mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-31 09:41:08 +00:00
Code Issues 32 Releases Wiki Activity

Refs #24022 -- Removed the ssi tag per deprecation timeline.

Browse Source
This commit is contained in:
Tim Graham
2015-08-17 09:34:50 -04:00
parent 3af9b70028
commit 04ee4059d7
21 changed files with 28 additions and 332 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
docs/releases/1.4.7.txt
View File

@@ -7,11 +7,11 @@ Django 1.4.7 release notes
Django 1.4.7 fixes one security issue present in previous Django releases in
the 1.4 series.
Directory traversal vulnerability in :ttag:`ssi` template tag
-------------------------------------------------------------
Directory traversal vulnerability in ``ssi`` template tag
---------------------------------------------------------
In previous versions of Django it was possible to bypass the
:setting:`ALLOWED_INCLUDE_ROOTS` setting used for security with the :ttag:`ssi`
``ALLOWED_INCLUDE_ROOTS`` setting used for security with the ``ssi``
template tag by specifying a relative path that starts with one of the allowed
roots. For example, if ``ALLOWED_INCLUDE_ROOTS = ("/var/www",)`` the following
would be possible:
@@ -21,5 +21,5 @@ would be possible:
{% ssi "/var/www/../../etc/passwd" %}
In practice this is not a very common problem, as it would require the template
author to put the :ttag:`ssi` file in a user-controlled variable, but it's
author to put the ``ssi`` file in a user-controlled variable, but it's
possible in principle.