---
title: "Django 1.4.7 release notes"
version: 1.9
locale: pt-br
source: https://docs.djangoproject.com/pt-br/1.9/releases/1.4.7/
canonical: https://djangodocs.dev/pt-br/1.9/releases/1.4.7/
---
# Django 1.4.7 release notes

*September 10, 2013*

Django 1.4.7 fixes one security issue present in previous Django releases in
the 1.4 series.

## Directory traversal vulnerability in [`ssi`](/pt-br/1.9/ref/templates/builtins/#std-templatetag-ssi) template tag

### Directory traversal vulnerability in `ssi` template tag

In previous versions of Django it was possible to bypass the
[`ALLOWED_INCLUDE_ROOTS`](/pt-br/1.9/ref/settings/#std-setting-ALLOWED_INCLUDE_ROOTS) setting used for security with the [`ssi`](/pt-br/1.9/ref/templates/builtins/#std-templatetag-ssi)
template tag by specifying a relative path that starts with one of the allowed
roots. For example, if `ALLOWED_INCLUDE_ROOTS = ("/var/www",)` the following
would be possible:

```html+django
{% ssi "/var/www/../../etc/passwd" %}
```

In practice this is not a very common problem, as it would require the template
author to put the [`ssi`](/pt-br/1.9/ref/templates/builtins/#std-templatetag-ssi) file in a user-controlled variable, but it’s
possible in principle.