lp:ubuntu/quantal-security/python-django

Branch merges

Propose for merging

No branches dependent on this one.

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Bug #1311433: REGRESSION: AttributeError: 'functools.partial' object has no attribute '__module__'

Undecided

New

Link a bug report

Related blueprints

47. By Seth Arnold on 2014-05-14

* SECURITY UPDATE: cache coherency problems in old Internet Explorer
  compatibility functions lead to loss of privacy and cache poisoning
  attacks. (LP: #1317663)
  - debian/patches/drop_fix_ie_for_vary_1_4.diff: remove fix_IE_for_vary()
    and fix_IE_for_attach() functions so Cache-Control and Vary headers are
    no longer modified. This may introduce some regressions for IE 6 and IE 7
    users. Patch from upstream.
  - CVE-2014-1418
* SECURITY UPDATE: The validation for redirects did not correctly validate
  some malformed URLs, which are accepted by some browsers. This allows a
  user to be redirected to an unsafe URL unexpectedly.
  - debian/patches/is_safe_url_1_4.diff: Forbid URLs starting with '///',
    forbid URLs without a host but with a path. Patch from upstream.

46. By Marc Deslauriers on 2014-04-22

* SECURITY REGRESSION: security fix regression when a view is a partial
  (LP: #1311433)
  - debian/patches/CVE-2014-0472-regression.patch: create the lookup_str
    from the original function whenever a partial is provided as an
    argument to a url pattern in django/core/urlresolvers.py,
    added tests to tests/regressiontests/urlpatterns_reverse/urls.py,
    tests/regressiontests/urlpatterns_reverse/views.py.
  - CVE-2014-0472

45. By Marc Deslauriers on 2014-04-19

* SECURITY UPDATE: unexpected code execution using reverse()
  (LP: #1309779)
  - debian/patches/CVE-2014-0472.patch: added filtering to
    django/core/urlresolvers.py, added tests to
    tests/regressiontests/urlpatterns_reverse/nonimported_module.py,
    tests/regressiontests/urlpatterns_reverse/tests.py,
    tests/regressiontests/urlpatterns_reverse/urls.py,
    tests/regressiontests/urlpatterns_reverse/views.py.
  - CVE-2014-0472
* SECURITY UPDATE: caching of anonymous pages could reveal CSRF token
  (LP: #1309782)
  - debian/patches/CVE-2014-0473.patch: don't cache responses with a
    cookie in django/middleware/cache.py, added tests to
    tests/regressiontests/cache/tests.py.
  - CVE-2014-0473
* SECURITY UPDATE: MySQL typecasting issue (LP: #1309784)
  - debian/patches/CVE-2014-0474.patch: convert arguments to correct
    type in django/db/models/fields/__init__.py, updated docs in
    docs/howto/custom-model-fields.txt, docs/ref/databases.txt,
    docs/ref/models/querysets.txt, docs/topics/db/sql.txt, added tests to
    tests/regressiontests/model_fields/tests.py.
  - CVE-2014-0474
* debian/patches/fix_test_ftbfs.patch: fix ftbfs with upstream commit.

44. By Marc Deslauriers on 2013-09-20

* SECURITY UPDATE: denial of service via long passwords (LP: #1225784)
  - debian/patches/CVE-2013-1443.patch: enforce a maximum password length
    in django/contrib/auth/forms.py, django/contrib/auth/hashers.py,
    django/contrib/auth/tests/hashers.py.
  - CVE-2013-1443
* SECURITY UPDATE: directory traversal with ssi template tag
  - debian/patches/CVE-2013-4315.patch: properly check absolute path in
    django/template/defaulttags.py,
    tests/regressiontests/templates/tests.py.
  - CVE-2013-4315
* SECURITY UPDATE: possible XSS via is_safe_url
  - debian/patches/security-is_safe_url.patch: properly reject URLs which
    specify a scheme other then HTTP or HTTPS.
  - https://www.djangoproject.com/weblog/2013/aug/13/security-releases-issued/
  - No CVE number
* debian/patches/fix-validation-tests.patch: fix regression in tests
  since example.com is now available via https.

43. By Marc Deslauriers on 2013-03-04

* SECURITY UPDATE: host header poisoning (LP: #1089337)
  - debian/patches/fix_get_host.patch: tighten host header validation in
    django/http/__init__.py, add info to docs/topics/security.txt, add
    tests to tests/regressiontests/requests/tests.py.
  - https://www.djangoproject.com/weblog/2012/dec/10/security/
  - No CVE number
* SECURITY UPDATE: redirect poisoning (LP: #1089337)
  - debian/patches/fix_redirect_poisoning.patch: tighten validation in
    django/contrib/auth/views.py,
    django/contrib/comments/views/comments.py,
    django/contrib/comments/views/moderation.py,
    django/contrib/comments/views/utils.py, django/utils/http.py,
    django/views/i18n.py, add tests to
    tests/regressiontests/comment_tests/tests/comment_view_tests.py,
    tests/regressiontests/comment_tests/tests/moderation_view_tests.py,
    tests/regressiontests/views/tests/i18n.py.
  - https://www.djangoproject.com/weblog/2012/dec/10/security/
  - No CVE number
* SECURITY UPDATE: host header poisoning (LP: #1130445)
  - debian/patches/add_allowed_hosts.patch: add new ALLOWED_HOSTS setting
    to django/conf/global_settings.py,
    django/conf/project_template/project_name/settings.py,
    django/contrib/auth/tests/views.py,
    django/contrib/contenttypes/tests.py, django/contrib/sites/tests.py,
    django/http/__init__.py, django/test/utils.py, add docs to
    docs/ref/settings.txt, docs/topics/security.txt, add tests to
    tests/regressiontests/csrf_tests/tests.py,
    tests/regressiontests/requests/tests.py.
  - https://www.djangoproject.com/weblog/2013/feb/19/security/
  - No CVE number
* SECURITY UPDATE: XML attacks (LP: #1130445)
  - debian/patches/CVE-2013-166x.patch: forbid DTDs, entity expansion,
    and external entities/DTDs in
    django/core/serializers/xml_serializer.py, add tests to
    tests/regressiontests/serializers_regress/tests.py.
  - https://www.djangoproject.com/weblog/2013/feb/19/security/
  - CVE-2013-1664
  - CVE-2013-1665
* SECURITY UPDATE: Data leakage via admin history log (LP: #1130445)
  - debian/patches/CVE-2013-0305.patch: add permission checks to history
    view in django/contrib/admin/options.py, add tests to
    tests/regressiontests/admin_views/tests.py.
  - https://www.djangoproject.com/weblog/2013/feb/19/security/
  - CVE-2013-0305
* SECURITY UPDATE: Formset denial-of-service (LP: #1130445)
  - debian/patches/CVE-2013-0306.patch: limit maximum number of forms in
    django/forms/formsets.py, add docs to docs/topics/forms/formsets.txt,
    docs/topics/forms/modelforms.txt, add tests to
    tests/regressiontests/forms/tests/formsets.py,
    tests/regressiontests/generic_inline_admin/tests.py.
  - https://www.djangoproject.com/weblog/2013/feb/19/security/
  - CVE-2013-0306

42. By Jamie Strandboge on 2012-11-19

* Add additional tests for CVE-2012-4520
  - debian/patches/CVE-2012-4520-additional-tests.diff: add various poisoned
    host header test material
* Don't fail self-tests if MANAGERS or ADMINS is defined in settings.py
  - debian/patches/lp1080204.diff: Isolate poisoned_http_host tests from 500
  - https://code.djangoproject.com/ticket/19172
  - LP: #1080204

41. By Jamie Strandboge on 2012-11-09

* SECURITY UPDATE: fix Host header poisoning
  - debian/patches/CVE-2012-4520.diff: adjust HttpRequest.get_host() to
    raise django.core.exceptions.SuspiciousOperation if Host headers contain
    potentially dangerous content. Patch thanks to Mackenzie Morgan.
  - CVE-2012-4520
  - LP: #1068486
* debian/patches/docs-update-httponly-cookie.diff: update documentation of
  HttpOnly cookie option to correctly describe changes to 1.4

40. By Raphaël Hertzog on 2012-08-21

* New patch 01_use_stdlib_htmlparser_when_possible.diff to not override
  Python stdlib's HTMLParser with Python versions which are unaffected by
  http://bugs.python.org/issue670664 Closes: #683648
  Thanks to David Watson <email address hidden> for the patch.
* Update the above patch to use the version committed upstream (commit
  57d9ccc).

39. By Raphaël Hertzog on 2012-08-02

* New upstream security and maintenance release. Closes: #683364
  Fixes: CVE-2012-3442 CVE-2012-3443 CVE-2012-3444
* Drop 01_disable_broken_test.diff and 04_hyphen-manpage.diff which
  have been merged upstream.

38. By Raphaël Hertzog on 2012-03-31

* New upstream release. Closes: #666003
* Fix watch file to correctly extract the version number from the URL.
* Updated Standards-Version to 3.9.3 (no change needed).
* Drop 01_disable_url_verify_regression_tests.diff since upstream test
  suite has been modified to work even without internet connection.
* Update 04_hyphen-manpage.diff to apply again.
* Drop 05_fix_djangodocs_sphinx_ext.diff which has been merged
  upstream.
* Update 06_use_debian_geoip_database_as_default.diff to apply on
  renamed file.
* Drop 07_fix_for_sphinx1.1.2.diff merged upstream.
* Drop 08_fix_test_week_view_allow_future.diff, merged upstream.
* Add 01_disable_broken_test.diff to disable a test that fails with
  the current python 2.7 version in Debian.