... View ¶ class View ¶ 属性 (とオプションのアクセサ): http_method_names メソッド as_view() dispatch() head() http_method_not_allowed() setup() TemplateView ¶ class TemplateView ¶ 属性 (とオプションのアクセサ): content_type extra_context http_method_names ... ngine template_name [ get_template_names() ] メソッド as_view() dispatch() get() get_context_data() head() http_method_not_allowed() render_to_response() setup() RedirectView ¶ class RedirectView ¶ 属性 (とオプションのアクセサ): http_method_names patter ... name permanent query_string url [ get_redirect_url() ] メソッド as_view() delete() dispatch() get() head() http_method_not_allowed() options() post() put() setup() 詳細ビュー ¶ DetailView ¶ class DetailView ¶ 属性 (とオプションのアクセサ): content_type ... ... View ¶ class View ¶ 属性 (とオプションのアクセサ): http_method_names メソッド as_view() dispatch() head() http_method_not_allowed() setup() TemplateView ¶ class TemplateView ¶ 属性 (とオプションのアクセサ): content_type extra_context http_method_names ... ngine template_name [ get_template_names() ] メソッド as_view() dispatch() get() get_context_data() head() http_method_not_allowed() render_to_response() setup() RedirectView ¶ class RedirectView ¶ 属性 (とオプションのアクセサ): http_method_names patter ... name permanent query_string url [ get_redirect_url() ] メソッド as_view() delete() dispatch() get() head() http_method_not_allowed() options() post() put() setup() 詳細ビュー ¶ DetailView ¶ class DetailView ¶ 属性 (とオプションのアクセサ): content_type ... ... regression causing ModelChoiceField to ignore prefetch_related() on its queryset ( #25496 ). Allowed "mode=memory" in SQLite test database name if supported ( #12118 ). Fixed system check crash on ForeignKey to abstract mod ... erent models that have the same field name, point to the same model, and have their reverse relations disabled ( #25545 ). Allowed filtering over a RawSQL annotation ( #25506 ). Made the Concat database function idempotent on SQLite ( #25517 ). Avoided ... r message when Django and South migrations exist in the same directory ( #25618 ). Fixed a regression in URLValidator that allowed URLs with consecutive dots in the domain section (like http://example..com/ ) to pass ( #25620 ). Fixed a crash with Gener ... ... regression causing ModelChoiceField to ignore prefetch_related() on its queryset ( #25496 ). Allowed "mode=memory" in SQLite test database name if supported ( #12118 ). Fixed system check crash on ForeignKey to abstract mod ... erent models that have the same field name, point to the same model, and have their reverse relations disabled ( #25545 ). Allowed filtering over a RawSQL annotation ( #25506 ). Made the Concat database function idempotent on SQLite ( #25517 ). Avoided ... r message when Django and South migrations exist in the same directory ( #25618 ). Fixed a regression in URLValidator that allowed URLs with consecutive dots in the domain section (like http://example..com/ ) to pass ( #25620 ). Fixed a crash with Gener ... ... un. DNS rebinding vulnerability when DEBUG=True ¶ Older versions of Django don't validate the Host header against settings.ALLOWED_HOSTS when settings.DEBUG=True . This makes them vulnerable to a DNS rebinding attack . While Django doesn't ship a module ... arbitrary SQL, which could be especially bad if the developers connect to the database with a superuser account. settings.ALLOWED_HOSTS is now validated regardless of DEBUG . For convenience, if ALLOWED_HOSTS is empty and DEBUG=True , the following var ... iations of localhost are allowed ['localhost', '127.0.0.1', '::1'] . If your local settings file has your production ALLOWED_HOSTS value, you must now omit ... ... un. DNS rebinding vulnerability when DEBUG=True ¶ Older versions of Django don't validate the Host header against settings.ALLOWED_HOSTS when settings.DEBUG=True . This makes them vulnerable to a DNS rebinding attack . While Django doesn't ship a module ... arbitrary SQL, which could be especially bad if the developers connect to the database with a superuser account. settings.ALLOWED_HOSTS is now validated regardless of DEBUG . For convenience, if ALLOWED_HOSTS is empty and DEBUG=True , the following var ... iations of localhost are allowed ['localhost', '127.0.0.1', '::1'] . If your local settings file has your production ALLOWED_HOSTS value, you must now omit ... ... 6188: AuthenticationForm における情報漏えい ¶ A regression in Django 1.11.8 made AuthenticationForm run its confirm_login_allowed() method even if an incorrect password is entered. This can leak information about a user, depending on what messages conf ... irm_login_allowed() raises. If confirm_login_allowed() isn't overridden, an attacker enter an arbitrary username and see if that user has be ... en set to is_active=False . If confirm_login_allowed() is overridden, more sensitive details could be leaked. This issue is fixed with the caveat that AuthenticationForm can n ... ... un. DNS rebinding vulnerability when DEBUG=True ¶ Older versions of Django don't validate the Host header against settings.ALLOWED_HOSTS when settings.DEBUG=True . This makes them vulnerable to a DNS rebinding attack . While Django doesn't ship a module ... arbitrary SQL, which could be especially bad if the developers connect to the database with a superuser account. settings.ALLOWED_HOSTS is now validated regardless of DEBUG . For convenience, if ALLOWED_HOSTS is empty and DEBUG=True , the following var ... iations of localhost are allowed ['localhost', '127.0.0.1', '::1'] . If your local settings file has your production ALLOWED_HOSTS value, you must now omit ... ... ory traversal vulnerability in ssi template tag ¶ In previous versions of Django it was possible to bypass the ALLOWED_INCLUDE_ROOTS setting used for security with the ssi template tag by specifying a relative path that starts with one of th ... e allowed roots. For example, if ALLOWED_INCLUDE_ROOTS = ("/var/www",) the following would be possible: {% ssi "/var/www/../../etc/p ... sue present releases series Directory traversal vulnerability versions bypass setting used specifying relative path starts allowed roots example following クイック検索 Last update: 2026年10月09日 « previous | up | next » ... ... un. DNS rebinding vulnerability when DEBUG=True ¶ Older versions of Django don't validate the Host header against settings.ALLOWED_HOSTS when settings.DEBUG=True . This makes them vulnerable to a DNS rebinding attack . While Django doesn't ship a module ... arbitrary SQL, which could be especially bad if the developers connect to the database with a superuser account. settings.ALLOWED_HOSTS is now validated regardless of DEBUG . For convenience, if ALLOWED_HOSTS is empty and DEBUG=True , the following var ... iations of localhost are allowed ['localhost', '127.0.0.1', '::1'] . If your local settings file has your production ALLOWED_HOSTS value, you must now omit ... 2026年10月08日