Luke Plant 45c7f427ce Fixed #14445 - Use HMAC and constant-time comparison functions where needed. ... All adhoc MAC applications have been updated to use HMAC, using SHA1 to generate unique keys for each application based on the SECRET_KEY, which is common practice for this situation. In all cases, backwards compatibility with existing hashes has been maintained, aiming to phase this out as per the normal deprecation process. In this way, under most normal circumstances the old hashes will have expired (e.g. by session expiration etc.) before they become invalid. In the case of the messages framework and the cookie backend, which was already using HMAC, there is the possibility of a backwards incompatibility if the SECRET_KEY is shorter than the default 50 bytes, but the low likelihood and low impact meant compatibility code was not worth it. All known instances where tokens/hashes were compared using simple string equality, which could potentially open timing based attacks, have also been fixed using a constant-time comparison function. There are no known practical attacks against the existing implementations, so these security improvements will not be backported. git-svn-id: http://code.djangoproject.com/svn/django/trunk@14218 bcc190cf-cafb-0310-a4f2-bffc1f526a37		2010-10-14 20:54:30 +00:00
..
custom_comments	Fixed #8630: finished the custom comment app API that was left out of 1.0. This means it's now possible to override any of the models, forms, or views used by the comment app; see the new custom comment app docs for details and an example. Thanks to Thejaswi Puthraya for the original patch, and to carljm for docs and tests.	2009-02-23 22:16:26 +00:00
fixtures	Changed the comments post view code to avoid raising an exception if handed invalid data for the object pk. Thanks to Leo for the test.	2010-03-16 22:37:45 +00:00
tests	Fixed #14445 - Use HMAC and constant-time comparison functions where needed.	2010-10-14 20:54:30 +00:00
__init__.py
models.py	Changed the comments post view code to avoid raising an exception if handed invalid data for the object pk. Thanks to Leo for the test.	2010-03-16 22:37:45 +00:00
urls_admin.py	Fixed a couple of test-ordering-dependant failures introduced in [11639] that caused test failures when running the whole test suite.	2009-10-24 00:23:47 +00:00
urls.py	Fixed #8630: finished the custom comment app API that was left out of 1.0. This means it's now possible to override any of the models, forms, or views used by the comment app; see the new custom comment app docs for details and an example. Thanks to Thejaswi Puthraya for the original patch, and to carljm for docs and tests.	2009-02-23 22:16:26 +00:00