1. ===========================

  2. Django 1.9.10 release notes

  3. ===========================

  4. 

  5. *September 26, 2016*

  6. 

  7. Django 1.9.10 fixes a security issue in 1.9.9.

  8. 

  9. CSRF protection bypass on a site with Google Analytics

  10. ======================================================

  11. 

  12. An interaction between Google Analytics and Django's cookie parsing could allow

  13. an attacker to set arbitrary cookies leading to a bypass of CSRF protection.

  14. 

  15. The parser for ``request.COOKIES`` is simplified to better match the behavior

  16. of browsers and to mitigate this attack. ``request.COOKIES`` may now contain

  17. cookies that are invalid according to :rfc:`6265` but are possible to set via

  18. ``document.cookie``.
About Sign Up Leave Feedback Contact