diff options
| author | Tim Graham <timograham@gmail.com> | 2014-10-06 13:35:52 -0400 |
|---|---|---|
| committer | Tim Graham <timograham@gmail.com> | 2014-10-06 13:35:52 -0400 |
| commit | 51165401be3e9d084c6a3ebb99246e5bb29bb752 (patch) | |
| tree | 51068bd2daa9498c0aa64bfcd0942ddf23ff63c5 /docs | |
| parent | 844ba211ceea11ad2aa81f6a55c518228dd33a53 (diff) | |
Moved release note for refs #23601 to 1.7.1.
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/releases/1.7.1.txt | 6 | ||||
| -rw-r--r-- | docs/releases/1.8.txt | 8 |
2 files changed, 6 insertions, 8 deletions
diff --git a/docs/releases/1.7.1.txt b/docs/releases/1.7.1.txt index f743447d56..0a5a0163b8 100644 --- a/docs/releases/1.7.1.txt +++ b/docs/releases/1.7.1.txt @@ -91,3 +91,9 @@ Bugfixes (:ticket:`23560`). * Fixed ``deepcopy`` on ``ErrorList`` (:ticket:`23594`). + +* Made the :mod:`~django.contrib.admindocs` view to browse view details check + if the view specified in the URL exists in the URLconf. Previously it was + possible to import arbitrary packages from the Python path. This was not + considered a security issue because ``admindocs`` is only accessible to staff + users (:ticket:`23601`). diff --git a/docs/releases/1.8.txt b/docs/releases/1.8.txt index 434e91e9a5..01e48b75e4 100644 --- a/docs/releases/1.8.txt +++ b/docs/releases/1.8.txt @@ -76,14 +76,6 @@ Minor features <django.contrib.admin.ModelAdmin.show_full_result_count>` to control whether or not the full count of objects should be displayed on a filtered admin page. -:mod:`django.contrib.admindocs` -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -* The view to browse view details now checks if the view specified in the URL - exists in the URLconf. Previously it was possible to import arbitrary - packages from the Python path. This was not considered a security issue - because ``admindocs`` is only accessible to staff users. - :mod:`django.contrib.auth` ^^^^^^^^^^^^^^^^^^^^^^^^^^ |