mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-31 09:41:08 +00:00
Code Issues 32 Releases Wiki Activity

Fixed CVE-2019-12308 -- Made AdminURLFieldWidget validate URL before rendering clickable link.

Browse Source
This commit is contained in:
Carlton Gibson
2019-05-23 12:06:34 +02:00
parent 98c0fe19ee
commit deeba6d920
6 changed files with 68 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
docs/releases/1.11.21.txt
View File

@@ -4,4 +4,18 @@ Django 1.11.21 release notes
*June 3, 2019*
Django 1.11.21 fixes security issues in 1.11.20.
Django 1.11.21 fixes a security issue in 1.11.20.
CVE-2019-12308: AdminURLFieldWidget XSS
---------------------------------------
The clickable "Current URL" link generated by ``AdminURLFieldWidget`` displayed
the provided value without validating it as a safe URL. Thus, an unvalidated
value stored in the database, or a value provided as a URL query parameter
payload, could result in an clickable JavaScript link.
``AdminURLFieldWidget`` now validates the provided value using
:class:`~django.core.validators.URLValidator` before displaying the clickable
link. You may customise the validator by passing a ``validator_class`` kwarg to
``AdminURLFieldWidget.__init__()``, e.g. when using
:attr:`~django.contrib.admin.ModelAdmin.formfield_overrides`.