Fixed a security issue related to password resets

Full disclosure and new release are forthcoming

1 files changed, 5 insertions, 0 deletions

diff --git a/django/http/__init__.py b/django/http/__init__.py
index ecb39129ad..b385b450ee 100644
--- a/django/http/__init__.py
+++ b/django/http/__init__.py
@@ -180,6 +180,11 @@ class HttpRequest(object):
             server_port = str(self.META['SERVER_PORT'])
             if server_port != ('443' if self.is_secure() else '80'):
                 host = '%s:%s' % (host, server_port)
+
+        # Disallow potentially poisoned hostnames.
+        if set(';/?@&=+$,').intersection(host):
+            raise SuspiciousOperation('Invalid HTTP_HOST header: %s' % host)
+
         return host
 
     def get_full_path(self):