diff options
| author | Florian Apolloner <florian@apolloner.eu> | 2014-07-17 21:59:28 +0200 |
|---|---|---|
| committer | Tim Graham <timograham@gmail.com> | 2014-08-11 09:04:23 -0400 |
| commit | c2fe73133b62a1d9e8f7a6b43966570b14618d7e (patch) | |
| tree | 205e3adda5f4a9886f216f5b9c309fe84e715a89 /docs | |
| parent | 4d5e972a2c9f3e2f6ce115f7fbe44df8dd8612ef (diff) | |
[1.4.x] Prevented reverse() from generating URLs pointing to other hosts.
This is a security fix. Disclosure following shortly.
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/releases/1.4.14.txt | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/docs/releases/1.4.14.txt b/docs/releases/1.4.14.txt index d0032e5399..28390c96a4 100644 --- a/docs/releases/1.4.14.txt +++ b/docs/releases/1.4.14.txt @@ -5,3 +5,16 @@ Django 1.4.14 release notes *Under development* Django 1.4.14 fixes several security issues in 1.4.13. + +:func:`~django.core.urlresolvers.reverse()` could generate URLs pointing to other hosts +======================================================================================= + +In certain situations, URL reversing could generate scheme-relative URLs (URLs +starting with two slashes), which could unexpectedly redirect a user to a +different host. An attacker could exploit this, for example, by redirecting +users to a phishing site designed to ask for user's passwords. + +To remedy this, URL reversing now ensures that no URL starts with two slashes +(//), replacing the second slash with its URL encoded counterpart (%2F). This +approach ensures that semantics stay the same, while making the URL relative to +the domain and not to the scheme. |