1. ==========================

  2. Django 1.4.6 release notes

  3. ==========================

  4. 

  5. *August 13, 2013*

  6. 

  7. Django 1.4.6 fixes one security issue present in previous Django releases in

  8. the 1.4 series, as well as one other bug.

  9. 

  10. This is the sixth bugfix/security release in the Django 1.4 series.

  11. 

  12. Mitigated possible XSS attack via user-supplied redirect URLs

  13. =============================================================

  14. 

  15. Django relies on user input in some cases (e.g.

  16. ``django.contrib.auth.views.login()``, ``django.contrib.comments``, and

  17. :doc:`i18n </topics/i18n/index>`) to redirect the user to an "on success" URL.

  18. The security checks for these redirects (namely

  19. ``django.utils.http.is_safe_url()``) didn't check if the scheme is ``http(s)``

  20. and as such allowed ``javascript:...`` URLs to be entered. If a developer

  21. relied on ``is_safe_url()`` to provide safe redirect targets and put such a

  22. URL into a link, they could suffer from a XSS attack. This bug doesn't affect

  23. Django currently, since we only put this URL into the ``Location`` response

  24. header and browsers seem to ignore JavaScript there.

  25. 

  26. Bugfixes

  27. ========

  28. 

  29. * Fixed an obscure bug with the :func:`~django.test.override_settings`

  30.   decorator. If you hit an ``AttributeError: 'Settings' object has no attribute

  31.   '_original_allowed_hosts'`` exception, it's probably fixed (#20636).
About Sign Up Leave Feedback Contact