibility, enabled only if
 ``'django.contrib.auth.middleware.SessionAuthenticationMiddleware'`` appears in
-:setting:`MIDDLEWARE_CLASSES`.
+``MIDDLEWARE_CLASSES``.
 
 In Django 1.10, session verification will be enabled regardless of whether or not
 ``SessionAuthenticationMiddleware`` is enabled (at which point

docs/releases/2.0.txt

@@ -390,3 +390,6 @@ these features.
 * Model ``Manager`` inheritance follows MRO inheritance rules. The requirement
   to use ``Meta.manager_inheritance_from_future`` to opt-in to the behavior is
   removed.
+
+* Support for old-style middleware using ``settings.MIDDLEWARE_CLASSES`` is
+  removed.

docs/topics/http/middleware.txt

@@ -16,16 +16,6 @@ how to write your own middleware. Django ships with some built-in middleware
 you can use right out of the box. They're documented in the :doc:`built-in
 middleware reference </ref/middleware>`.
 
-.. versionchanged:: 1.10
-
-    A new style of middleware was introduced for use with the new
-    :setting:`MIDDLEWARE` setting. If you're using the old
-    :setting:`MIDDLEWARE_CLASSES` setting, you'll need to :ref:`adapt old,
-    custom middleware <upgrading-middleware>` before using the new setting.
-    This document describes new-style middleware. Refer to this page in older
-    versions of the documentation for a description of how old-style middleware
-    works.
-
 Writing your own middleware
 ===========================
 
@@ -311,7 +301,7 @@ Upgrading pre-Django 1.10-style middleware
 
 Django provides ``django.utils.deprecation.MiddlewareMixin`` to ease creating
 middleware classes that are compatible with both :setting:`MIDDLEWARE` and the
-old :setting:`MIDDLEWARE_CLASSES`. All middleware classes included with Django
+old ``MIDDLEWARE_CLASSES``. All middleware classes included with Django
 are compatible with both settings.
 
 The mixin provides an ``__init__()`` method that accepts an optional
@@ -325,7 +315,7 @@ The ``__call__()`` method:
 #. Calls ``self.process_response(request, response)`` (if defined).
 #. Returns the response.
 
-If used with :setting:`MIDDLEWARE_CLASSES`, the ``__call__()`` method will
+If used with ``MIDDLEWARE_CLASSES``, the ``__call__()`` method will
 never be used; Django calls ``process_request()`` and ``process_response()``
 directly.
 
@@ -336,9 +326,9 @@ even beneficial to the existing middleware. In a few cases, a middleware class
 may need some changes to adjust to the new semantics.
 
 These are the behavioral differences between using :setting:`MIDDLEWARE` and
-:setting:`MIDDLEWARE_CLASSES`:
+``MIDDLEWARE_CLASSES``:
 
-1. Under :setting:`MIDDLEWARE_CLASSES`, every middleware will always have its
+1. Under ``MIDDLEWARE_CLASSES``, every middleware will always have its
    ``process_response`` method called, even if an earlier middleware
    short-circuited by returning a response from its ``process_request``
    method. Under :setting:`MIDDLEWARE`, middleware behaves more like an onion:
@@ -347,7 +337,7 @@ These are the behavioral differences between using :setting:`MIDDLEWARE` and
    that middleware and the ones before it in :setting:`MIDDLEWARE` will see the
    response.
 
-2. Under :setting:`MIDDLEWARE_CLASSES`, ``process_exception`` is applied to
+2. Under ``MIDDLEWARE_CLASSES``, ``process_exception`` is applied to
    exceptions raised from a middleware ``process_request`` method. Under
    :setting:`MIDDLEWARE`, ``process_exception`` applies only to exceptions
    raised from the view (or from the ``render`` method of a
@@ -355,7 +345,7 @@ These are the behavioral differences between using :setting:`MIDDLEWARE` and
    a middleware are converted to the appropriate HTTP response and then passed
    to the next middleware.
 
-3. Under :setting:`MIDDLEWARE_CLASSES`, if a ``process_response`` method raises
+3. Under ``MIDDLEWARE_CLASSES``, if a ``process_response`` method raises
    an exception, the ``process_response`` methods of all earlier middleware are
    skipped and a ``500 Internal Server Error`` HTTP response is always
    returned (even if the exception raised was e.g. an

tests/auth_tests/test_context_processors.py

@@ -4,8 +4,6 @@ from django.contrib.auth.models import Permission, User
 from django.contrib.contenttypes.models import ContentType
 from django.db.models import Q
 from django.test import SimpleTestCase, TestCase, override_settings
-from django.test.utils import ignore_warnings
-from django.utils.deprecation import RemovedInDjango20Warning
 
 from .settings import AUTH_MIDDLEWARE, AUTH_TEMPLATES
 
@@ -78,12 +76,6 @@ class AuthContextProcessorTests(TestCase):
         response = self.client.get('/auth_processor_no_attr_access/')
         self.assertContains(response, "Session not accessed")
 
-    @ignore_warnings(category=RemovedInDjango20Warning)
-    @override_settings(MIDDLEWARE_CLASSES=AUTH_MIDDLEWARE, MIDDLEWARE=None)
-    def test_session_not_accessed_middleware_classes(self):
-        response = self.client.get('/auth_processor_no_attr_access/')
-        self.assertContains(response, "Session not accessed")
-
     @override_settings(MIDDLEWARE=AUTH_MIDDLEWARE)
     def test_session_is_accessed(self):
         """
@@ -93,12 +85,6 @@ class AuthContextProcessorTests(TestCase):
         response = self.client.get('/auth_processor_attr_access/')
         self.assertContains(response, "Session accessed")
 
-    @ignore_warnings(category=RemovedInDjango20Warning)
-    @override_settings(MIDDLEWARE_CLASSES=AUTH_MIDDLEWARE, MIDDLEWARE=None)
-    def test_session_is_accessed_middleware_classes(self):
-        response = self.client.get('/auth_processor_attr_access/')
-        self.assertContains(response, "Session accessed")
-
     def test_perms_attrs(self):
         u = User.objects.create_user(username='normal', password='secret')
         u.user_permissions.add(

tests/auth_tests/test_remote_user.py

@@ -6,9 +6,7 @@ from django.contrib.auth.backends import RemoteUserBackend
 from django.contrib.auth.middleware import RemoteUserMiddleware
 from django.contrib.auth.models import User
 from django.test import TestCase, modify_settings, override_settings
-from django.test.utils import ignore_warnings
 from django.utils import timezone
-from django.utils.deprecation import RemovedInDjango20Warning
 
 
 @override_settings(ROOT_URLCONF='auth_tests.urls')
@@ -153,22 +151,6 @@ class RemoteUserTest(TestCase):
         self.assertTrue(response.context['user'].is_anonymous)
 
 
-@ignore_warnings(category=RemovedInDjango20Warning)
-@override_settings(MIDDLEWARE=None)
-class RemoteUserTestMiddlewareClasses(RemoteUserTest):
-
-    def setUp(self):
-        self.patched_settings = modify_settings(
-            AUTHENTICATION_BACKENDS={'append': self.backend},
-            MIDDLEWARE_CLASSES={'append': [
-                'django.contrib.sessions.middleware.SessionMiddleware',
-                'django.contrib.auth.middleware.AuthenticationMiddleware',
-                self.middleware,
-            ]},
-        )
-        self.patched_settings.enable()
-
-
 class RemoteUserNoCreateBackend(RemoteUserBackend):
     """Backend that doesn't create unknown users."""
     create_unknown_user = False

tests/check_framework/test_security.py

 from django.conf import settings
 from django.core.checks.security import base, csrf, sessions
-from django.core.checks.utils import patch_middleware_message
 from django.test import SimpleTestCase
 from django.test.utils import override_settings
 
@@ -22,14 +21,6 @@ class CheckSessionCookieSecureTest(SimpleTestCase):
         """
         self.assertEqual(self.func(None), [sessions.W010])
 
-    @override_settings(
-        SESSION_COOKIE_SECURE=False,
-        INSTALLED_APPS=["django.contrib.sessions"],
-        MIDDLEWARE=None,
-        MIDDLEWARE_CLASSES=[])
-    def test_session_cookie_secure_with_installed_app_middleware_classes(self):
-        self.assertEqual(self.func(None), [sessions.W010])
-
     @override_settings(
         SESSION_COOKIE_SECURE=False,
         INSTALLED_APPS=[],
@@ -42,14 +33,6 @@ class CheckSessionCookieSecureTest(SimpleTestCase):
         """
         self.assertEqual(self.func(None), [sessions.W011])
 
-    @override_settings(
-        SESSION_COOKIE_SECURE=False,
-        INSTALLED_APPS=[],
-        MIDDLEWARE=None,
-        MIDDLEWARE_CLASSES=["django.contrib.sessions.middleware.SessionMiddleware"])
-    def test_session_cookie_secure_with_middleware_middleware_classes(self):
-        self.assertEqual(self.func(None), [patch_middleware_message(sessions.W011)])
-
     @override_settings(
         SESSION_COOKIE_SECURE=False,
         INSTALLED_APPS=["django.contrib.sessions"],
@@ -61,14 +44,6 @@ class CheckSessionCookieSecureTest(SimpleTestCase):
         """
         self.assertEqual(self.func(None), [sessions.W012])
 
-    @override_settings(
-        SESSION_COOKIE_SECURE=False,
-        INSTALLED_APPS=["django.contrib.sessions"],
-        MIDDLEWARE=None,
-        MIDDLEWARE_CLASSES=["django.contrib.sessions.middleware.SessionMiddleware"])
-    def test_session_cookie_secure_both_middleware_classes(self):
-        self.assertEqual(self.func(None), [sessions.W012])
-
     @override_settings(
         SESSION_COOKIE_SECURE=True,
         INSTALLED_APPS=["django.contrib.sessions"],
@@ -137,7 +112,7 @@ class CheckCSRFMiddlewareTest(SimpleTestCase):
         from django.core.checks.security.csrf import check_csrf_middleware
         return check_csrf_middleware
 
-    @override_settings(MIDDLEWARE=[], MIDDLEWARE_CLASSES=[])
+    @override_settings(MIDDLEWARE=[])
     def test_no_csrf_middleware(self):
         """
         Warn if CsrfViewMiddleware isn't in MIDDLEWARE.
@@ -177,7 +152,7 @@ class CheckCSRFCookieSecureTest(SimpleTestCase):
         """
         self.assertEqual(self.func(None), [])
 
-    @override_settings(MIDDLEWARE=[], MIDDLEWARE_CLASSES=[], CSRF_COOKIE_SECURE=False)
+    @override_settings(MIDDLEWARE=[], CSRF_COOKIE_SECURE=False)
     def test_with_csrf_cookie_secure_false_no_middleware(self):
         """
         No warning if CsrfViewMiddleware isn't in MIDDLEWARE, even if

tests/flatpages_tests/test_csrf.py

@@ -2,8 +2,6 @@ from django.contrib.auth.models import User
 from django.contrib.flatpages.models import FlatPage
 from django.contrib.sites.models import Site
 from django.test import Client, TestCase, modify_settings, override_settings
-from django.test.utils import ignore_warnings
-from django.utils.deprecation import RemovedInDjango20Warning
 
 from .settings import FLATPAGES_TEMPLATES
 
@@ -99,19 +97,3 @@ class FlatpageCSRFTests(TestCase):
         "POSTing to an unknown page isn't caught as a 403 CSRF error"
         response = self.client.post('/no_such_page/')
         self.assertEqual(response.status_code, 404)
-
-
-@ignore_warnings(category=RemovedInDjango20Warning)
-@override_settings(
-    MIDDLEWARE=None,
-    MIDDLEWARE_CLASSES=[
-        'django.middleware.common.CommonMiddleware',
-        'django.contrib.sessions.middleware.SessionMiddleware',
-        'django.middleware.csrf.CsrfViewMiddleware',
-        'django.contrib.auth.middleware.AuthenticationMiddleware',
-        'django.contrib.messages.middleware.MessageMiddleware',
-        'django.contrib.flatpages.middleware.FlatpageFallbackMiddleware',
-    ],
-)
-class FlatpageCSRFMiddlewareClassesTests(FlatpageCSRFTests):
-    pass

tests/flatpages_tests/test_forms.py

@@ -59,24 +59,6 @@ class FlatpageAdminFormTests(TestCase):
         form = FlatpageForm(data=dict(url='/no_trailing_slash', **self.form_data))
         self.assertTrue(form.is_valid())
 
-    @override_settings(
-        APPEND_SLASH=True, MIDDLEWARE=None,
-        MIDDLEWARE_CLASSES=['django.middleware.common.CommonMiddleware'],
-    )
-    def test_flatpage_requires_trailing_slash_with_append_slash_middleware_classes(self):
-        form = FlatpageForm(data=dict(url='/no_trailing_slash', **self.form_data))
-        with translation.override('en'):
-            self.assertFalse(form.is_valid())
-            self.assertEqual(form.errors['url'], ["URL is missing a trailing slash."])
-
-    @override_settings(
-        APPEND_SLASH=False, MIDDLEWARE=None,
-        MIDDLEWARE_CLASSES=['django.middleware.common.CommonMiddleware'],
-    )
-    def test_flatpage_doesnt_requires_trailing_slash_without_append_slash_middleware_classes(self):
-        form = FlatpageForm(data=dict(url='/no_trailing_slash', **self.form_data))
-        self.assertTrue(form.is_valid())
-
     def test_flatpage_admin_form_url_uniqueness_validation(self):
         "The flatpage admin form correctly enforces url uniqueness among flatpages of the same site"
         data = dict(url='/myflatpage1/', **self.form_data)

tests/flatpages_tests/test_middleware.py

@@ -3,8 +3,6 @@ from django.contrib.auth.models import User
 from django.contrib.flatpages.models import FlatPage
 from django.contrib.sites.models import Site
 from django.test import TestCase, modify_settings, override_settings
-from django.test.utils import ignore_warnings
-from django.utils.deprecation import RemovedInDjango20Warning
 
 from .settings import FLATPAGES_TEMPLATES
 
@@ -109,22 +107,6 @@ class FlatpageMiddlewareTests(TestDataMixin, TestCase):
         self.assertContains(response, "<p>Isn't it special!</p>")
 
 
-@ignore_warnings(category=RemovedInDjango20Warning)
-@override_settings(
-    MIDDLEWARE=None,
-    MIDDLEWARE_CLASSES=[
-        'django.middleware.common.CommonMiddleware',
-        'django.contrib.sessions.middleware.SessionMiddleware',
-        'django.middleware.csrf.CsrfViewMiddleware',
-        'django.contrib.auth.middleware.AuthenticationMiddleware',
-        'django.contrib.messages.middleware.MessageMiddleware',
-        'django.contrib.flatpages.middleware.FlatpageFallbackMiddleware',
-    ],
-)
-class FlatpageMiddlewareClassesTests(FlatpageMiddlewareTests):
-    pass
-
-
 @modify_settings(INSTALLED_APPS={'append': 'django.contrib.flatpages'})
 @override_settings(
     APPEND_SLASH=True,
@@ -190,19 +172,3 @@ class FlatpageMiddlewareAppendSlashTests(TestDataMixin, TestCase):
 
         response = self.client.get('/')
         self.assertContains(response, "<p>Root</p>")
-
-
-@ignore_warnings(category=RemovedInDjango20Warning)
-@override_settings(
-    MIDDLEWARE=None,
-    MIDDLEWARE_CLASSES=[
-        'django.middleware.common.CommonMiddleware',
-        'django.contrib.sessions.middleware.SessionMiddleware',
-        'django.middleware.csrf.CsrfViewMiddleware',
-        'django.contrib.auth.middleware.AuthenticationMiddleware',
-        'django.contrib.messages.middleware.MessageMiddleware',
-        'django.contrib.flatpages.middleware.FlatpageFallbackMiddleware',
-    ],
-)
-class FlatpageAppendSlashMiddlewareClassesTests(FlatpageMiddlewareAppendSlashTests):
-    pass

tests/redirects_tests/tests.py

@@ -5,9 +5,7 @@ from django.contrib.redirects.models import Redirect
 from django.contrib.sites.models import Site
 from django.core.exceptions import ImproperlyConfigured
 from django.test import TestCase, modify_settings, override_settings
-from django.test.utils import ignore_warnings
 from django.utils import six
-from django.utils.deprecation import RemovedInDjango20Warning
 
 
 @modify_settings(MIDDLEWARE={'append': 'django.contrib.redirects.middleware.RedirectFallbackMiddleware'})
@@ -44,20 +42,6 @@ class RedirectTests(TestCase):
         response = self.client.get('/initial')
         self.assertEqual(response.status_code, 410)
 
-    @ignore_warnings(category=RemovedInDjango20Warning)
-    @override_settings(MIDDLEWARE=None)
-    @modify_settings(MIDDLEWARE_CLASSES={'append': 'django.contrib.redirects.middleware.RedirectFallbackMiddleware'})
-    def test_redirect_middleware_classes(self):
-        self.test_redirect()
-
-    @ignore_warnings(category=RemovedInDjango20Warning)
-    @override_settings(MIDDLEWARE=None)
-    @modify_settings(MIDDLEWARE_CLASSES={'append': 'django.contrib.redirects.middleware.RedirectFallbackMiddleware'})
-    def test_more_redirects_middleware_classes(self):
-        self.test_redirect_with_append_slash()
-        self.test_redirect_with_append_slash_and_query_string()
-        self.test_response_gone()
-
     @modify_settings(INSTALLED_APPS={'remove': 'django.contrib.sites'})
     def test_sites_not_installed(self):
         with self.assertRaises(ImproperlyConfigured):

tests/template_tests/test_response.py

@@ -11,8 +11,8 @@ from django.template.response import (
 from django.test import (
     RequestFactory, SimpleTestCase, modify_settings, override_settings,
 )
-from django.test.utils import ignore_warnings, require_jinja2
-from django.utils.deprecation import MiddlewareMixin, RemovedInDjango20Warning
+from django.test.utils import require_jinja2
+from django.utils.deprecation import MiddlewareMixin
 
 from .utils import TEMPLATE_DIR
 
@@ -362,34 +362,3 @@ class CacheMiddlewareTest(SimpleTestCase):
         self.assertEqual(response2.status_code, 200)
 
         self.assertNotEqual(response.content, response2.content)
-
-
-@ignore_warnings(category=RemovedInDjango20Warning)
-@override_settings(
-    MIDDLEWARE=None,
-    MIDDLEWARE_CLASSES=[
-        'django.middleware.cache.FetchFromCacheMiddleware',
-        'django.middleware.cache.UpdateCacheMiddleware',
-    ],
-    CACHE_MIDDLEWARE_SECONDS=2.0,
-    ROOT_URLCONF='template_tests.alternate_urls'
-)
-class CacheMiddlewareClassesTest(SimpleTestCase):
-    def test_middleware_caching(self):
-        response = self.client.get('/template_response_view/')
-        self.assertEqual(response.status_code, 200)
-
-        time.sleep(1.0)
-
-        response2 = self.client.get('/template_response_view/')
-        self.assertEqual(response2.status_code, 200)
-
-        self.assertEqual(response.content, response2.content)
-
-        time.sleep(2.0)
-
-        # Let the cache expire and test again
-        response2 = self.client.get('/template_response_view/')
-        self.assertEqual(response2.status_code, 200)
-
-        self.assertNotEqual(response.content, response2.content)

tests/view_tests/tests/test_csrf.py

@@ -2,8 +2,6 @@ from django.template import TemplateDoesNotExist
 from django.test import (
     Client, RequestFactory, SimpleTestCase, override_settings,
 )
-from django.test.utils import ignore_warnings
-from django.utils.deprecation import RemovedInDjango20Warning
 from django.utils.translation import override
 from django.views.csrf import CSRF_FAILURE_TEMPLATE_NAME, csrf_failure
 
@@ -40,33 +38,6 @@ class CsrfViewTests(SimpleTestCase):
                                 "CSRF-verificatie mislukt. Verzoek afgebroken.",
                                 status_code=403)
 
-    @ignore_warnings(category=RemovedInDjango20Warning)
-    @override_settings(
-        USE_I18N=True,
-        MIDDLEWARE=None,
-        MIDDLEWARE_CLASSES=[
-            'django.middleware.locale.LocaleMiddleware',
-            'django.middleware.common.CommonMiddleware',
-            'django.middleware.csrf.CsrfViewMiddleware',
-        ],
-    )
-    def test_translation_middleware_classes(self):
-        """
-        An invalid request is rejected with a localized error message.
-        """
-        response = self.client.post('/')
-        self.assertContains(response, "Forbidden", status_code=403)
-        self.assertContains(response,
-                            "CSRF verification failed. Request aborted.",
-                            status_code=403)
-
-        with self.settings(LANGUAGE_CODE='nl'), override('en-us'):
-            response = self.client.post('/')
-            self.assertContains(response, "Verboden", status_code=403)
-            self.assertContains(response,
-                                "CSRF-verificatie mislukt. Verzoek afgebroken.",
-                                status_code=403)
-
     @override_settings(
         SECURE_PROXY_SSL_HEADER=('HTTP_X_FORWARDED_PROTO', 'https')
     )

tests/view_tests/tests/test_i18n.py

@@ -10,11 +10,9 @@ from django.test import (
     SimpleTestCase, TestCase, modify_settings, override_settings,
 )
 from django.test.selenium import SeleniumTestCase
-from django.test.utils import ignore_warnings
 from django.urls import reverse
 from django.utils import six
 from django.utils._os import upath
-from django.utils.deprecation import RemovedInDjango20Warning
 from django.utils.translation import (
     LANGUAGE_SESSION_KEY, get_language, override,
 )
@@ -157,27 +155,6 @@ class I18NTests(TestCase):
             self.assertEqual(language_cookie['path'], '/test/')
             self.assertEqual(language_cookie['max-age'], 3600 * 7 * 2)
 
-    @ignore_warnings(category=RemovedInDjango20Warning)
-    def test_setlang_cookie_middleware_classes(self):
-        # we force saving language to a cookie rather than a session
-        # by excluding session middleware and those which do require it
-        test_settings = dict(
-            MIDDLEWARE=None,
-            MIDDLEWARE_CLASSES=['django.middleware.common.CommonMiddleware'],
-            LANGUAGE_COOKIE_NAME='mylanguage',
-            LANGUAGE_COOKIE_AGE=3600 * 7 * 2,
-            LANGUAGE_COOKIE_DOMAIN='.example.com',
-            LANGUAGE_COOKIE_PATH='/test/',
-        )
-        with self.settings(**test_settings):
-            post_data = dict(language='pl', next='/views/')
-            response = self.client.post('/i18n/setlang/', data=post_data)
-            language_cookie = response.cookies.get('mylanguage')
-            self.assertEqual(language_cookie.value, 'pl')
-            self.assertEqual(language_cookie['domain'], '.example.com')
-            self.assertEqual(language_cookie['path'], '/test/')
-            self.assertEqual(language_cookie['max-age'], 3600 * 7 * 2)
-
     def test_setlang_decodes_http_referer_url(self):
         """
         The set_language view decodes the HTTP_REFERER URL.
@@ -207,28 +184,6 @@ class I18NTests(TestCase):
         )
         self.assertRedirects(response, '/en/translated/')
 
-    @ignore_warnings(category=RemovedInDjango20Warning)
-    @override_settings(
-        MIDDLEWARE=None,
-        MIDDLEWARE_CLASSES=[
-            'django.contrib.sessions.middleware.SessionMiddleware',
-            'django.middleware.locale.LocaleMiddleware',
-        ],
-    )
-    def test_lang_from_translated_i18n_pattern_middleware_classes(self):
-        response = self.client.post(
-            '/i18n/setlang/', data={'language': 'nl'},
-            follow=True, HTTP_REFERER='/en/translated/'
-        )
-        self.assertEqual(self.client.session[LANGUAGE_SESSION_KEY], 'nl')
-        self.assertRedirects(response, '/nl/vertaald/')
-        # And reverse
-        response = self.client.post(
-            '/i18n/setlang/', data={'language': 'en'},
-            follow=True, HTTP_REFERER='/nl/vertaald/'
-        )
-        self.assertRedirects(response, '/en/translated/')
-
 
 @override_settings(ROOT_URLCONF='view_tests.urls')
 class JsI18NTests(SimpleTestCase):