django.git/docs/releases/1.11.22.txt, branch main django http://cgit.adnoto.dev/django.git/atom?h=main 2019-07-01T05:48:04Z Fixed CVE-2019-12781 -- Made HttpRequest always trust SECURE_PROXY_SSL_HEADER if set. 2019-07-01T05:48:04Z Carlton Gibson carlton.gibson@noumenal.es 2019-06-13T08:57:29Z urn:sha1:54d0f5e62f54c29a12dd96f44bacd810cbe03ac8 An HTTP request would not be redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings were used if the proxy connected to Django via HTTPS. HttpRequest.scheme will now always trust the SECURE_PROXY_SSL_HEADER if set, rather than falling back to the request scheme when the SECURE_PROXY_SSL_HEADER did not have the secure value. Thanks to Gavin Wahl for the report and initial patch suggestion, and Shai Berger for review. Added stub release notes for security releases. 2019-07-01T04:57:27Z Mariusz Felisiak felisiak.mariusz@gmail.com 2019-06-20T08:45:38Z urn:sha1:30b3ee9d0b33bb440f9c73d1ce9e0e7303887a9f