... only occur when Django is run on a version of Python that is no longer receiving security updates ("end-of-life") are not considered valid , even if that version is listed as supported by Django. User input must be sanitized ¶ Reports based on a failure t ... properly handle user input. This principle is explained in our security documentation . For example, the following is not considered valid because email has not been sanitized: from django.core.mail import send_mail from django.http import JsonResponse de ... it is the developer's responsibility to safely process user input for these functions. For instance, the following is not considered valid because query has not been sanitized: from django.shortcuts import HttpResponse from .models import MyModel def my_p ... ... only occur when Django is run on a version of Python that is no longer receiving security updates ("end-of-life") are not considered valid , even if that version is listed as supported by Django. User input must be sanitized ¶ Reports based on a failure t ... properly handle user input. This principle is explained in our security documentation . For example, the following is not considered valid because email has not been sanitized: from django.core.mail import send_mail from django.http import JsonResponse de ... it is the developer's responsibility to safely process user input for these functions. For instance, the following is not considered valid because query has not been sanitized: from django.shortcuts import HttpResponse from .models import MyModel def my_p ... ... redirect the user to an "on success" URL. The security check for these redirects (namely django.utils.http.is_safe_url() ) considered some URLs with basic authentication credentials "safe" when they shouldn't be. For example, a URL like http://mysite.examp ... le.com\@attacker.com would be considered safe if the request's host is http://mysite.example.com , but redirecting to this URL sends the user to attacker.com . Als ... ... redirect the user to an "on success" URL. The security check for these redirects (namely django.utils.http.is_safe_url() ) considered some URLs with basic authentication credentials "safe" when they shouldn't be. For example, a URL like http://mysite.examp ... le.com\@attacker.com would be considered safe if the request's host is http://mysite.example.com , but redirecting to this URL sends the user to attacker.com . Als ... ... redirect the user to an "on success" URL. The security check for these redirects (namely django.utils.http.is_safe_url() ) considered some URLs with basic authentication credentials "safe" when they shouldn't be. For example, a URL like http://mysite.examp ... le.com\@attacker.com would be considered safe if the request's host is http://mysite.example.com , but redirecting to this URL sends the user to attacker.com . Als ... ... redirect the user to an "on success" URL. The security check for these redirects (namely django.utils.http.is_safe_url() ) considered some URLs with basic authentication credentials "safe" when they shouldn't be. For example, a URL like http://mysite.examp ... le.com\@attacker.com would be considered safe if the request's host is http://mysite.example.com , but redirecting to this URL sends the user to attacker.com . Als ... ... checks for these redirects (namely django.utils.http.is_safe_url() ) accepted URLs with leading control characters and so considered URLs like \x08javascript:... safe. This issue doesn't affect Django currently, since we only put this URL into the Locatio ... ... checks for these redirects (namely django.utils.http.is_safe_url() ) accepted URLs with leading control characters and so considered URLs like \x08javascript:... safe. This issue doesn't affect Django currently, since we only put this URL into the Locatio ... ... The django.db.models.Model.__eq__() method is now defined in a way where instances of a proxy model and its base model are considered equal when primary keys match. Previously only instances of exact same class were considered equal on primary key match. T ... he django.db.models.Model.__eq__() method has changed such that two Model instances without primary key values won't be considered equal (unless they are the same instance). The django.db.models.Model.__hash__() method will now raise TypeError when call ... em to change their content. For example, you might want to override MyFormClass.base_fields (although this attribute isn't considered a public API) to change the ordering of fields for all MyFormClass instances; or similarly, you could override self.fields ... ... redirect the user to an "on success" URL. The security check for these redirects (namely django.utils.http.is_safe_url() ) considered some numeric URLs (e.g. http:999999999 ) "safe" when they shouldn't be. Also, if a developer relies on is_safe_url() to pr ... 2026年10月08日