diff options
| author | Claude Paroz <claude@2xlibre.net> | 2016-03-04 23:33:35 +0100 |
|---|---|---|
| committer | Claude Paroz <claude@2xlibre.net> | 2016-03-04 23:39:46 +0100 |
| commit | beb392b85e71fdd41209d323126181d74090fecb (patch) | |
| tree | e05961f9b439140f9f9d9c714361ce69e4c0f38f /docs | |
| parent | 28bed24f552aa01e5b69902493f5ee2e06514522 (diff) | |
[1.8.x] Added safety to URL decoding in is_safe_url() on Python 2
The errors='replace' parameter to force_text altered the URL before checking
it, which wasn't considered sane. Refs 24fc935218 and ada7a4aef.
Backport of 552f03869e from master.
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/releases/1.8.11.txt | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/docs/releases/1.8.11.txt b/docs/releases/1.8.11.txt index b01807129b..f33149b9e7 100644 --- a/docs/releases/1.8.11.txt +++ b/docs/releases/1.8.11.txt @@ -2,7 +2,7 @@ Django 1.8.11 release notes =========================== -*March 4, 2016* +*March 5, 2016* Django 1.8.11 fixes a regression on Python 2 in the 1.8.10 security release where ``utils.http.is_safe_url()`` crashes on bytestring URLs (:ticket:`26308`). |