diff options
| author | John-Mark Bell <jmb@pexip.com> | 2016-03-07 12:06:46 +0000 |
|---|---|---|
| committer | Tim Graham <timograham@gmail.com> | 2016-03-07 13:22:11 -0500 |
| commit | 809eb5ddeeca388b2a1d339f7d5ee1f29119ecea (patch) | |
| tree | 772adf7d61f75f9c03c06392ed6d199f019f203a /docs | |
| parent | 4702c1ac98b284cacffcf5fbb0db9b85f0c2f8ba (diff) | |
[1.9.x] Fixed #26325 -- Made MultiPartParser ignore filenames that normalize to an empty string.
Backport of 4b129ac81f4fa38004950d0b307f81d1e9b44af8 from master
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/releases/1.8.12.txt | 4 | ||||
| -rw-r--r-- | docs/releases/1.9.5.txt | 4 |
2 files changed, 6 insertions, 2 deletions
diff --git a/docs/releases/1.8.12.txt b/docs/releases/1.8.12.txt index 332c6091a5..26735b8278 100644 --- a/docs/releases/1.8.12.txt +++ b/docs/releases/1.8.12.txt @@ -9,4 +9,6 @@ Django 1.8.12 fixes several bugs in 1.8.11. Bugfixes ======== -* ... +* Made ``MultiPartParser`` ignore filenames that normalize to an empty string + to fix crash in ``MemoryFileUploadHandler`` on specially crafted user input + (:ticket:`26325`). diff --git a/docs/releases/1.9.5.txt b/docs/releases/1.9.5.txt index edff4db6bc..211cbba6ba 100644 --- a/docs/releases/1.9.5.txt +++ b/docs/releases/1.9.5.txt @@ -9,4 +9,6 @@ Django 1.9.5 fixes several bugs in 1.9.4. Bugfixes ======== -* ... +* Made ``MultiPartParser`` ignore filenames that normalize to an empty string + to fix crash in ``MemoryFileUploadHandler`` on specially crafted user input + (:ticket:`26325`). |