... in date template filter ¶ If an application allows users to specify an unvalidated format for dates and passes this format to the date filter, e.g. {{ last_updated|date:user_date_format }} , then a malicious user could obtain any sec ... template application allows user instead リリースノート November fixes security issue leak users specify unvalidated dates passes last malicious クイック検索 Last update: 2026年10月09日 « previous | up | next » ... ... request . user . email . endswith ( "@example.com" ): return redirect ( "/login/?next= %s " % request . path ) # ... user_passes_test ( test_func , login_url = None , redirect_field_name = 'next' ) [ソース] ¶ 便利なショートカットとして、 user_passes_t ... 使えば、呼び出し可能オブジェクトが False を返したときにリダイレクトできます: from django.contrib.auth.decorators import user_passes_test def email_check ( user ): return user . email . endswith ( "@example.com" ) @user_passes_test ( email_check ) def my_ ... view ( request ): ... user_passes_test() は必須引数として User オブジェクトを受け取り、そのユーザがページの閲覧を許可されていれば True を返す呼び出し可能オブ ... ... request . user . email . endswith ( "@example.com" ): return redirect ( "/login/?next= %s " % request . path ) # ... user_passes_test ( test_func , login_url = None , redirect_field_name = 'next' ) [ソース] ¶ 便利なショートカットとして、 user_passes_t ... 使えば、呼び出し可能オブジェクトが False を返したときにリダイレクトできます: from django.contrib.auth.decorators import user_passes_test def email_check ( user ): return user . email . endswith ( "@example.com" ) @user_passes_test ( email_check ) def my_ ... view ( request ): ... user_passes_test() は必須引数として User オブジェクトを受け取り、そのユーザがページの閲覧を許可されていれば True を返す呼び出し可能オブ ... ... ss' which itself references 'foo.css' ) or if the chain of files referencing other files is too deep to resolve in several passes. In the latter case, increase the number of passes using ManifestStaticFilesStorage.max_post_process_passes . When using M ... .g., StringIO and BytesIO ) uploaded to an ImageField using the test client now require a name attribute with a value that passes the validate_image_file_extension validator. See the note in Client.post() . FileField now moves rather than copies the fi ... ... te (e.g. custom control flow tags) should ensure that their code follows the new rules for stateful template tags The user_passes_test() , login_required() , and permission_required() , decorators from django.contrib.auth only apply to functions and no ... tween multiple renderings of the same include . Now that the cycle tag is thread safe, this leakage no longer occurs. user_passes_test , login_required and permission_required ¶ django.contrib.auth.decorators provides the decorators login_required , pe ... rmission_required and user_passes_test . Previously it was possible to use these decorators both on functions (where the first argument is 'request') and on ... ... in date template filter ¶ If an application allows users to specify an unvalidated format for dates and passes this format to the date filter, e.g. {{ last_updated|date:user_date_format }} , then a malicious user could obtain any sec ... ... ss' which itself references 'foo.css' ) or if the chain of files referencing other files is too deep to resolve in several passes. In the latter case, increase the number of passes using ManifestStaticFilesStorage.max_post_process_passes . When using M ... .g., StringIO and BytesIO ) uploaded to an ImageField using the test client now require a name attribute with a value that passes the validate_image_file_extension validator. See the note in Client.post() . FileField now moves rather than copies the fi ... ... te (e.g. custom control flow tags) should ensure that their code follows the new rules for stateful template tags The user_passes_test() , login_required() , and permission_required() , decorators from django.contrib.auth only apply to functions and no ... tween multiple renderings of the same include . Now that the cycle tag is thread safe, this leakage no longer occurs. user_passes_test , login_required and permission_required ¶ django.contrib.auth.decorators provides the decorators login_required , pe ... rmission_required and user_passes_test . Previously it was possible to use these decorators both on functions (where the first argument is 'request') and on ... ... s leak possibility in date template filter ¶ If an application allows users to specify an unvalidated format for dates and passes this format to the date filter, e.g. {{ last_updated|date:user_date_format }} , then a malicious user could obtain any sec ... ... AI-generated output. Ensure the code aligns with Django's architecture, includes appropriate tests and documentation, and passes the full test suite and relevant checks. Double-check the proposal against the Contribution checklist . We align with simi ... not be considered trivial , first ensure it has an accepted ticket before proceeding with the review. If the pull request passes all the criteria below and is not your own, please set the "Triage Stage" on the corresponding Trac ticket to "Ready for c ... 2026年10月08日