From 2f16ff5a6cbd71fc6c50e88e4087f3657222e90e Mon Sep 17 00:00:00 2001 From: Markus Holtermann Date: Sat, 4 Oct 2014 19:04:21 +0200 Subject: Fixed #23601 -- Ensured view exists in URLconf before importing it in admindocs. --- docs/releases/1.8.txt | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'docs') diff --git a/docs/releases/1.8.txt b/docs/releases/1.8.txt index 01e48b75e4..434e91e9a5 100644 --- a/docs/releases/1.8.txt +++ b/docs/releases/1.8.txt @@ -76,6 +76,14 @@ Minor features ` to control whether or not the full count of objects should be displayed on a filtered admin page. +:mod:`django.contrib.admindocs` +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +* The view to browse view details now checks if the view specified in the URL + exists in the URLconf. Previously it was possible to import arbitrary + packages from the Python path. This was not considered a security issue + because ``admindocs`` is only accessible to staff users. + :mod:`django.contrib.auth` ^^^^^^^^^^^^^^^^^^^^^^^^^^ -- cgit v1.3