diff options
| author | Markus Holtermann <info@markusholtermann.eu> | 2022-01-02 00:37:40 +0100 |
|---|---|---|
| committer | Mariusz Felisiak <felisiak.mariusz@gmail.com> | 2022-02-01 07:43:45 +0100 |
| commit | 01422046065d2b51f8f613409cad2c81b39487e5 (patch) | |
| tree | f6c8ab06087174650bf603ddaf2a62145408b99a /docs/ref | |
| parent | 6928227dffe45f06deed9a218a188e6ed11334ba (diff) | |
[4.0.x] Fixed CVE-2022-22818 -- Fixed possible XSS via {% debug %} template tag.
Thanks Keryn Knight for the report.
Backport of 394517f07886495efcf79f95c7ee402a9437bd68 from main.
Co-authored-by: Adam Johnson <me@adamj.eu>
Diffstat (limited to 'docs/ref')
| -rw-r--r-- | docs/ref/templates/builtins.txt | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/docs/ref/templates/builtins.txt b/docs/ref/templates/builtins.txt index 733cc3cdb2..a664e9d2d2 100644 --- a/docs/ref/templates/builtins.txt +++ b/docs/ref/templates/builtins.txt @@ -194,7 +194,13 @@ from its first value when it's next encountered. --------- Outputs a whole load of debugging information, including the current context -and imported modules. +and imported modules. ``{% debug %}`` outputs nothing when the :setting:`DEBUG` +setting is ``False``. + +.. versionchanged:: 2.2.27 + + In older versions, debugging information was displayed when the + :setting:`DEBUG` setting was ``False``. .. templatetag:: extends |