-
Committer:
Bazaar Package Importer
-
Author(s):
Jamie Strandboge
-
Date:
2011-02-15 17:04:19 UTC
-
Revision ID:
james.westby@ubuntu.com-20110215170419-5mebvxl1co15dp01
Tags: 1.2.3-1ubuntu0.2.10.10.2
* SECURITY UPDATE: flaw in CSRF handling (LP: #719031)
- debian/patches/09_CVE-2011-0696.diff: apply full CSRF validation to all
requests, regardless of apparent AJAX origin. This is technically
backwards-incompatible, but the security risks have been judged to
outweigh the compatibility concerns in this case. See the Django project
notes for more information:
http://www.djangoproject.com/weblog/2011/feb/08/security/
- CVE-2011-0696
* SECURITY UPDATE: potential XSS in file field rendering
- debian/patches/10_admin_widgets-to-unittest.diff: prepare testsuite for
security fix tests
- debian/patches/11_CVE-2011-0697.diff: properly escape URL in
django/contrib/admin/widgets.py
- CVE-2011-0697