diff options
| author | Tim Graham <timograham@gmail.com> | 2017-09-02 19:24:18 -0400 |
|---|---|---|
| committer | Tim Graham <timograham@gmail.com> | 2017-09-22 12:51:17 -0400 |
| commit | 4f313e284e03a675da5fb1d25122ac9b04af5950 (patch) | |
| tree | 8dcc91d0e8d6a16a8788160e351131904d6f2617 /docs/releases/1.8.18.txt | |
| parent | deb592b3e3d883ae32655f574c42af90079de8fa (diff) | |
Refs #17209 -- Removed login/logout and password reset/change function-based views.
Per deprecation timeline.
Diffstat (limited to 'docs/releases/1.8.18.txt')
| -rw-r--r-- | docs/releases/1.8.18.txt | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/docs/releases/1.8.18.txt b/docs/releases/1.8.18.txt index f41c7d080f..4196fa1573 100644 --- a/docs/releases/1.8.18.txt +++ b/docs/releases/1.8.18.txt @@ -10,7 +10,7 @@ CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric r ============================================================================================ Django relies on user input in some cases (e.g. -:func:`django.contrib.auth.views.login` and :doc:`i18n </topics/i18n/index>`) +``django.contrib.auth.views.login()`` and :doc:`i18n </topics/i18n/index>`) to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs (e.g. ``http:999999999``) "safe" when they shouldn't be. |