---
title: "Django 1.4.6 release notes"
version: 5.1
locale: pt-br
source: https://docs.djangoproject.com/pt-br/5.1/releases/1.4.6/
canonical: https://djangodocs.dev/pt-br/5.1/releases/1.4.6/
---
# Django 1.4.6 release notes

*August 13, 2013*

Django 1.4.6 fixes one security issue present in previous Django releases in
the 1.4 series, as well as one other bug.

This is the sixth bugfix/security release in the Django 1.4 series.

## Mitigated possible XSS attack via user-supplied redirect URLs

Django relies on user input in some cases (e.g.
`django.contrib.auth.views.login()`, `django.contrib.comments`, and
[i18n](/pt-br/5.1/topics/i18n/)) to redirect the user to an “on success” URL.
The security checks for these redirects (namely
`django.utils.http.is_safe_url()`) didn’t check if the scheme is `http(s)`
and as such allowed `javascript:...` URLs to be entered. If a developer
relied on `is_safe_url()` to provide safe redirect targets and put such a
URL into a link, they could suffer from a XSS attack. This bug doesn’t affect
Django currently, since we only put this URL into the `Location` response
header and browsers seem to ignore JavaScript there.

## Bugfixes

- Fixed an obscure bug with the [`override_settings()`](/pt-br/5.1/topics/testing/tools/#django.test.override_settings)
  decorator. If you hit an `AttributeError: 'Settings' object has no attribute
  '_original_allowed_hosts'` exception, it’s probably fixed (#20636).