~ubuntu-branches/ubuntu/lucid/python-django/lucid-security : changes

~ubuntu-branches/ubuntu/lucid/python-django/lucid-security » Changes from revision 39

From Revision 32 to 13

Rev	Summary	Authors	Tags	Date
32	* SECURITY UPDATE: fix Host header poisoning * SECURITY UPDATE: fix Host header poisoning - debian/patches/CVE-2012-4520.diff: adjust HttpRequest.get_host() to raise django.core.exceptions.SuspiciousOperation if Host headers contain potentially dangerous content. - CVE-2012-4520 - LP: #1068486	Jamie Strandboge	1.1.1-2ubuntu1.6	12 years ago
31	* SECURITY UPDATE: Cross-site scripting in authentication vi... * SECURITY UPDATE: Cross-site scripting in authentication views (LP: #1031733) - debian/patches/16_fix_cross_site_scripting_in_authentication.diff: fix unsafe redirects indjango/http/__init__.py. Patch backported from Debian Squeeze and fixed for python 2.4 compatibility. - CVE-2012-3442 * SECURITY UPDATE: Denial-of-service in image validation (LP: #1031733) - debian/patches/17_fix_dos_in_image_validation.diff: call verify() immediately after the constructor in django/forms/fields.py. - CVE-2012-3443 * SECURITY UPDATE: Denial-of-service via get_image_dimensions() (LP: #1031733) - debian/patches/18_fix_dos_via_get_image_dimensions.diff: don't limit chunk size in django/core/files/images.py. - CVE-2012-3444	Marc Deslauriers	1.1.1-2ubuntu1.5	12 years ago
30	* SECURITY UPDATE: session manipulation when using django.co... * SECURITY UPDATE: session manipulation when using django.contrib.sessions with memory-based sessions and caching - debian/patches/CVE-2011-4136.patch: use namespace of cache to store keys for session instead of root namespace - CVE-2011-4136 * SECURITY UPDATE: potential denial of service and information disclosure in URLField - debian/patches/CVE-2011-4137+4138.patch: set verify_exists to False by default and use a timeout if available. - CVE-2011-4137, CVE-2011-4138 * SECURITY UPDATE: potential cache-poisoning via crafted Host header - debian/patches/CVE-2011-4139.patch: ignore X-Forwarded-Host header by default when constructing full URLs - CVE-2011-4139 * More information on these issues can be found at: https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/	Jamie Strandboge	1.1.1-2ubuntu1.4	13 years ago
29	* SECURITY UPDATE: flaw in CSRF handling (LP: #719031) * SECURITY UPDATE: flaw in CSRF handling (LP: #719031) - debian/patches/10_CVE-2011-0696.diff: apply full CSRF validation to all requests, regardless of apparent AJAX origin. This is technically backwards-incompatible, but the security risks have been judged to outweigh the compatibility concerns in this case. See the Django project notes for more information: http://www.djangoproject.com/weblog/2011/feb/08/security/ - CVE-2011-0696 * SECURITY UPDATE: potential XSS in file field rendering - debian/patches/11_CVE-2011-0697.diff: properly escape URL in django/contrib/admin/widgets.py - CVE-2011-0697	Jamie Strandboge	1.1.1-2ubuntu1.3	14 years ago
28	* SECURITY UPDATE: information leak in admin interface * SECURITY UPDATE: information leak in admin interface - debian/patches/08_security_admin_infoleak.diff: validate querystring lookup arguments either specify only fields on the model being viewed, or cross relations which have been explicitly whitelisted. - CVE-2010-4534 * SECURITY UPDATE: - debian/patches/09_security_pasword_reset_dos.diff: adjust base36_to_int() function in django.utils.http will now validate the length of its input; on input longer than 13 digits (sufficient to base36-encode any 64-bit integer), it will now raise ValueError. Additionally, the default URL patterns for django.contrib.auth will now enforce a maximum length on the relevant parameters. - CVE-2010-4535	Jamie Strandboge	1.1.1-2ubuntu1.2	14 years ago
27	Fix django test client cookie handling. Fix django test client cookie handling.	James Westby	1.1.1-2ubuntu1	15 years ago
26	* Remove embedded "decimal" code copy and use system version... * Remove embedded "decimal" code copy and use system version instead. The "doctest" code copy cannot be removed as parts of Django depend on modified behaviour. (Closes: #555419) * Fix FTBFS in November by applying patch from upstream bug #12125. (Closes: #555931) * Fix FTBFS under Python 2.6.3 by applying patch from upstream bug #11993. (Closes: #555969)	Chris Lamb	1.1.1-2	15 years ago
25	* Merge python-django 1.1.1-1 from debian unstable (LP: #447... * Merge python-django 1.1.1-1 from debian unstable (LP: #447617) for security and bug fixes, all Ubuntu changes merged by Debian. * Add to debian/patches: - 20_python2.6.3_regression.patch - backported upstream commit 11620 to make Django work with Python 2.6.3 properly. (LP: #445639)	Krzysztof Klimonda	1.1.1-1ubuntu1	15 years ago
24	* debian/patches/20_disable_url_verify_regression_tests.diff * debian/patches/20_disable_url_verify_regression_tests.diff - Disable regression tests that require internet connection.	Krzysztof Klimonda	1.1-2ubuntu1	15 years ago
23	* Run testsuite on build. * Run testsuite on build. * Use "--with quilt" over specifying $(QUILT_STAMPFN)/unpatch dependencies. * Override clean target correctly.	Chris Lamb	1.1-2	15 years ago
22	* New upstream release. * New upstream release. * Merge from experimental: - Ship FastCGI initscript and /etc/default file in python-django's examples directory (Closes: #538863) - Drop "05_10539-sphinx06-compatibility.diff"; it has been applied upstream. - Bump Standards-Version to 3.8.2.	Chris Lamb	1.1-1	15 years ago
21	Fix compatibility with Python 2.6 and Python transitions in ... Fix compatibility with Python 2.6 and Python transitions in general. Thanks to Krzysztof Klimonda <kklimonda@syntaxhighlighted.com>.	Chris Lamb	1.0.2-7	15 years ago
20	Python 2.6 transition. Python 2.6 transition.	Michael Bienia	1.0.2-5ubuntu1	15 years ago
19	Fix issue where newly created projects do not have their man... Fix issue where newly created projects do not have their manage.py file executable.	Chris Lamb	1.0.2-5	15 years ago
18	[ Chris Lamb ] [ Chris Lamb ] * New upstream bugfix release. Closes: #505783 * Add myself to Uploaders with ACK from Brett. [ David Spreen ] * Remove python-pysqlite2 from Recommends because Python 2.5 includes sqlite library used by Django. Closes: 497886 [ Sandro Tosi ] * debian/control - switch Vcs-Browser field to viewsvn	Chris Lamb	1.0.2-1	16 years ago
17	* New upstream release: * New upstream release: - Bug fixes. * The tests/ sub-directory appaers to have been dropped upstream, so pull our patch to workaround the tests and modify the rules.	Scott James Remnant	1.0.1-0ubuntu1	16 years ago
16	* Merge from Debian (LP: #264191), remaining changes: * Merge from Debian (LP: #264191), remaining changes: - Run test suite on build. [Eddy Mulyono] * Update patch to workaround network test case failures.	Scott James Remnant	1.0-1ubuntu1	16 years ago
15	* Lack of debian/tests_settings.py file, fix FTBFS. * Lack of debian/tests_settings.py file, fix FTBFS. * debian/rules: remove settings file.	Andrea Gasparini	0.96.2-1ubuntu2	16 years ago
14	* Also closes LP: #234631: "security vulnerability in django... * Also closes LP: #234631: "security vulnerability in django admin" * Merge from Debian unstable. Remaining Ubuntu changes: - debian/patches/04_workaround_net_tests.patch - debian/rules: run testsuite during build process - debian/control: Maintainer set to Ubuntu Motu.	Andrea Gasparini	0.96.2-1ubuntu1	16 years ago
13	* Merge from Debian unstable (LP: #229954). Remaining Ubuntu... * Merge from Debian unstable (LP: #229954). Remaining Ubuntu changes - debian/patches/04_workaround_net_tests.patch run testsuite during build process - debian/patches/03_dynamicshebang.diff: manage.py created with the right python interpreter. - debian/control: Maintainer set to Ubuntu Motu.	Andrea Gasparini	0.96.1-3ubuntu1	16 years ago

Older »