django/docs/releases/1.9.4.txt

==========================
Django 1.9.4 release notes
==========================

*March 5, 2016*

Django 1.9.4 fixes a regression on Python 2 in the 1.9.3 security release
where ``utils.http.is_safe_url()`` crashes on bytestring URLs (:ticket:`26308`).
Added stub release notes for 1.9.4. 2016-03-01 12:39:01 -05:00			`==========================`
			`Django 1.9.4 release notes`
			`==========================`

Added safety to URL decoding in is_safe_url() on Python 2 The errors='replace' parameter to force_text altered the URL before checking it, which wasn't considered sane. Refs 24fc935218 and ada7a4aef. 2016-03-04 23:33:35 +01:00			`March 5, 2016`
Added stub release notes for 1.9.4. 2016-03-01 12:39:01 -05:00
Fixed #26308 -- Prevented crash with binary URLs in is_safe_url() This fixes a regression introduced by c5544d28923. Thanks John Eskew for the reporti and Tim Graham for the review. 2016-03-04 15:41:52 +01:00			`Django 1.9.4 fixes a regression on Python 2 in the 1.9.3 security release`
			where ``utils.http.is_safe_url()`` crashes on bytestring URLs (:ticket:`26308`).