1
0
mirror of https://github.com/django/django.git synced 2024-12-24 10:05:46 +00:00
django/django
Luke Plant 45c7f427ce Fixed #14445 - Use HMAC and constant-time comparison functions where needed.
All adhoc MAC applications have been updated to use HMAC, using SHA1 to
generate unique keys for each application based on the SECRET_KEY, which is
common practice for this situation. In all cases, backwards compatibility
with existing hashes has been maintained, aiming to phase this out as per
the normal deprecation process. In this way, under most normal
circumstances the old hashes will have expired (e.g. by session expiration
etc.) before they become invalid.

In the case of the messages framework and the cookie backend, which was
already using HMAC, there is the possibility of a backwards incompatibility
if the SECRET_KEY is shorter than the default 50 bytes, but the low
likelihood and low impact meant compatibility code was not worth it.

All known instances where tokens/hashes were compared using simple string
equality, which could potentially open timing based attacks, have also been
fixed using a constant-time comparison function.

There are no known practical attacks against the existing implementations,
so these security improvements will not be backported.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@14218 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-10-14 20:54:30 +00:00
..
bin
conf Fixed #13863 -- Corrected decimal separator in Swedish format module. Thanks, Ulf Urdén. 2010-10-10 17:56:39 +00:00
contrib Fixed #14445 - Use HMAC and constant-time comparison functions where needed. 2010-10-14 20:54:30 +00:00
core Fixed #14301 -- Handle email validation gracefully with email addresses containing non-ASCII characters. Thanks, Andi Albrecht. 2010-10-14 18:37:05 +00:00
db Fixed #12192 -- Don't execute any DB query when the QS slicing being performed 2010-10-13 23:36:16 +00:00
dispatch Fixed #9015 -- added a signal decorator for simplifying signal connections 2010-09-12 19:58:05 +00:00
forms Fixed #14119 -- fields_for_model no longer returns all fields when fields parameter is the empty tuple. Thanks alexdutton! 2010-10-13 04:46:33 +00:00
http Allow setting HttpResponse cookie expiry times with datetime objects. 2010-09-12 20:52:49 +00:00
middleware Fixed #14445 - Use HMAC and constant-time comparison functions where needed. 2010-10-14 20:54:30 +00:00
shortcuts
template Fixed #14436 -- Escalated 1.2 PendingDeprecationWarnings to DeprecationWarnings, and removed 1.1 deprecated code. 2010-10-11 12:20:07 +00:00
templatetags Fixed #13568 -- Fixed the blocktrans tag to not raise a KeyError if the number of variables in the singular and the plural block differ. Thanks, deloide. 2010-10-01 02:02:01 +00:00
test Fixed #9002 -- Added a RequestFactory. This allows you to create request instances so you can unit test views as standalone functions. Thanks to Simon Willison for the suggestion and snippet on which this patch was originally based. 2010-10-12 23:37:47 +00:00
utils Fixed #14445 - Use HMAC and constant-time comparison functions where needed. 2010-10-14 20:54:30 +00:00
views Fixed #11509 -- Modified usage of "Web" to match our style guide in various documentation, comments and code. Thanks to timo and Simon Meers for the work on the patch. 2010-10-09 08:12:50 +00:00
__init__.py Django is now 1.3 pre-alpha. 2010-06-19 21:14:56 +00:00