diff options
| author | Russell Keith-Magee <russell@keith-magee.com> | 2013-09-15 13:48:15 +0800 |
|---|---|---|
| committer | Russell Keith-Magee <russell@keith-magee.com> | 2013-09-15 13:48:15 +0800 |
| commit | 22b74fa09d7ccbc8c52270d648a0da7f3f0fa2bc (patch) | |
| tree | 504b5c88849fc2c1dd6f22d83c4cd5e6c0ab1d2a /docs/releases/1.5.4.txt | |
| parent | e66fe357b2324f984e91392286b3b0e6b5dd627e (diff) | |
[1.5.x] Ensure that passwords are never long enough for a DoS.
* Limit the password length to 4096 bytes
* Password hashers will raise a ValueError
* django.contrib.auth forms will fail validation
* Document in release notes that this is a backwards incompatible change
Thanks to Josh Wright for the report, and Donald Stufft for the patch.
This is a security fix; disclosure to follow shortly.
Backport of aae5a96d5754ad34e48b7f673ef2411a3bbc1015 from master.
Diffstat (limited to 'docs/releases/1.5.4.txt')
0 files changed, 0 insertions, 0 deletions