... via user-supplied numeric redirect URLs ¶ Django relies on user input in some cases (e.g. django.contrib.auth.views.login() and i18n ) to redirect t ... r to an "on success" URL. The security check for these redirects (namely django.utils.http.is_safe_url() ) considered some numeric URLs (e.g. http:999999999 ) "safe" when they shouldn't be. Also, if a developer relies on is_safe_url() to provide safe re ... development aid. 目次 Django 1.8.18 リリースノート CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() 前のトピックへ Django 1.8.19 リリー ... ... XSS attack via user-supplied numeric redirect URLs ¶ Django relies on user input in some cases (e.g. django.contrib.auth.views.login() and i18n ) to redirect t ... r to an "on success" URL. The security check for these redirects (namely django.utils.http.is_safe_url() ) considered some numeric URLs (e.g. http:999999999 ) "safe" when they shouldn't be. Also, if a developer relies on is_safe_url() to provide safe re ... tiple ( #27993 ). 目次 Django 1.10.7 リリースノート CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() バグ修正 前のトピックへ Django 1.1 ... ... via user-supplied numeric redirect URLs ¶ Django relies on user input in some cases (e.g. django.contrib.auth.views.login() and i18n ) to redirect t ... r to an "on success" URL. The security check for these redirects (namely django.utils.http.is_safe_url() ) considered some numeric URLs (e.g. http:999999999 ) "safe" when they shouldn't be. Also, if a developer relies on is_safe_url() to provide safe re ... development aid. 目次 Django 1.8.18 リリースノート CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() 前のトピックへ Django 1.8.19 リリー ... ... 、1.9.x シリーズの最終リリースとなります。 CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs ¶ Django relies on user input in some cases (e.g. django.contrib.auth.views.login() and i18n ) to redirect t ... r to an "on success" URL. The security check for these redirects (namely django.utils.http.is_safe_url() ) considered some numeric URLs (e.g. http:999999999 ) "safe" when they shouldn't be. Also, if a developer relies on is_safe_url() to provide safe re ... year ( #27637 ). 目次 Django 1.9.13 リリースノート CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() バグ修正 前のトピックへ Django 1.1 ... ... XSS attack via user-supplied numeric redirect URLs ¶ Django relies on user input in some cases (e.g. django.contrib.auth.views.login() and i18n ) to redirect t ... r to an "on success" URL. The security check for these redirects (namely django.utils.http.is_safe_url() ) considered some numeric URLs (e.g. http:999999999 ) "safe" when they shouldn't be. Also, if a developer relies on is_safe_url() to provide safe re ... tiple ( #27993 ). 目次 Django 1.10.7 リリースノート CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() バグ修正 前のトピックへ Django 1.1 ... ... 、1.9.x シリーズの最終リリースとなります。 CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs ¶ Django relies on user input in some cases (e.g. django.contrib.auth.views.login() and i18n ) to redirect t ... r to an "on success" URL. The security check for these redirects (namely django.utils.http.is_safe_url() ) considered some numeric URLs (e.g. http:999999999 ) "safe" when they shouldn't be. Also, if a developer relies on is_safe_url() to provide safe re ... year ( #27637 ). 目次 Django 1.9.13 リリースノート CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() バグ修正 前のトピックへ Django 1.1 ... ... ectly) ( #28229 ). Prevented attribute values in the django/forms/widgets/attrs.html template from being localized so that numeric attributes (e.g. max and min ) of NumberInput work correctly ( #28303 ). Removed casting of the option value to a string i ... t , SelectMultiple , and Select widgets ( #28176 ). In Django 1.11.1, casting was added in Python to avoid localization of numeric values in Django templates, but this made some use cases more difficult. Casting is now done in the template using the |st ... orrect warning regression Model using list filter admin invalid based models primary QuerySet context login values widgets numeric casting クイック検索 Last update: 2026年10月09日 « previous | up | next » ... ... ectly) ( #28229 ). Prevented attribute values in the django/forms/widgets/attrs.html template from being localized so that numeric attributes (e.g. max and min ) of NumberInput work correctly ( #28303 ). Removed casting of the option value to a string i ... t , SelectMultiple , and Select widgets ( #28176 ). In Django 1.11.1, casting was added in Python to avoid localization of numeric values in Django templates, but this made some use cases more difficult. Casting is now done in the template using the |st ... ... rs [A-Za-z0-9] plus hyphen ('-') or dot ('.'). IP addresses -- both IPv4 and IPv6 -- are permitted. Port, if specified, is numeric. Any deviation from this will now be rejected, raising the exception django.core.exceptions.SuspiciousOperation . Redirect ... ... rs [A-Za-z0-9] plus hyphen ('-') or dot ('.'). IP addresses -- both IPv4 and IPv6 -- are permitted. Port, if specified, is numeric. Any deviation from this will now be rejected, raising the exception django.core.exceptions.SuspiciousOperation . Redirect ... 2026年10月08日