Permalink
Browse files

[1.1.X] [1.2.X] Fixed #15253 -- Added 1.1.3 release notes, and added …

…sections to the 1.2.4 and 1.3 release notes about the December security announcement.

Backport of r15485 from trunk.

Backport of r15486 from trunk.

git-svn-id: http://code.djangoproject.com/svn/django/branches/releases/1.1.X@15487 bcc190cf-cafb-0310-a4f2-bffc1f526a37
  • Loading branch information...
freakboy3742 committed Feb 10, 2011
1 parent b7a7cdc commit 99c529eec881708a725bb0e1c99392b3f6c4547d
Showing with 54 additions and 3 deletions.
  1. +50 −0 docs/releases/1.1.3.txt
  2. +3 −3 docs/releases/1.1.4.txt
  3. +1 −0 docs/releases/index.txt
View
@@ -0,0 +1,50 @@
==========================
Django 1.1.3 release notes
==========================
Welcome to Django 1.1.3!
This is the third "bugfix" release in the Django 1.1 series,
improving the stability and performance of the Django 1.1 codebase.
With one exception, Django 1.1.3 maintains backwards compatibility
with Django 1.1.2. It also contains a number of fixes and other
improvements. Django 1.1.2 is a recommended upgrade for any
development or deployment currently using or targeting Django 1.1.
For full details on the new features, backwards incompatibilities, and
deprecated features in the 1.1 branch, see the :doc:`/releases/1.1`.
Backwards incompatible changes
==============================
Restricted filters in admin interface
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The Django administrative interface, django.contrib.admin, supports
filtering of displayed lists of objects by fields on the corresponding
models, including across database-level relationships. This is
implemented by passing lookup arguments in the querystring portion of
the URL, and options on the ModelAdmin class allow developers to
specify particular fields or relationships which will generate
automatic links for filtering.
One historically-undocumented and -unofficially-supported feature has
been the ability for a user with sufficient knowledge of a model's
structure and the format of these lookup arguments to invent useful
new filters on the fly by manipulating the querystring.
However, it has been demonstrated that this can be abused to gain
access to information outside of an admin user's permissions; for
example, an attacker with access to the admin and sufficient knowledge
of model structure and relations could construct query strings which --
with repeated use of regular-expression lookups supported by the
Django database API -- expose sensitive information such as users'
password hashes.
To remedy this, django.contrib.admin will now validate that
querystring lookup arguments either specify only fields on the model
being viewed, or cross relations which have been explicitly
whitelisted by the application developer using the pre-existing
mechanism mentioned above. This is backwards-incompatible for any
users relying on the prior ability to insert arbitrary lookups.
View
@@ -8,15 +8,15 @@ This is the fourth "bugfix" release in the Django 1.1 series,
improving the stability and performance of the Django 1.1 codebase.
With one exception, Django 1.1.4 maintains backwards compatibility
with Django 1.1.3, but contain a number of fixes and other
with Django 1.1.3. It also contains a number of fixes and other
improvements. Django 1.1.4 is a recommended upgrade for any
development or deployment currently using or targeting Django 1.1.
For full details on the new features, backwards incompatibilities, and
deprecated features in the 1.1 branch, see the :doc:`/releases/1.1`.
Backwards-incompatible changes in 1.1.4
=======================================
Backwards incompatible changes
==============================
CSRF exception for AJAX requests
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
View
@@ -22,6 +22,7 @@ Final releases
:maxdepth: 1
1.1.4
1.1.3
1.1.2
1.1

0 comments on commit 99c529e

Please sign in to comment.