0
0
mirror of https://github.com/django/django.git synced 2024-11-29 06:03:25 +01:00
django/docs/releases/1.9.4.txt
Claude Paroz 552f03869e Added safety to URL decoding in is_safe_url() on Python 2
The errors='replace' parameter to force_text altered the URL before checking
it, which wasn't considered sane. Refs 24fc935218 and ada7a4aef.
2016-03-04 23:33:35 +01:00

9 lines
254 B
Plaintext

==========================
Django 1.9.4 release notes
==========================
*March 5, 2016*
Django 1.9.4 fixes a regression on Python 2 in the 1.9.3 security release
where ``utils.http.is_safe_url()`` crashes on bytestring URLs (:ticket:`26308`).