mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-11-07 07:15:35 +00:00
Code Issues 32 Releases Wiki Activity

[1.7.x] Fixed DoS possibility in ModelMultipleChoiceField.

Browse Source 
This is a security fix. Disclosure following shortly.

Thanks Keryn Knight for the report and initial patch.
This commit is contained in:
Tim Graham
2014-12-11 08:31:03 -05:00
parent 818e59a3f0
commit bcfb47780c
5 changed files with 63 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
docs/releases/1.6.10.txt
View File

@@ -58,3 +58,12 @@ Note, however, that this view has always carried a warning that it is not
hardened for production use and should be used only as a development aid. Now
may be a good time to audit your project and serve your files in production
using a real front-end web server if you are not doing so.
Database denial-of-service with ``ModelMultipleChoiceField``
============================================================
Given a form that uses ``ModelMultipleChoiceField`` and
``show_hidden_initial=True`` (not a documented API), it was possible for a user
to cause an unreasonable number of SQL queries by submitting duplicate values
for the field's data. The validation logic in ``ModelMultipleChoiceField`` now
deduplicates submitted values to address this issue.

9
docs/releases/1.7.3.txt
View File

@@ -59,6 +59,15 @@ hardened for production use and should be used only as a development aid. Now
may be a good time to audit your project and serve your files in production
using a real front-end web server if you are not doing so.
Database denial-of-service with ``ModelMultipleChoiceField``
============================================================
Given a form that uses ``ModelMultipleChoiceField`` and
``show_hidden_initial=True`` (not a documented API), it was possible for a user
to cause an unreasonable number of SQL queries by submitting duplicate values
for the field's data. The validation logic in ``ModelMultipleChoiceField`` now
deduplicates submitted values to address this issue.
Bugfixes
========