From 8cc41ce7a7a8f6bebfdd89d5ab276cd0109f4fc5 Mon Sep 17 00:00:00 2001 From: Tim Graham Date: Wed, 5 Aug 2015 16:51:42 -0400 Subject: Fixed DoS possiblity in contrib.auth.views.logout() Thanks Florian Apolloner and Carl Meyer for review. This is a security fix. --- django/contrib/sessions/middleware.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'django') diff --git a/django/contrib/sessions/middleware.py b/django/contrib/sessions/middleware.py index 8f12a12623..96751dbbc1 100644 --- a/django/contrib/sessions/middleware.py +++ b/django/contrib/sessions/middleware.py @@ -36,7 +36,7 @@ class SessionMiddleware(object): else: if accessed: patch_vary_headers(response, ('Cookie',)) - if modified or settings.SESSION_SAVE_EVERY_REQUEST: + if (modified or settings.SESSION_SAVE_EVERY_REQUEST) and not empty: if request.session.get_expire_at_browser_close(): max_age = None expires = None -- cgit v1.3