{"title":"Django 1.6.6 release notes","version":"dev","locale":"en","docname":"releases/1.6.6","url":"/en/dev/releases/1.6.6/","canonical":"https://djangodocs.dev/en/dev/releases/1.6.6/","summary":"Django 1.6.6 fixes several security issues and bugs in 1.6.5. In certain situations, URL reversing could generate scheme-relative URLs (URLs starting with…","html":"

Django 1.6.6 release notesLink to this heading#

\n

August 20, 2014

\n

Django 1.6.6 fixes several security issues and bugs in 1.6.5.

\n
\n

reverse() could generate URLs pointing to other hostsLink to this heading#

\n

In certain situations, URL reversing could generate scheme-relative URLs (URLs\nstarting with two slashes), which could unexpectedly redirect a user to a\ndifferent host. An attacker could exploit this, for example, by redirecting\nusers to a phishing site designed to ask for user’s passwords.

\n

To remedy this, URL reversing now ensures that no URL starts with two slashes\n(//), replacing the second slash with its URL encoded counterpart (%2F). This\napproach ensures that semantics stay the same, while making the URL relative to\nthe domain and not to the scheme.

\n
\n
\n

File upload denial-of-serviceLink to this heading#

\n

Before this release, Django’s file upload handing in its default configuration\nmay degrade to producing a huge number of os.stat() system calls when a\nduplicate filename is uploaded. Since stat() may invoke IO, this may\nproduce a huge data-dependent slowdown that slowly worsens over time. The net\nresult is that given enough time, a user with the ability to upload files can\ncause poor performance in the upload handler, eventually causing it to become\nvery slow simply by uploading 0-byte files. At this point, even a slow network\nconnection and few HTTP requests would be all that is necessary to make a site\nunavailable.

\n

We’ve remedied the issue by changing the algorithm for generating file names\nif a file with the uploaded name already exists.\nStorage.get_available_name() now appends an\nunderscore plus a random 7 character alphanumeric string (e.g. "_x3a1gho"),\nrather than iterating through an underscore followed by a number (e.g.\n"_1", "_2", etc.).

\n
\n
\n

RemoteUserMiddleware session hijackingLink to this heading#

\n

When using the RemoteUserMiddleware\nand the RemoteUserBackend, a change to the REMOTE_USER header between\nrequests without an intervening logout could result in the prior user’s session\nbeing co-opted by the subsequent user. The middleware now logs the user out on\na failed login attempt.

\n
\n
\n

Data leakage via query string manipulation in contrib.adminLink to this heading#

\n

In older versions of Django it was possible to reveal any field’s data by\nmodifying the “popup” and “to_field” parameters of the query string on an admin\nchange form page. For example, requesting a URL like\n/admin/auth/user/?_popup=1&t=password and viewing the page’s HTML allowed\nviewing the password hash of each user. While the admin requires users to have\npermissions to view the change form pages in the first place, this could leak\ndata if you rely on users having access to view only certain fields on a model.

\n

To address the issue, an exception will now be raised if a to_field value\nthat isn’t a related field to a model that has been registered with the admin\nis specified.

\n
\n
\n

BugfixesLink to this heading#

\n\n
","rootId":"django-1-6-6-release-notes","toc":[{"title":"reverse() could generate URLs pointing to other hosts","anchor":"reverse-could-generate-urls-pointing-to-other-hosts","children":[]},{"title":"File upload denial-of-service","anchor":"file-upload-denial-of-service","children":[]},{"title":"RemoteUserMiddleware session hijacking","anchor":"remoteusermiddleware-session-hijacking","children":[]},{"title":"Data leakage via query string manipulation in contrib.admin","anchor":"data-leakage-via-query-string-manipulation-in-contrib-admin","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/1.6.7","title":"Django 1.6.7 release notes","url":"/en/dev/releases/1.6.7/"},"next":{"docname":"releases/1.6.5","title":"Django 1.6.5 release notes","url":"/en/dev/releases/1.6.5/"},"formats":{"html":"/en/dev/releases/1.6.6/","markdown":"/en/dev/releases/1.6.6.md","json":"/en/dev/releases/1.6.6.json"},"source":"https://github.com/django/django/blob/main/docs/releases/1.6.6.txt","official":"https://docs.djangoproject.com/en/dev/releases/1.6.6/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11","1.10","1.9","1.8"],"inLocales":["en"]}