mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-23 21:59:11 +00:00
Code Issues 32 Releases Wiki Activity

Added safety to URL decoding in is_safe_url() on Python 2

Browse Source 
The errors='replace' parameter to force_text altered the URL before checking
it, which wasn't considered sane. Refs 24fc935218 and ada7a4aef.
This commit is contained in:
Claude Paroz
2016-03-04 23:33:35 +01:00
parent ada7a4aefb
commit 552f03869e
4 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/releases/1.8.11.txt
View File

@@ -2,7 +2,7 @@
Django 1.8.11 release notes
===========================
*March 4, 2016*
*March 5, 2016*
Django 1.8.11 fixes a regression on Python 2 in the 1.8.10 security release
where ``utils.http.is_safe_url()`` crashes on bytestring URLs (:ticket:`26308`).

2
docs/releases/1.9.4.txt
View File

@@ -2,7 +2,7 @@
Django 1.9.4 release notes
==========================
*March 4, 2016*
*March 5, 2016*
Django 1.9.4 fixes a regression on Python 2 in the 1.9.3 security release
where ``utils.http.is_safe_url()`` crashes on bytestring URLs (:ticket:`26308`).