{"title":"Django 1.4.7 release notes","version":"dev","locale":"en","docname":"releases/1.4.7","url":"/en/dev/releases/1.4.7/","canonical":"https://djangodocs.dev/en/dev/releases/1.4.7/","summary":"Django 1.4.7 fixes one security issue present in previous Django releases in the 1.4 series.","html":"<h1>Django 1.4.7 release notes<a class=\"heading-anchor\" href=\"#django-1-4-7-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>September 10, 2013</em></p>\n<p>Django 1.4.7 fixes one security issue present in previous Django releases in\nthe 1.4 series.</p>\n<section id=\"directory-traversal-vulnerability-in-ssi-template-tag\">\n<h2>Directory traversal vulnerability in <code class=\"docutils literal notranslate\">ssi</code> template tag<a class=\"heading-anchor\" href=\"#directory-traversal-vulnerability-in-ssi-template-tag\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>In previous versions of Django it was possible to bypass the\n<code class=\"docutils literal notranslate\">ALLOWED_INCLUDE_ROOTS</code> setting used for security with the <code class=\"docutils literal notranslate\">ssi</code>\ntemplate tag by specifying a relative path that starts with one of the allowed\nroots. For example, if <code class=\"docutils literal notranslate\">ALLOWED_INCLUDE_ROOTS = (&quot;/var/www&quot;,)</code> the following\nwould be possible:</p>\n<div class=\"code-block\" data-language=\"html+django\"><div class=\"code-block-toolbar\"><span class=\"code-block-language\">Django template</span><button type=\"button\" class=\"copy-button\" data-copy hidden><span class=\"copy-button-label\">Copy</span></button></div><pre role=\"group\" tabindex=\"0\" aria-label=\"Django template code\"><code><span class=\"cp\">{%</span> <span class=\"k\">ssi</span> <span class=\"s2\">&quot;/var/www/../../etc/passwd&quot;</span> <span class=\"cp\">%}</span>\n</code></pre></div>\n<p>In practice this is not a very common problem, as it would require the template\nauthor to put the <code class=\"docutils literal notranslate\">ssi</code> file in a user-controlled variable, but it’s\npossible in principle.</p>\n</section>","rootId":"django-1-4-7-release-notes","toc":[{"title":"Directory traversal vulnerability in ssi template tag","anchor":"directory-traversal-vulnerability-in-ssi-template-tag","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/1.4.8","title":"Django 1.4.8 release notes","url":"/en/dev/releases/1.4.8/"},"next":{"docname":"releases/1.4.6","title":"Django 1.4.6 release notes","url":"/en/dev/releases/1.4.6/"},"formats":{"html":"/en/dev/releases/1.4.7/","markdown":"/en/dev/releases/1.4.7.md","json":"/en/dev/releases/1.4.7.json"},"source":"https://github.com/django/django/blob/main/docs/releases/1.4.7.txt","official":"https://docs.djangoproject.com/en/dev/releases/1.4.7/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11","1.10","1.9","1.8"],"inLocales":["en"]}