From 2a4e49595acd263e9bac67c32b1683dc4310901b Mon Sep 17 00:00:00 2001 From: Paul McMillan <Paul@McMillan.ws> Date: Fri, 2 Mar 2012 04:22:16 +0000 Subject: [PATCH] Fixed #17766. Clarified HttpOnly flag on session cookie. Thanks ptone for the patch! git-svn-id: http://code.djangoproject.com/svn/django/trunk@17618 bcc190cf-cafb-0310-a4f2-bffc1f526a37 --- docs/releases/1.4-beta-1.txt | 7 +++++-- docs/releases/1.4.txt | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/docs/releases/1.4-beta-1.txt b/docs/releases/1.4-beta-1.txt index c8b4536f62..092ac5bc4e 100644 --- a/docs/releases/1.4-beta-1.txt +++ b/docs/releases/1.4-beta-1.txt @@ -1112,8 +1112,11 @@ Session cookies now have the ``httponly`` flag by default ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Session cookies now include the ``httponly`` attribute by default to -help reduce the impact of potential XSS attacks. For strict backwards -compatibility, use ``SESSION_COOKIE_HTTPONLY = False`` in your settings file. +help reduce the impact of potential XSS attacks. As a consequence of +this change, session cookie data, including sessionid, is no longer +accessible from Javascript in many browsers. For strict backwards +compatibility, use ``SESSION_COOKIE_HTTPONLY = False`` in your +settings file. Wildcard expansion of application names in `INSTALLED_APPS` ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/docs/releases/1.4.txt b/docs/releases/1.4.txt index cce28d8c78..de4cdadc3c 100644 --- a/docs/releases/1.4.txt +++ b/docs/releases/1.4.txt @@ -998,8 +998,11 @@ Session cookies now have the ``httponly`` flag by default ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Session cookies now include the ``httponly`` attribute by default to -help reduce the impact of potential XSS attacks. For strict backwards -compatibility, use ``SESSION_COOKIE_HTTPONLY = False`` in your settings file. +help reduce the impact of potential XSS attacks. As a consequence of +this change, session cookie data, including sessionid, is no longer +accessible from Javascript in many browsers. For strict backwards +compatibility, use ``SESSION_COOKIE_HTTPONLY = False`` in your +settings file. The :tfilter:`urlize` filter no longer escapes every URL ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~