mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2024-12-25 02:26:12 +00:00
Code Issues 25 Releases Wiki Activity

[4.2.x] Added warning about flatpages and untrusted users.

Browse Source 
Backport of 571bab9887 from main
This commit is contained in:
Mariusz Felisiak 2023-09-27 19:09:10 +02:00
parent fec4ed0a25
commit dd0bf63d3e
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
docs/ref/contrib/flatpages.txt
View File

@ -164,6 +164,13 @@ For more on middleware, read the :doc:`middleware docs
How to add, change and delete flatpages
=======================================
.. warning::
Permissions to add or edit flatpages should be restricted to trusted users.
Flatpages are defined by raw HTML and are **not sanitized** by Django. As a
consequence, a malicious flatpage can lead to various security
vulnerabilities, including permission escalation.
.. _flatpages-admin:
Via the admin interface