diff options
| author | Przemysław Suliga <mail@suligap.net> | 2016-08-19 13:40:21 +0200 |
|---|---|---|
| committer | Tim Graham <timograham@gmail.com> | 2016-08-19 19:01:01 -0400 |
| commit | 549b90fab33c80d1ba6575d4837ea52d79f70fb1 (patch) | |
| tree | 42b4220bbc3b451c3f8bae8d3c3e5ce54431c53a /docs | |
| parent | 5e5a17028f4b9cfb5ff777d8c259e079bca0c988 (diff) | |
Refs #26902 -- Protected against insecure redirects in Login/LogoutView.
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/releases/1.11.txt | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/docs/releases/1.11.txt b/docs/releases/1.11.txt index d62ea80e8c..64afe7a841 100644 --- a/docs/releases/1.11.txt +++ b/docs/releases/1.11.txt @@ -356,6 +356,13 @@ to assign a free port. The ``DJANGO_LIVE_TEST_SERVER_ADDRESS`` environment variable is no longer used, and as it's also no longer used, the ``manage.py test --liveserver`` option is removed. +Protection against insecure redirects in :mod:`django.contrib.auth` views +------------------------------------------------------------------------- + +``LoginView`` and ``LogoutView`` (and the deprecated function-based equivalents) +protect users from being redirected to non-HTTPS ``next`` URLs when the app +is running over HTTPS. + Miscellaneous ------------- |