diff options
| author | Tim Graham <timograham@gmail.com> | 2015-08-05 16:51:42 -0400 |
|---|---|---|
| committer | Tim Graham <timograham@gmail.com> | 2015-08-18 08:03:43 -0400 |
| commit | 8cc41ce7a7a8f6bebfdd89d5ab276cd0109f4fc5 (patch) | |
| tree | 4561241b0fae38ec47942121bf9f5edff5180ced /django | |
| parent | b0ab74dfcaaf92ee222b30295e2e9559bdbb8212 (diff) | |
Fixed DoS possiblity in contrib.auth.views.logout()
Thanks Florian Apolloner and Carl Meyer for review.
This is a security fix.
Diffstat (limited to 'django')
| -rw-r--r-- | django/contrib/sessions/middleware.py | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/django/contrib/sessions/middleware.py b/django/contrib/sessions/middleware.py index 8f12a12623..96751dbbc1 100644 --- a/django/contrib/sessions/middleware.py +++ b/django/contrib/sessions/middleware.py @@ -36,7 +36,7 @@ class SessionMiddleware(object): else: if accessed: patch_vary_headers(response, ('Cookie',)) - if modified or settings.SESSION_SAVE_EVERY_REQUEST: + if (modified or settings.SESSION_SAVE_EVERY_REQUEST) and not empty: if request.session.get_expire_at_browser_close(): max_age = None expires = None |