Sophie: python-django-doc-1.8.19-1.mga6 noarch

python-django-doc-1.8.19-1.mga6.noarch.rpm

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">


<html xmlns="http://www.w3.org/1999/xhtml" lang="">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
    
    <title>Django 1.8.10 release notes &#8212; Django 1.8.19 documentation</title>
    
    <link rel="stylesheet" href="../_static/default.css" type="text/css" />
    <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
    
    <script type="text/javascript">
      var DOCUMENTATION_OPTIONS = {
        URL_ROOT:    '../',
        VERSION:     '1.8.19',
        COLLAPSE_INDEX: false,
        FILE_SUFFIX: '.html',
        HAS_SOURCE:  true
      };
    </script>
    <script type="text/javascript" src="../_static/jquery.js"></script>
    <script type="text/javascript" src="../_static/underscore.js"></script>
    <script type="text/javascript" src="../_static/doctools.js"></script>
    <link rel="index" title="Index" href="../genindex.html" />
    <link rel="search" title="Search" href="../search.html" />
    <link rel="top" title="Django 1.8.19 documentation" href="../contents.html" />
    <link rel="up" title="Release notes" href="index.html" />
    <link rel="next" title="Django 1.8.9 release notes" href="1.8.9.html" />
    <link rel="prev" title="Django 1.8.11 release notes" href="1.8.11.html" />



 
<script type="text/javascript" src="../templatebuiltins.js"></script>
<script type="text/javascript">
(function($) {
    if (!django_template_builtins) {
       // templatebuiltins.js missing, do nothing.
       return;
    }
    $(document).ready(function() {
        // Hyperlink Django template tags and filters
        var base = "../ref/templates/builtins.html";
        if (base == "#") {
            // Special case for builtins.html itself
            base = "";
        }
        // Tags are keywords, class '.k'
        $("div.highlight\\-html\\+django span.k").each(function(i, elem) {
             var tagname = $(elem).text();
             if ($.inArray(tagname, django_template_builtins.ttags) != -1) {
                 var fragment = tagname.replace(/_/, '-');
                 $(elem).html("<a href='" + base + "#" + fragment + "'>" + tagname + "</a>");
             }
        });
        // Filters are functions, class '.nf'
        $("div.highlight\\-html\\+django span.nf").each(function(i, elem) {
             var filtername = $(elem).text();
             if ($.inArray(filtername, django_template_builtins.tfilters) != -1) {
                 var fragment = filtername.replace(/_/, '-');
                 $(elem).html("<a href='" + base + "#" + fragment + "'>" + filtername + "</a>");
             }
        });
    });
})(jQuery);
</script>


  </head>
  <body role="document">

    <div class="document">
  <div id="custom-doc" class="yui-t6">
    <div id="hd">
      <h1><a href="../index.html">Django 1.8.19 documentation</a></h1>
      <div id="global-nav">
        <a title="Home page" href="../index.html">Home</a>  |
        <a title="Table of contents" href="../contents.html">Table of contents</a>  |
        <a title="Global index" href="../genindex.html">Index</a>  |
        <a title="Module index" href="../py-modindex.html">Modules</a>
      </div>
      <div class="nav">
    &laquo; <a href="1.8.11.html" title="Django 1.8.11 release notes">previous</a>
     |
    <a href="index.html" title="Release notes" accesskey="U">up</a>
   |
    <a href="1.8.9.html" title="Django 1.8.9 release notes">next</a> &raquo;</div>
    </div>

    <div id="bd">
      <div id="yui-main">
        <div class="yui-b">
          <div class="yui-g" id="releases-1.8.10">
            
  <div class="section" id="s-django-1-8-10-release-notes">
<span id="django-1-8-10-release-notes"></span><h1>Django 1.8.10 release notes<a class="headerlink" href="#django-1-8-10-release-notes" title="Permalink to this headline">¶</a></h1>
<p><em>March 1, 2016</em></p>
<p>Django 1.8.10 fixes two security issues and several bugs in 1.8.9.</p>
<div class="section" id="s-cve-2016-2512-malicious-redirect-and-possible-xss-attack-via-user-supplied-redirect-urls-containing-basic-auth">
<span id="cve-2016-2512-malicious-redirect-and-possible-xss-attack-via-user-supplied-redirect-urls-containing-basic-auth"></span><h2>CVE-2016-2512: Malicious redirect and possible XSS attack via user-supplied redirect URLs containing basic auth<a class="headerlink" href="#cve-2016-2512-malicious-redirect-and-possible-xss-attack-via-user-supplied-redirect-urls-containing-basic-auth" title="Permalink to this headline">¶</a></h2>
<p>Django relies on user input in some cases (e.g.
<a class="reference internal" href="../topics/auth/default.html#django.contrib.auth.views.login" title="django.contrib.auth.views.login"><code class="xref py py-func docutils literal"><span class="pre">django.contrib.auth.views.login()</span></code></a> and <a class="reference internal" href="../topics/i18n/index.html"><span class="doc">i18n</span></a>)
to redirect the user to an &#8220;on success&#8221; URL. The security check for these
redirects (namely <code class="docutils literal"><span class="pre">django.utils.http.is_safe_url()</span></code>) considered some URLs
with basic authentication credentials &#8220;safe&#8221; when they shouldn&#8217;t be.</p>
<p>For example, a URL like <code class="docutils literal"><span class="pre">http://mysite.example.com\&#64;attacker.com</span></code> would be
considered safe if the request&#8217;s host is <code class="docutils literal"><span class="pre">http://mysite.example.com</span></code>, but
redirecting to this URL sends the user to <code class="docutils literal"><span class="pre">attacker.com</span></code>.</p>
<p>Also, if a developer relies on <code class="docutils literal"><span class="pre">is_safe_url()</span></code> to provide safe redirect
targets and puts such a URL into a link, they could suffer from an XSS attack.</p>
</div>
<div class="section" id="s-cve-2016-2513-user-enumeration-through-timing-difference-on-password-hasher-work-factor-upgrade">
<span id="cve-2016-2513-user-enumeration-through-timing-difference-on-password-hasher-work-factor-upgrade"></span><h2>CVE-2016-2513: User enumeration through timing difference on password hasher work factor upgrade<a class="headerlink" href="#cve-2016-2513-user-enumeration-through-timing-difference-on-password-hasher-work-factor-upgrade" title="Permalink to this headline">¶</a></h2>
<p>In each major version of Django since 1.6, the default number of iterations for
the <code class="docutils literal"><span class="pre">PBKDF2PasswordHasher</span></code> and its subclasses has increased. This improves
the security of the password as the speed of hardware increases, however, it
also creates a timing difference between a login request for a user with a
password encoded in an older number of iterations and login request for a
nonexistent user (which runs the default hasher&#8217;s default number of iterations
since Django 1.6).</p>
<p>This only affects users who haven&#8217;t logged in since the iterations were
increased. The first time a user logs in after an iterations increase, their
password is updated with the new iterations and there is no longer a timing
difference.</p>
<p>The new <code class="docutils literal"><span class="pre">BasePasswordHasher.harden_runtime()</span></code> method allows hashers to bridge
the runtime gap between the work factor (e.g. iterations) supplied in existing
encoded passwords and the default work factor of the hasher. This method
is implemented for <code class="docutils literal"><span class="pre">PBKDF2PasswordHasher</span></code>  and <code class="docutils literal"><span class="pre">BCryptPasswordHasher</span></code>.
The number of rounds for the latter hasher hasn&#8217;t changed since Django 1.4, but
some projects may subclass it and increase the work factor as needed.</p>
<p>A warning will be emitted for any <a class="reference internal" href="../topics/auth/passwords.html#write-your-own-password-hasher"><span class="std std-ref">third-party password hashers that don&#8217;t
implement</span></a> a <code class="docutils literal"><span class="pre">harden_runtime()</span></code> method.</p>
<p>If you have different password hashes in your database (such as SHA1 hashes
from users who haven&#8217;t logged in since the default hasher switched to PBKDF2
in Django 1.4), the timing difference on a login request for these users may be
even greater and this fix doesn&#8217;t remedy that difference (or any difference
when changing hashers). You may be able to <a class="reference internal" href="../topics/auth/passwords.html#wrapping-password-hashers"><span class="std std-ref">upgrade those hashes</span></a> to prevent a timing attack for that case.</p>
</div>
<div class="section" id="s-bugfixes">
<span id="bugfixes"></span><h2>Bugfixes<a class="headerlink" href="#bugfixes" title="Permalink to this headline">¶</a></h2>
<ul class="simple">
<li>Fixed a crash on PostgreSQL that prevented using <code class="docutils literal"><span class="pre">TIME_ZONE=None</span></code> and
<code class="docutils literal"><span class="pre">USE_TZ=False</span></code> (<a class="reference external" href="https://code.djangoproject.com/ticket/26177">#26177</a>).</li>
<li>Added system checks for query name clashes of hidden relationships
(<a class="reference external" href="https://code.djangoproject.com/ticket/26162">#26162</a>).</li>
<li>Made <code class="docutils literal"><span class="pre">forms.FileField</span></code> and <code class="docutils literal"><span class="pre">utils.translation.lazy_number()</span></code> picklable
(<a class="reference external" href="https://code.djangoproject.com/ticket/26212">#26212</a>).</li>
<li>Fixed <a class="reference internal" href="../ref/contrib/postgres/fields.html#django.contrib.postgres.fields.RangeField" title="django.contrib.postgres.fields.RangeField"><code class="xref py py-class docutils literal"><span class="pre">RangeField</span></code></a> and
<a class="reference internal" href="../ref/contrib/postgres/fields.html#django.contrib.postgres.fields.ArrayField" title="django.contrib.postgres.fields.ArrayField"><code class="xref py py-class docutils literal"><span class="pre">ArrayField</span></code></a> serialization with
<code class="docutils literal"><span class="pre">None</span></code> values (<a class="reference external" href="https://code.djangoproject.com/ticket/26215">#26215</a>).</li>
<li>Reallowed dashes in top-level domain names of URLs checked by
<code class="docutils literal"><span class="pre">URLValidator</span></code> to fix a regression in Django 1.8 (<a class="reference external" href="https://code.djangoproject.com/ticket/26204">#26204</a>).</li>
<li>Fixed <code class="docutils literal"><span class="pre">BoundField</span></code> to reallow slices of subwidgets (<a class="reference external" href="https://code.djangoproject.com/ticket/26267">#26267</a>).</li>
<li>Prevented <code class="docutils literal"><span class="pre">ContentTypeManager</span></code> instances from sharing their cache
(<a class="reference external" href="https://code.djangoproject.com/ticket/26286">#26286</a>).</li>
</ul>
</div>
</div>


          </div>
        </div>
      </div>
      
        
          <div class="yui-b" id="sidebar">
            
      <div class="sphinxsidebar" role="navigation" aria-label="main navigation">
        <div class="sphinxsidebarwrapper">
  <h3><a href="../contents.html">Table Of Contents</a></h3>
  <ul>
<li><a class="reference internal" href="#">Django 1.8.10 release notes</a><ul>
<li><a class="reference internal" href="#cve-2016-2512-malicious-redirect-and-possible-xss-attack-via-user-supplied-redirect-urls-containing-basic-auth">CVE-2016-2512: Malicious redirect and possible XSS attack via user-supplied redirect URLs containing basic auth</a></li>
<li><a class="reference internal" href="#cve-2016-2513-user-enumeration-through-timing-difference-on-password-hasher-work-factor-upgrade">CVE-2016-2513: User enumeration through timing difference on password hasher work factor upgrade</a></li>
<li><a class="reference internal" href="#bugfixes">Bugfixes</a></li>
</ul>
</li>
</ul>

  <h3>Browse</h3>
  <ul>
    
      <li>Prev: <a href="1.8.11.html">Django 1.8.11 release notes</a></li>
    
    
      <li>Next: <a href="1.8.9.html">Django 1.8.9 release notes</a></li>
    
  </ul>
  <h3>You are here:</h3>
  <ul>
      <li>
        <a href="../index.html">Django 1.8.19 documentation</a>
        
          <ul><li><a href="index.html">Release notes</a>
        
        <ul><li>Django 1.8.10 release notes</li></ul>
        </li></ul>
      </li>
  </ul>

  <div role="note" aria-label="source link">
    <h3>This Page</h3>
    <ul class="this-page-menu">
      <li><a href="../_sources/releases/1.8.10.txt"
            rel="nofollow">Show Source</a></li>
    </ul>
   </div>
<div id="searchbox" style="display: none" role="search">
  <h3>Quick search</h3>
    <form class="search" action="../search.html" method="get">
      <div><input type="text" name="q" /></div>
      <div><input type="submit" value="Go" /></div>
      <input type="hidden" name="check_keywords" value="yes" />
      <input type="hidden" name="area" value="default" />
    </form>
</div>
<script type="text/javascript">$('#searchbox').show(0);</script>
        </div>
      </div>
              <h3>Last update:</h3>
              <p class="topless">Mar 10, 2018</p>
          </div>
        
      
    </div>

    <div id="ft">
      <div class="nav">
    &laquo; <a href="1.8.11.html" title="Django 1.8.11 release notes">previous</a>
     |
    <a href="index.html" title="Release notes" accesskey="U">up</a>
   |
    <a href="1.8.9.html" title="Django 1.8.9 release notes">next</a> &raquo;</div>
    </div>
  </div>

      <div class="clearer"></div>
    </div>
  </body>
</html>