mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2024-12-22 09:05:43 +00:00
Code Issues 25 Releases Wiki Activity

Added release notes for 1.9.10 and 1.8.15 releases.

Browse Source
This commit is contained in:
Tim Graham 2016-09-26 12:57:18 -04:00
parent 6d6d1b1001
commit c6a3109e20
3 changed files with 38 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
docs/releases/1.8.15.txt Normal file
View File

@ -0,0 +1,18 @@
===========================
Django 1.8.15 release notes
===========================
*September 26, 2016*
Django 1.8.15 fixes a security issue in 1.8.14.
CSRF protection bypass on a site with Google Analytics
======================================================
An interaction between Google Analytics and Django's cookie parsing could allow
an attacker to set arbitrary cookies leading to a bypass of CSRF protection.
The parser for ``request.COOKIES`` is simplified to better match the behavior
of browsers and to mitigate this attack. ``request.COOKIES`` may now contain
cookies that are invalid according to :rfc:`6265` but are possible to set via
``document.cookie``.

18
docs/releases/1.9.10.txt Normal file
View File

@ -0,0 +1,18 @@
===========================
Django 1.9.10 release notes
===========================
*September 26, 2016*
Django 1.9.10 fixes a security issue in 1.9.9.
CSRF protection bypass on a site with Google Analytics
======================================================
An interaction between Google Analytics and Django's cookie parsing could allow
an attacker to set arbitrary cookies leading to a bypass of CSRF protection.
The parser for ``request.COOKIES`` is simplified to better match the behavior
of browsers and to mitigate this attack. ``request.COOKIES`` may now contain
cookies that are invalid according to :rfc:`6265` but are possible to set via
``document.cookie``.

2
docs/releases/index.txt
View File

@ -42,6 +42,7 @@ versions of the documentation contain the release notes for any later releases.
.. toctree::
:maxdepth: 1
1.9.10
1.9.9
1.9.8
1.9.7
@ -58,6 +59,7 @@ versions of the documentation contain the release notes for any later releases.
.. toctree::
:maxdepth: 1
1.8.15
1.8.14
1.8.13
1.8.12