{"title":"Django 1.4.13 release notes","version":"dev","locale":"en","docname":"releases/1.4.13","url":"/en/dev/releases/1.4.13/","canonical":"https://djangodocs.dev/en/dev/releases/1.4.13/","summary":"Django 1.4.13 fixes two security issues in 1.4.12. In certain situations, Django may allow caches to store private data related to a particular session and…","html":"<h1>Django 1.4.13 release notes<a class=\"heading-anchor\" href=\"#django-1-4-13-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>May 14, 2014</em></p>\n<p>Django 1.4.13 fixes two security issues in 1.4.12.</p>\n<section id=\"caches-may-incorrectly-be-allowed-to-store-and-serve-private-data\">\n<h2>Caches may incorrectly be allowed to store and serve private data<a class=\"heading-anchor\" href=\"#caches-may-incorrectly-be-allowed-to-store-and-serve-private-data\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>In certain situations, Django may allow caches to store private data\nrelated to a particular session and then serve that data to requests\nwith a different session, or no session at all. This can lead to\ninformation disclosure and can be a vector for cache poisoning.</p>\n<p>When using Django sessions, Django will set a <code class=\"docutils literal notranslate\">Vary: Cookie</code> header to\nensure caches do not serve cached data to requests from other sessions.\nHowever, older versions of Internet Explorer (most likely only Internet\nExplorer 6, and Internet Explorer 7 if run on Windows XP or Windows Server\n2003) are unable to handle the <code class=\"docutils literal notranslate\">Vary</code> header in combination with many content\ntypes. Therefore, Django would remove the header if the request was made by\nInternet Explorer.</p>\n<p>To remedy this, the special behavior for these older Internet Explorer versions\nhas been removed, and the <code class=\"docutils literal notranslate\">Vary</code> header is no longer stripped from the\nresponse. In addition, modifications to the <code class=\"docutils literal notranslate\">Cache-Control</code> header for all\nInternet Explorer requests with a <code class=\"docutils literal notranslate\">Content-Disposition</code> header have also been\nremoved as they were found to have similar issues.</p>\n</section>\n<section id=\"malformed-redirect-urls-from-user-input-not-correctly-validated\">\n<h2>Malformed redirect URLs from user input not correctly validated<a class=\"heading-anchor\" href=\"#malformed-redirect-urls-from-user-input-not-correctly-validated\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>The validation for redirects did not correctly validate some malformed URLs,\nwhich are accepted by some browsers. This allows a user to be redirected to\nan unsafe URL unexpectedly.</p>\n<p>Django relies on user input in some cases (e.g.\n<code class=\"docutils literal notranslate\">django.contrib.auth.views.login()</code>, <code class=\"docutils literal notranslate\">django.contrib.comments</code>, and\n<a class=\"reference internal\" href=\"/en/dev/topics/i18n/\"><span class=\"doc\">i18n</span></a>) to redirect the user to an “on success” URL.\nThe security checks for these redirects (namely\n<code class=\"docutils literal notranslate\">django.utils.http.is_safe_url()</code>) did not correctly validate some malformed\nURLs, such as <code class=\"docutils literal notranslate\">http:\\\\\\\\\\\\djangoproject.com</code>, which are accepted by some\nbrowsers with more liberal URL parsing.</p>\n<p>To remedy this, the validation in <code class=\"docutils literal notranslate\">is_safe_url()</code> has been tightened to be\nable to handle and correctly validate these malformed URLs.</p>\n</section>","rootId":"django-1-4-13-release-notes","toc":[{"title":"Caches may incorrectly be allowed to store and serve private data","anchor":"caches-may-incorrectly-be-allowed-to-store-and-serve-private-data","children":[]},{"title":"Malformed redirect URLs from user input not correctly validated","anchor":"malformed-redirect-urls-from-user-input-not-correctly-validated","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/1.4.14","title":"Django 1.4.14 release notes","url":"/en/dev/releases/1.4.14/"},"next":{"docname":"releases/1.4.12","title":"Django 1.4.12 release notes","url":"/en/dev/releases/1.4.12/"},"formats":{"html":"/en/dev/releases/1.4.13/","markdown":"/en/dev/releases/1.4.13.md","json":"/en/dev/releases/1.4.13.json"},"source":"https://github.com/django/django/blob/main/docs/releases/1.4.13.txt","official":"https://docs.djangoproject.com/en/dev/releases/1.4.13/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11","1.10","1.9","1.8"],"inLocales":["en"]}