diff options
| author | Carlton Gibson <carlton.gibson@noumenal.es> | 2019-05-27 09:37:10 +0200 |
|---|---|---|
| committer | Mariusz Felisiak <felisiak.mariusz@gmail.com> | 2019-06-03 14:05:25 +0200 |
| commit | 022c205f5196f34b55c56f492c38a71d32921b7f (patch) | |
| tree | 73c32da76e3eb4f2107967810b4dcbfaf477b42f | |
| parent | 862ef796afc629d3a4045dfcc1e4304d0ea87adc (diff) | |
[2.0.x] Forwardported 1.11.21 release notes.
| -rw-r--r-- | docs/releases/1.11.21.txt | 21 | ||||
| -rw-r--r-- | docs/releases/index.txt | 1 |
2 files changed, 22 insertions, 0 deletions
diff --git a/docs/releases/1.11.21.txt b/docs/releases/1.11.21.txt new file mode 100644 index 0000000000..3da7a78612 --- /dev/null +++ b/docs/releases/1.11.21.txt @@ -0,0 +1,21 @@ +============================ +Django 1.11.21 release notes +============================ + +*June 3, 2019* + +Django 1.11.21 fixes a security issue in 1.11.20. + +CVE-2019-12308: AdminURLFieldWidget XSS +--------------------------------------- + +The clickable "Current URL" link generated by ``AdminURLFieldWidget`` displayed +the provided value without validating it as a safe URL. Thus, an unvalidated +value stored in the database, or a value provided as a URL query parameter +payload, could result in an clickable JavaScript link. + +``AdminURLFieldWidget`` now validates the provided value using +:class:`~django.core.validators.URLValidator` before displaying the clickable +link. You may customise the validator by passing a ``validator_class`` kwarg to +``AdminURLFieldWidget.__init__()``, e.g. when using +:attr:`~django.contrib.admin.ModelAdmin.formfield_overrides`. diff --git a/docs/releases/index.txt b/docs/releases/index.txt index 6dafcb075f..38ab2fb1e2 100644 --- a/docs/releases/index.txt +++ b/docs/releases/index.txt @@ -45,6 +45,7 @@ versions of the documentation contain the release notes for any later releases. .. toctree:: :maxdepth: 1 + 1.11.21 1.11.20 1.11.19 1.11.18 |