From 5731342dbc0e2e0395d53ba9ad54dc5ba49a8560 Mon Sep 17 00:00:00 2001
From: Tim Graham <timograham@gmail.com>
Date: Mon, 26 Sep 2016 12:57:18 -0400
Subject: [PATCH] [1.10.x] Added release notes for 1.9.10 and 1.8.15 releases.

---
 docs/releases/1.8.15.txt | 18 ++++++++++++++++++
 docs/releases/1.9.10.txt | 18 ++++++++++++++++++
 docs/releases/index.txt  |  2 ++
 3 files changed, 38 insertions(+)
 create mode 100644 docs/releases/1.8.15.txt
 create mode 100644 docs/releases/1.9.10.txt

diff --git a/docs/releases/1.8.15.txt b/docs/releases/1.8.15.txt
new file mode 100644
index 0000000000..e977cffbab
--- /dev/null
+++ b/docs/releases/1.8.15.txt
@@ -0,0 +1,18 @@
+===========================
+Django 1.8.15 release notes
+===========================
+
+*September 26, 2016*
+
+Django 1.8.15 fixes a security issue in 1.8.14.
+
+CSRF protection bypass on a site with Google Analytics
+======================================================
+
+An interaction between Google Analytics and Django's cookie parsing could allow
+an attacker to set arbitrary cookies leading to a bypass of CSRF protection.
+
+The parser for ``request.COOKIES`` is simplified to better match the behavior
+of browsers and to mitigate this attack. ``request.COOKIES`` may now contain
+cookies that are invalid according to :rfc:`6265` but are possible to set via
+``document.cookie``.
diff --git a/docs/releases/1.9.10.txt b/docs/releases/1.9.10.txt
new file mode 100644
index 0000000000..6321cd8d03
--- /dev/null
+++ b/docs/releases/1.9.10.txt
@@ -0,0 +1,18 @@
+===========================
+Django 1.9.10 release notes
+===========================
+
+*September 26, 2016*
+
+Django 1.9.10 fixes a security issue in 1.9.9.
+
+CSRF protection bypass on a site with Google Analytics
+======================================================
+
+An interaction between Google Analytics and Django's cookie parsing could allow
+an attacker to set arbitrary cookies leading to a bypass of CSRF protection.
+
+The parser for ``request.COOKIES`` is simplified to better match the behavior
+of browsers and to mitigate this attack. ``request.COOKIES`` may now contain
+cookies that are invalid according to :rfc:`6265` but are possible to set via
+``document.cookie``.
diff --git a/docs/releases/index.txt b/docs/releases/index.txt
index b7e553d6c8..51875f813d 100644
--- a/docs/releases/index.txt
+++ b/docs/releases/index.txt
@@ -34,6 +34,7 @@ versions of the documentation contain the release notes for any later releases.
 .. toctree::
    :maxdepth: 1
 
+   1.9.10
    1.9.9
    1.9.8
    1.9.7
@@ -50,6 +51,7 @@ versions of the documentation contain the release notes for any later releases.
 .. toctree::
    :maxdepth: 1
 
+   1.8.15
    1.8.14
    1.8.13
    1.8.12