diff options
| author | Markus Holtermann <info@markusholtermann.eu> | 2014-10-04 19:04:21 +0200 |
|---|---|---|
| committer | Tim Graham <timograham@gmail.com> | 2014-10-06 09:31:39 -0400 |
| commit | 2f16ff5a6cbd71fc6c50e88e4087f3657222e90e (patch) | |
| tree | b407362fde4e16ee4ea53ce4346e13bd4fd2ed23 /docs | |
| parent | a24cf217220dca44b7bd5b36ad9c14a96bca486e (diff) | |
Fixed #23601 -- Ensured view exists in URLconf before importing it in admindocs.
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/releases/1.8.txt | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/docs/releases/1.8.txt b/docs/releases/1.8.txt index 01e48b75e4..434e91e9a5 100644 --- a/docs/releases/1.8.txt +++ b/docs/releases/1.8.txt @@ -76,6 +76,14 @@ Minor features <django.contrib.admin.ModelAdmin.show_full_result_count>` to control whether or not the full count of objects should be displayed on a filtered admin page. +:mod:`django.contrib.admindocs` +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +* The view to browse view details now checks if the view specified in the URL + exists in the URLconf. Previously it was possible to import arbitrary + packages from the Python path. This was not considered a security issue + because ``admindocs`` is only accessible to staff users. + :mod:`django.contrib.auth` ^^^^^^^^^^^^^^^^^^^^^^^^^^ |