https://www.djangoproject.com/weblog/2013/feb/19/security/
- Host header poisoning: an attacker could cause Django to generate
and display URLs that link to arbitrary domains.
- Formset denial-of-service: an attacker can abuse Django's tracking
of the number of forms in a formset to cause a denial-of-service attack.
- XML attacks: Django's serialization framework was vulnerable to
attacks via XML entity expansion and external references.
- Data leakage via admin history log: Django's admin interface could
expose supposedly-hidden information via its history log.
diff submitted by Ryan Boggs (MAINTAINER), thanks!
This update fixes a security issue related to host header poisoning.
more details at: ttps://www.djangoproject.com/weblog/2012/oct/17/security/
development and clean, pragmatic design.
Developed and used over two years by a fast-moving online-news
operation, Django was designed to handle two challenges: the intensive
deadlines of a newsroom and the stringent requirements of the
experienced Web developers who wrote it. It lets you build
high-performing, elegant Web applications quickly.
From Darrin Chandler (MAINTAINER)
Testing and help from Will Maier and myself
ok steven@
