Skip to content
Projeler
Gruplar
Parçacıklar
Yardım
Yükleniyor...
Oturum aç / Kaydol
Gezinmeyi değiştir
D
django
Proje
Proje
Ayrıntılar
Etkinlik
Cycle Analytics
Depo (repository)
Depo (repository)
Dosyalar
Kayıtlar (commit)
Dallar (branch)
Etiketler
Katkıda bulunanlar
Grafik
Karşılaştır
Grafikler
Konular (issue)
0
Konular (issue)
0
Liste
Pano
Etiketler
Kilometre Taşları
Birleştirme (merge) Talepleri
0
Birleştirme (merge) Talepleri
0
CI / CD
CI / CD
İş akışları (pipeline)
İşler
Zamanlamalar
Grafikler
Paketler
Paketler
Wiki
Wiki
Parçacıklar
Parçacıklar
Üyeler
Üyeler
Collapse sidebar
Close sidebar
Etkinlik
Grafik
Grafikler
Yeni bir konu (issue) oluştur
İşler
Kayıtlar (commit)
Konu (issue) Panoları
Kenar çubuğunu aç
Batuhan Osman TASKAYA
django
Commits
dd0b4878
Kaydet (Commit)
dd0b4878
authored
Şub 20, 2015
tarafından
Tim Graham
Dosyalara gözat
Seçenekler
Dosyalara Gözat
İndir
Eposta Yamaları
Sade Fark
Fixed typo in path to is_safe_url()
üst
d28bcba2
Hide whitespace changes
Inline
Side-by-side
Showing
8 changed files
with
8 additions
and
8 deletions
+8
-8
1.4.13.txt
docs/releases/1.4.13.txt
+1
-1
1.4.18.txt
docs/releases/1.4.18.txt
+1
-1
1.4.6.txt
docs/releases/1.4.6.txt
+1
-1
1.5.2.txt
docs/releases/1.5.2.txt
+1
-1
1.5.8.txt
docs/releases/1.5.8.txt
+1
-1
1.6.10.txt
docs/releases/1.6.10.txt
+1
-1
1.6.5.txt
docs/releases/1.6.5.txt
+1
-1
1.7.3.txt
docs/releases/1.7.3.txt
+1
-1
No files found.
docs/releases/1.4.13.txt
Dosyayı görüntüle @
dd0b4878
...
@@ -39,7 +39,7 @@ Django relies on user input in some cases (e.g.
...
@@ -39,7 +39,7 @@ Django relies on user input in some cases (e.g.
:func:`django.contrib.auth.views.login`, ``django.contrib.comments``, and
:func:`django.contrib.auth.views.login`, ``django.contrib.comments``, and
:doc:`i18n </topics/i18n/index>`) to redirect the user to an "on success" URL.
:doc:`i18n </topics/i18n/index>`) to redirect the user to an "on success" URL.
The security checks for these redirects (namely
The security checks for these redirects (namely
``django.util.http.is_safe_url()``) did not correctly validate some malformed
``django.util
s
.http.is_safe_url()``) did not correctly validate some malformed
URLs, such as `http:\\\\\\djangoproject.com`, which are accepted by some browsers
URLs, such as `http:\\\\\\djangoproject.com`, which are accepted by some browsers
with more liberal URL parsing.
with more liberal URL parsing.
...
...
docs/releases/1.4.18.txt
Dosyayı görüntüle @
dd0b4878
...
@@ -37,7 +37,7 @@ Mitigated possible XSS attack via user-supplied redirect URLs
...
@@ -37,7 +37,7 @@ Mitigated possible XSS attack via user-supplied redirect URLs
Django relies on user input in some cases (e.g.
Django relies on user input in some cases (e.g.
:func:`django.contrib.auth.views.login` and :doc:`i18n </topics/i18n/index>`)
:func:`django.contrib.auth.views.login` and :doc:`i18n </topics/i18n/index>`)
to redirect the user to an "on success" URL. The security checks for these
to redirect the user to an "on success" URL. The security checks for these
redirects (namely ``django.util.http.is_safe_url()``) didn't strip leading
redirects (namely ``django.util
s
.http.is_safe_url()``) didn't strip leading
whitespace on the tested URL and as such considered URLs like
whitespace on the tested URL and as such considered URLs like
``\njavascript:...`` safe. If a developer relied on ``is_safe_url()`` to
``\njavascript:...`` safe. If a developer relied on ``is_safe_url()`` to
provide safe redirect targets and put such a URL into a link, they could suffer
provide safe redirect targets and put such a URL into a link, they could suffer
...
...
docs/releases/1.4.6.txt
Dosyayı görüntüle @
dd0b4878
...
@@ -16,7 +16,7 @@ Django relies on user input in some cases (e.g.
...
@@ -16,7 +16,7 @@ Django relies on user input in some cases (e.g.
:func:`django.contrib.auth.views.login`, ``django.contrib.comments``, and
:func:`django.contrib.auth.views.login`, ``django.contrib.comments``, and
:doc:`i18n </topics/i18n/index>`) to redirect the user to an "on success" URL.
:doc:`i18n </topics/i18n/index>`) to redirect the user to an "on success" URL.
The security checks for these redirects (namely
The security checks for these redirects (namely
``django.util.http.is_safe_url()``) didn't check if the scheme is ``http(s)``
``django.util
s
.http.is_safe_url()``) didn't check if the scheme is ``http(s)``
and as such allowed ``javascript:...`` URLs to be entered. If a developer
and as such allowed ``javascript:...`` URLs to be entered. If a developer
relied on ``is_safe_url()`` to provide safe redirect targets and put such a
relied on ``is_safe_url()`` to provide safe redirect targets and put such a
URL into a link, they could suffer from a XSS attack. This bug doesn't affect
URL into a link, they could suffer from a XSS attack. This bug doesn't affect
...
...
docs/releases/1.5.2.txt
Dosyayı görüntüle @
dd0b4878
...
@@ -13,7 +13,7 @@ Django relies on user input in some cases (e.g.
...
@@ -13,7 +13,7 @@ Django relies on user input in some cases (e.g.
:func:`django.contrib.auth.views.login`, ``django.contrib.comments``, and
:func:`django.contrib.auth.views.login`, ``django.contrib.comments``, and
:doc:`i18n </topics/i18n/index>`) to redirect the user to an "on success" URL.
:doc:`i18n </topics/i18n/index>`) to redirect the user to an "on success" URL.
The security checks for these redirects (namely
The security checks for these redirects (namely
``django.util.http.is_safe_url()``) didn't check if the scheme is ``http(s)``
``django.util
s
.http.is_safe_url()``) didn't check if the scheme is ``http(s)``
and as such allowed ``javascript:...`` URLs to be entered. If a developer
and as such allowed ``javascript:...`` URLs to be entered. If a developer
relied on ``is_safe_url()`` to provide safe redirect targets and put such a
relied on ``is_safe_url()`` to provide safe redirect targets and put such a
URL into a link, they could suffer from a XSS attack. This bug doesn't affect
URL into a link, they could suffer from a XSS attack. This bug doesn't affect
...
...
docs/releases/1.5.8.txt
Dosyayı görüntüle @
dd0b4878
...
@@ -39,7 +39,7 @@ Django relies on user input in some cases (e.g.
...
@@ -39,7 +39,7 @@ Django relies on user input in some cases (e.g.
:func:`django.contrib.auth.views.login`, ``django.contrib.comments``, and
:func:`django.contrib.auth.views.login`, ``django.contrib.comments``, and
:doc:`i18n </topics/i18n/index>`) to redirect the user to an "on success" URL.
:doc:`i18n </topics/i18n/index>`) to redirect the user to an "on success" URL.
The security checks for these redirects (namely
The security checks for these redirects (namely
``django.util.http.is_safe_url()``) did not correctly validate some malformed
``django.util
s
.http.is_safe_url()``) did not correctly validate some malformed
URLs, such as `http:\\\\\\djangoproject.com`, which are accepted by some browsers
URLs, such as `http:\\\\\\djangoproject.com`, which are accepted by some browsers
with more liberal URL parsing.
with more liberal URL parsing.
...
...
docs/releases/1.6.10.txt
Dosyayı görüntüle @
dd0b4878
...
@@ -36,7 +36,7 @@ Mitigated possible XSS attack via user-supplied redirect URLs
...
@@ -36,7 +36,7 @@ Mitigated possible XSS attack via user-supplied redirect URLs
Django relies on user input in some cases (e.g.
Django relies on user input in some cases (e.g.
:func:`django.contrib.auth.views.login` and :doc:`i18n </topics/i18n/index>`)
:func:`django.contrib.auth.views.login` and :doc:`i18n </topics/i18n/index>`)
to redirect the user to an "on success" URL. The security checks for these
to redirect the user to an "on success" URL. The security checks for these
redirects (namely ``django.util.http.is_safe_url()``) didn't strip leading
redirects (namely ``django.util
s
.http.is_safe_url()``) didn't strip leading
whitespace on the tested URL and as such considered URLs like
whitespace on the tested URL and as such considered URLs like
``\njavascript:...`` safe. If a developer relied on ``is_safe_url()`` to
``\njavascript:...`` safe. If a developer relied on ``is_safe_url()`` to
provide safe redirect targets and put such a URL into a link, they could suffer
provide safe redirect targets and put such a URL into a link, they could suffer
...
...
docs/releases/1.6.5.txt
Dosyayı görüntüle @
dd0b4878
...
@@ -39,7 +39,7 @@ Django relies on user input in some cases (e.g.
...
@@ -39,7 +39,7 @@ Django relies on user input in some cases (e.g.
:func:`django.contrib.auth.views.login`, ``django.contrib.comments``, and
:func:`django.contrib.auth.views.login`, ``django.contrib.comments``, and
:doc:`i18n </topics/i18n/index>`) to redirect the user to an "on success" URL.
:doc:`i18n </topics/i18n/index>`) to redirect the user to an "on success" URL.
The security checks for these redirects (namely
The security checks for these redirects (namely
``django.util.http.is_safe_url()``) did not correctly validate some malformed
``django.util
s
.http.is_safe_url()``) did not correctly validate some malformed
URLs, such as `http:\\\\\\djangoproject.com`, which are accepted by some browsers
URLs, such as `http:\\\\\\djangoproject.com`, which are accepted by some browsers
with more liberal URL parsing.
with more liberal URL parsing.
...
...
docs/releases/1.7.3.txt
Dosyayı görüntüle @
dd0b4878
...
@@ -36,7 +36,7 @@ Mitigated possible XSS attack via user-supplied redirect URLs
...
@@ -36,7 +36,7 @@ Mitigated possible XSS attack via user-supplied redirect URLs
Django relies on user input in some cases (e.g.
Django relies on user input in some cases (e.g.
:func:`django.contrib.auth.views.login` and :doc:`i18n </topics/i18n/index>`)
:func:`django.contrib.auth.views.login` and :doc:`i18n </topics/i18n/index>`)
to redirect the user to an "on success" URL. The security checks for these
to redirect the user to an "on success" URL. The security checks for these
redirects (namely ``django.util.http.is_safe_url()``) didn't strip leading
redirects (namely ``django.util
s
.http.is_safe_url()``) didn't strip leading
whitespace on the tested URL and as such considered URLs like
whitespace on the tested URL and as such considered URLs like
``\njavascript:...`` safe. If a developer relied on ``is_safe_url()`` to
``\njavascript:...`` safe. If a developer relied on ``is_safe_url()`` to
provide safe redirect targets and put such a URL into a link, they could suffer
provide safe redirect targets and put such a URL into a link, they could suffer
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment