1. ============================

  2. Django 1.11.21 release notes

  3. ============================

  4. 

  5. *June 3, 2019*

  6. 

  7. Django 1.11.21 fixes a security issue in 1.11.20.

  8. 

  9. CVE-2019-12308: AdminURLFieldWidget XSS

  10. ---------------------------------------

  11. 

  12. The clickable "Current URL" link generated by ``AdminURLFieldWidget`` displayed

  13. the provided value without validating it as a safe URL. Thus, an unvalidated

  14. value stored in the database, or a value provided as a URL query parameter

  15. payload, could result in an clickable JavaScript link.

  16. 

  17. ``AdminURLFieldWidget`` now validates the provided value using

  18. :class:`~django.core.validators.URLValidator` before displaying the clickable

  19. link. You may customize the validator by passing a ``validator_class`` kwarg to

  20. ``AdminURLFieldWidget.__init__()``, e.g. when using

  21. :attr:`~django.contrib.admin.ModelAdmin.formfield_overrides`.
About Sign Up Leave Feedback Contact