1
0
mirror of https://github.com/django/django.git synced 2025-03-15 11:50:46 +00:00
django/docs/releases/1.5.9.txt
Florian Apolloner 45ac9d4fb0 [1.5.x] Prevented reverse() from generating URLs pointing to other hosts.
This is a security fix. Disclosure following shortly.
2014-08-20 11:44:02 -04:00

21 lines
899 B
Plaintext

==========================
Django 1.5.9 release notes
==========================
*Under development*
Django 1.5.9 fixes several security issues in 1.5.8.
:func:`~django.core.urlresolvers.reverse()` could generate URLs pointing to other hosts
=======================================================================================
In certain situations, URL reversing could generate scheme-relative URLs (URLs
starting with two slashes), which could unexpectedly redirect a user to a
different host. An attacker could exploit this, for example, by redirecting
users to a phishing site designed to ask for user's passwords.
To remedy this, URL reversing now ensures that no URL starts with two slashes
(//), replacing the second slash with its URL encoded counterpart (%2F). This
approach ensures that semantics stay the same, while making the URL relative to
the domain and not to the scheme.