diff options
| author | Jacob Kaplan-Moss <jacob@jacobian.org> | 2011-02-24 13:38:32 +0000 |
|---|---|---|
| committer | Jacob Kaplan-Moss <jacob@jacobian.org> | 2011-02-24 13:38:32 +0000 |
| commit | 062cbfb1ecbc21156c66196e55893481936dec84 (patch) | |
| tree | 99e2ac776c9515de6766e2b10c7e8a8fbbba6da7 /scripts | |
| parent | fa1a74ff3c7069c6e442b31c0c3842a24a01fc8a (diff) | |
[1.2.X] Prevented non-admin users from accessing the admin redirect shortcut.
If the admin shortcut view (e.g. /admin/r/<content-type>/<pk>/) is
publically-accessible, and if a public users can guess a content-type ID
(which isn't hard given that they're sequential), then the redirect view could
possibly leak data by redirecting to pages a user shouldn't "know about." So
the redirect view needs the same protection as the rest of the admin site.
Thanks to Jason Royes for pointing this out.
Backport of [15639] from trunk.
git-svn-id: http://code.djangoproject.com/svn/django/branches/releases/1.2.X@15640 bcc190cf-cafb-0310-a4f2-bffc1f526a37
Diffstat (limited to 'scripts')
0 files changed, 0 insertions, 0 deletions