1. ===========================

  2. Django 1.9.13 release notes

  3. ===========================

  4. 

  5. *April 4, 2017*

  6. 

  7. Django 1.9.13 fixes two security issues and a bug in 1.9.12. This is the final

  8. release of the 1.9.x series.

  9. 

  10. CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs

  11. ============================================================================================

  12. 

  13. Django relies on user input in some cases  (e.g.

  14. ``django.contrib.auth.views.login()`` and :doc:`i18n </topics/i18n/index>`)

  15. to redirect the user to an "on success" URL. The security check for these

  16. redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric

  17. URLs (e.g. ``http:999999999``) "safe" when they shouldn't be.

  18. 

  19. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect

  20. targets and puts such a URL into a link, they could suffer from an XSS attack.

  21. 

  22. CVE-2017-7234: Open redirect vulnerability in ``django.views.static.serve()``

  23. =============================================================================

  24. 

  25. A maliciously crafted URL to a Django site using the

  26. :func:`~django.views.static.serve` view could redirect to any other domain. The

  27. view no longer does any redirects as they don't provide any known, useful

  28. functionality.

  29. 

  30. Note, however, that this view has always carried a warning that it is not

  31. hardened for production use and should be used only as a development aid.

  32. 

  33. Bugfixes

  34. ========

  35. 

  36. * Fixed a regression in the ``timesince`` and ``timeuntil`` filters that caused

  37.   incorrect results for dates in a leap year (:ticket:`27637`).
About Sign Up Leave Feedback Contact