{"title":"Django 1.6.5 release notes","version":"dev","locale":"en","docname":"releases/1.6.5","url":"/en/dev/releases/1.6.5/","canonical":"https://djangodocs.dev/en/dev/releases/1.6.5/","summary":"Django 1.6.5 fixes two security issues and several bugs in 1.6.4. In certain situations, Django may allow caches to store private data related to a…","html":"

Django 1.6.5 release notesLink to this heading#

\n

May 14, 2014

\n

Django 1.6.5 fixes two security issues and several bugs in 1.6.4.

\n
\n

Issue: Caches may incorrectly be allowed to store and serve private dataLink to this heading#

\n

In certain situations, Django may allow caches to store private data\nrelated to a particular session and then serve that data to requests\nwith a different session, or no session at all. This can lead to\ninformation disclosure and can be a vector for cache poisoning.

\n

When using Django sessions, Django will set a Vary: Cookie header to\nensure caches do not serve cached data to requests from other sessions.\nHowever, older versions of Internet Explorer (most likely only Internet\nExplorer 6, and Internet Explorer 7 if run on Windows XP or Windows Server\n2003) are unable to handle the Vary header in combination with many content\ntypes. Therefore, Django would remove the header if the request was made by\nInternet Explorer.

\n

To remedy this, the special behavior for these older Internet Explorer versions\nhas been removed, and the Vary header is no longer stripped from the\nresponse. In addition, modifications to the Cache-Control header for all\nInternet Explorer requests with a Content-Disposition header have also been\nremoved as they were found to have similar issues.

\n
\n
\n

Issue: Malformed redirect URLs from user input not correctly validatedLink to this heading#

\n

The validation for redirects did not correctly validate some malformed URLs,\nwhich are accepted by some browsers. This allows a user to be redirected to\nan unsafe URL unexpectedly.

\n

Django relies on user input in some cases (e.g.\ndjango.contrib.auth.views.login(), django.contrib.comments, and\ni18n) to redirect the user to an “on success” URL.\nThe security checks for these redirects (namely\ndjango.utils.http.is_safe_url()) did not correctly validate some malformed\nURLs, such as http:\\\\\\\\\\\\djangoproject.com, which are accepted by some\nbrowsers with more liberal URL parsing.

\n

To remedy this, the validation in is_safe_url() has been tightened to be\nable to handle and correctly validate these malformed URLs.

\n
\n
\n

BugfixesLink to this heading#

\n\n
","rootId":"django-1-6-5-release-notes","toc":[{"title":"Issue: Caches may incorrectly be allowed to store and serve private data","anchor":"issue-caches-may-incorrectly-be-allowed-to-store-and-serve-private-data","children":[]},{"title":"Issue: Malformed redirect URLs from user input not correctly validated","anchor":"issue-malformed-redirect-urls-from-user-input-not-correctly-validated","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/1.6.6","title":"Django 1.6.6 release notes","url":"/en/dev/releases/1.6.6/"},"next":{"docname":"releases/1.6.4","title":"Django 1.6.4 release notes","url":"/en/dev/releases/1.6.4/"},"formats":{"html":"/en/dev/releases/1.6.5/","markdown":"/en/dev/releases/1.6.5.md","json":"/en/dev/releases/1.6.5.json"},"source":"https://github.com/django/django/blob/main/docs/releases/1.6.5.txt","official":"https://docs.djangoproject.com/en/dev/releases/1.6.5/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11","1.10","1.9","1.8"],"inLocales":["en"]}