diff options
| author | Jake Howard <git@theorangeone.net> | 2025-09-04 11:53:51 +0100 |
|---|---|---|
| committer | nessita <124304+nessita@users.noreply.github.com> | 2025-09-04 13:37:54 -0300 |
| commit | 4e7a991c12a113229e0927974d3bf94ea04eecf6 (patch) | |
| tree | 77b9eb0dfc5c8b18c54c9be90f37fff954d08d6a /docs/ref/django-admin.txt | |
| parent | c595af65457e44221aa56cab25e1b5766d802b8f (diff) | |
Refs #36588 -- Warned about using external templates in startapp/startproject commands.
Clarified that custom templates provided via `--template` for `starapp`
and `startproject` are used as-is, adding a warning that malicious or
poorly constructed templates may introduce security issues.
Diffstat (limited to 'docs/ref/django-admin.txt')
| -rw-r--r-- | docs/ref/django-admin.txt | 14 |
1 files changed, 13 insertions, 1 deletions
diff --git a/docs/ref/django-admin.txt b/docs/ref/django-admin.txt index 245a8f387c..def46ceecc 100644 --- a/docs/ref/django-admin.txt +++ b/docs/ref/django-admin.txt @@ -1319,6 +1319,15 @@ zip files, you can use a URL like: django-admin startapp --template=https://github.com/githubuser/django-app-template/archive/main.zip myapp +.. warning:: + + Templates provided via ``--template`` are used as is. Malicious or poorly + constructed templates may introduce security weaknesses or unintended + behavior. Compressed archives may also consume excessive resources during + extraction, potentially causing crashes or hangs. + + Contents of templates should be carefully inspected before use. + .. django-admin-option:: --extension EXTENSIONS, -e EXTENSIONS Specifies which file extensions in the app template should be rendered with the @@ -1412,7 +1421,10 @@ For example: .. django-admin-option:: --template TEMPLATE Specifies a directory, file path, or URL of a custom project template. See the -:option:`startapp --template` documentation for examples and usage. +:option:`startapp --template` documentation for examples and usage. The same +**security considerations** described for ``startapp`` templates apply here: +malicious or poorly constructed templates may introduce weaknesses or consume +excessive resources, and templates should be carefully inspected before use. .. django-admin-option:: --extension EXTENSIONS, -e EXTENSIONS |