diff options
| author | Markus Holtermann <info@markusholtermann.eu> | 2014-10-04 19:04:21 +0200 |
|---|---|---|
| committer | Tim Graham <timograham@gmail.com> | 2014-10-06 13:44:01 -0400 |
| commit | c2508990cb53b52783ebb38dc0b5f0ab5d023c76 (patch) | |
| tree | ddc2bdab52a3da0afcb90af9d06317c3370524c9 /docs | |
| parent | b3569b3a825e82d25ffadf49f436c13f30a205f8 (diff) | |
[1.7.x] Fixed #23601 -- Ensured view exists in URLconf before importing it in admindocs.
Backport of 2f16ff5a6c from master
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/releases/1.7.1.txt | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/docs/releases/1.7.1.txt b/docs/releases/1.7.1.txt index f743447d56..0a5a0163b8 100644 --- a/docs/releases/1.7.1.txt +++ b/docs/releases/1.7.1.txt @@ -91,3 +91,9 @@ Bugfixes (:ticket:`23560`). * Fixed ``deepcopy`` on ``ErrorList`` (:ticket:`23594`). + +* Made the :mod:`~django.contrib.admindocs` view to browse view details check + if the view specified in the URL exists in the URLconf. Previously it was + possible to import arbitrary packages from the Python path. This was not + considered a security issue because ``admindocs`` is only accessible to staff + users (:ticket:`23601`). |