Altered the behavior of URLField to avoid a potential DOS vector, and to avoid potential leakage of local filesystem data. A security announcement will be made shortly.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@16760 bcc190cf-cafb-0310-a4f2-bffc1f526a37

5 files changed, 32 insertions, 5 deletions

diff --git a/docs/internals/deprecation.txt b/docs/internals/deprecation.txt
index 105b39e937..8d5baaf407 100644
--- a/docs/internals/deprecation.txt
+++ b/docs/internals/deprecation.txt
@@ -115,6 +115,11 @@ their deprecation, as per the :ref:`deprecation policy
       beyond that of a simple ``TextField`` since the removal of oldforms.
       All uses of ``XMLField`` can be replaced with ``TextField``.
 
+    * ``django.db.models.fields.URLField.verify_exists`` has been
+      deprecated due to intractable security and performance
+      issues. Validation behavior has been removed in 1.4, and the
+      argument will be removed in 1.5.
+
 1.5
 ---
 
diff --git a/docs/ref/forms/fields.txt b/docs/ref/forms/fields.txt
index be1019c16e..437610384e 100644
--- a/docs/ref/forms/fields.txt
+++ b/docs/ref/forms/fields.txt
@@ -799,6 +799,11 @@ Takes the following optional arguments:
     If ``True``, the validator will attempt to load the given URL, raising
     ``ValidationError`` if the page gives a 404. Defaults to ``False``.
 
+.. deprecated:: 1.3.1
+
+   ``verify_exists`` was deprecated for security reasons and will be
+   removed in 1.4. This deprecation also removes ``validator_user_agent``.
+
 .. attribute:: URLField.validator_user_agent
 
     String used as the user-agent used when checking for a URL's existence.
diff --git a/docs/ref/models/fields.txt b/docs/ref/models/fields.txt
index 9a40a67439..8b5c0db7f5 100644
--- a/docs/ref/models/fields.txt
+++ b/docs/ref/models/fields.txt
@@ -872,14 +872,21 @@ shortcuts.
 ``URLField``
 ------------
 
-.. class:: URLField([verify_exists=True, max_length=200, **options])
+.. class:: URLField([verify_exists=False, max_length=200, **options])
 
 A :class:`CharField` for a URL. Has one extra optional argument:
 
+.. deprecated:: 1.3.1 
+
+   ``verify_exists`` is deprecated for security reasons as of 1.3.1
+   and will be removed in 1.4. Prior to 1.3.1, the default value was
+   ``True``.
+
 .. attribute:: URLField.verify_exists
 
-    If ``True`` (the default), the URL given will be checked for existence
-    (i.e., the URL actually loads and doesn't give a 404 response).
+    If ``True``, the URL given will be checked for existence (i.e.,
+    the URL actually loads and doesn't give a 404 response) using a
+    ``HEAD`` request. Redirects are allowed, but will not be followed.
 
     Note that when you're using the single-threaded development server,
     validating a URL being served by the same server will hang. This should not
diff --git a/docs/ref/settings.txt b/docs/ref/settings.txt
index 756799114d..f23a187bf2 100644
--- a/docs/ref/settings.txt
+++ b/docs/ref/settings.txt
@@ -2012,8 +2012,10 @@ URL_VALIDATOR_USER_AGENT
 
 Default: ``Django/<version> (http://www.djangoproject.com/)``
 
-The string to use as the ``User-Agent`` header when checking to see if URLs
-exist (see the ``verify_exists`` option on :class:`~django.db.models.URLField`).
+The string to use as the ``User-Agent`` header when checking to see if
+URLs exist (see the ``verify_exists`` option on
+:class:`~django.db.models.URLField`). This setting was deprecated in
+1.3.1 along with ``verify_exists`` and will be removed in 1.4.
 
 .. setting:: USE_ETAGS
 
diff --git a/docs/releases/1.4.txt b/docs/releases/1.4.txt
index ba05f2805f..f078ee0dfd 100644
--- a/docs/releases/1.4.txt
+++ b/docs/releases/1.4.txt
@@ -519,6 +519,14 @@ This was an alias to ``django.template.loader`` since 2005, it has been removed
 without emitting a warning due to the length of the deprecation. If your code
 still referenced this please use ``django.template.loader`` instead.
 
+``django.db.models.fields.URLField.verify_exists``
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This functionality has been removed due to intractable performance and
+security issues. Any existing usage of ``verify_exists`` should be
+removed.
+
+
 .. _deprecated-features-1.4:
 
 Features deprecated in 1.4