Skip to content
Projeler
Gruplar
Parçacıklar
Yardım
Yükleniyor...
Oturum aç / Kaydol
Gezinmeyi değiştir
D
django
Proje
Proje
Ayrıntılar
Etkinlik
Cycle Analytics
Depo (repository)
Depo (repository)
Dosyalar
Kayıtlar (commit)
Dallar (branch)
Etiketler
Katkıda bulunanlar
Grafik
Karşılaştır
Grafikler
Konular (issue)
0
Konular (issue)
0
Liste
Pano
Etiketler
Kilometre Taşları
Birleştirme (merge) Talepleri
0
Birleştirme (merge) Talepleri
0
CI / CD
CI / CD
İş akışları (pipeline)
İşler
Zamanlamalar
Grafikler
Paketler
Paketler
Wiki
Wiki
Parçacıklar
Parçacıklar
Üyeler
Üyeler
Collapse sidebar
Close sidebar
Etkinlik
Grafik
Grafikler
Yeni bir konu (issue) oluştur
İşler
Kayıtlar (commit)
Konu (issue) Panoları
Kenar çubuğunu aç
Batuhan Osman TASKAYA
django
Commits
c5185172
Kaydet (Commit)
c5185172
authored
May 15, 2014
tarafından
Tim Graham
Dosyalara gözat
Seçenekler
Dosyalara Gözat
İndir
Eposta Yamaları
Sade Fark
[1.7.x] Minor edits to latest release notes.
Backport of
860d31ac
from master
üst
2914f669
Hide whitespace changes
Inline
Side-by-side
Showing
3 changed files
with
24 additions
and
23 deletions
+24
-23
1.4.13.txt
docs/releases/1.4.13.txt
+9
-9
1.5.8.txt
docs/releases/1.5.8.txt
+8
-8
1.6.5.txt
docs/releases/1.6.5.txt
+7
-6
No files found.
docs/releases/1.4.13.txt
Dosyayı görüntüle @
c5185172
==========================
==========================
=
Django 1.4.13 release notes
==========================
==========================
=
*May 1
3
, 2014*
*May 1
4
, 2014*
Django 1.4.13 fixes two security issues in 1.4.12.
Caches may incorrectly be allowed to store and serve private data
=================================================================
In certain situations, Django may allow caches to store private data
related to a particular session and then serve that data to requests
with a different session, or no session at all. This can
both
lead to
information disclosure
,
and can be a vector for cache poisoning.
with a different session, or no session at all. This can lead to
information disclosure and can be a vector for cache poisoning.
When using Django sessions, Django will set a ``Vary: Cookie`` header to
ensure caches do not serve cached data to requests from other sessions.
...
...
@@ -22,15 +22,15 @@ Explorer 6, and Internet Explorer 7 if run on Windows XP or Windows Server
types. Therefore, Django would remove the header if the request was made by
Internet Explorer.
To remedy this, the special behavio
u
r for these older Internet Explorer versions
To remedy this, the special behavior for these older Internet Explorer versions
has been removed, and the ``Vary`` header is no longer stripped from the response.
In addition, modifications to the ``Cache-Control`` header for all Internet Explorer
requests with a ``Content-Disposition`` header
,
have also been removed as they
requests with a ``Content-Disposition`` header have also been removed as they
were found to have similar issues.
Malformed redirect URLs from user input not correctly validated
===============================================================
The validation for redirects did not correctly validate some malformed URLs,
which are accepted by some browsers. This allows a user to be redirected to
an unsafe URL unexpectedly.
...
...
docs/releases/1.5.8.txt
Dosyayı görüntüle @
c5185172
...
...
@@ -2,17 +2,17 @@
Django 1.5.8 release notes
==========================
*May 13, 2014*
Django 1.5.8 fixes two security issues in 1.5.8.
*May 14, 2014*
Django 1.5.8 fixes two security issues in 1.5.8.
Caches may incorrectly be allowed to store and serve private data
=================================================================
In certain situations, Django may allow caches to store private data
related to a particular session and then serve that data to requests
with a different session, or no session at all. This can
both
lead to
information disclosure
,
and can be a vector for cache poisoning.
with a different session, or no session at all. This can lead to
information disclosure and can be a vector for cache poisoning.
When using Django sessions, Django will set a ``Vary: Cookie`` header to
ensure caches do not serve cached data to requests from other sessions.
...
...
@@ -22,15 +22,15 @@ Explorer 6, and Internet Explorer 7 if run on Windows XP or Windows Server
types. Therefore, Django would remove the header if the request was made by
Internet Explorer.
To remedy this, the special behavio
u
r for these older Internet Explorer versions
To remedy this, the special behavior for these older Internet Explorer versions
has been removed, and the ``Vary`` header is no longer stripped from the response.
In addition, modifications to the ``Cache-Control`` header for all Internet Explorer
requests with a ``Content-Disposition`` header
,
have also been removed as they
requests with a ``Content-Disposition`` header have also been removed as they
were found to have similar issues.
Malformed redirect URLs from user input not correctly validated
===============================================================
The validation for redirects did not correctly validate some malformed URLs,
which are accepted by some browsers. This allows a user to be redirected to
an unsafe URL unexpectedly.
...
...
docs/releases/1.6.5.txt
Dosyayı görüntüle @
c5185172
...
...
@@ -4,14 +4,15 @@ Django 1.6.5 release notes
*May 14, 2014*
Django 1.6.5 fixes two security issues and several
several
bugs in 1.6.4.
Django 1.6.5 fixes two security issues and several bugs in 1.6.4.
Issue: Caches may incorrectly be allowed to store and serve private data
========================================================================
In certain situations, Django may allow caches to store private data
related to a particular session and then serve that data to requests
with a different session, or no session at all. This can
both
lead to
information disclosure
,
and can be a vector for cache poisoning.
with a different session, or no session at all. This can lead to
information disclosure and can be a vector for cache poisoning.
When using Django sessions, Django will set a ``Vary: Cookie`` header to
ensure caches do not serve cached data to requests from other sessions.
...
...
@@ -21,15 +22,15 @@ Explorer 6, and Internet Explorer 7 if run on Windows XP or Windows Server
types. Therefore, Django would remove the header if the request was made by
Internet Explorer.
To remedy this, the special behavio
u
r for these older Internet Explorer versions
To remedy this, the special behavior for these older Internet Explorer versions
has been removed, and the ``Vary`` header is no longer stripped from the response.
In addition, modifications to the ``Cache-Control`` header for all Internet Explorer
requests with a ``Content-Disposition`` header
,
have also been removed as they
requests with a ``Content-Disposition`` header have also been removed as they
were found to have similar issues.
Issue: Malformed redirect URLs from user input not correctly validated
======================================================================
The validation for redirects did not correctly validate some malformed URLs,
which are accepted by some browsers. This allows a user to be redirected to
an unsafe URL unexpectedly.
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment