... edirect classes, performing additional validation of the scheme of the URL to redirect to (since, both within Django's own supplied applications and many third-party applications, accepting a user-supplied redirect target is a common pattern). Since then ... is added; this function takes a URL and a hostname, and checks that the URL is either relative, or if absolute matches the supplied hostname. This function is intended for use whenever user-supplied redirect targets are accepted, to ensure that such redi ... ary third-party sites. 2. All of Django's own built-in views -- primarily in the authentication system -- which allow user-supplied redirect targets now use is_safe_url to validate the supplied URL. 目次 Django 1.3.5 リリースノート Host header poisoning ... ... edirect classes, performing additional validation of the scheme of the URL to redirect to (since, both within Django's own supplied applications and many third-party applications, accepting a user-supplied redirect target is a common pattern). Since then ... is added; this function takes a URL and a hostname, and checks that the URL is either relative, or if absolute matches the supplied hostname. This function is intended for use whenever user-supplied redirect targets are accepted, to ensure that such redi ... ary third-party sites. 2. All of Django's own built-in views -- primarily in the authentication system -- which allow user-supplied redirect targets now use is_safe_url to validate the supplied URL. 目次 Django 1.4.3 リリースノート Host header poisoning ... ... edirect classes, performing additional validation of the scheme of the URL to redirect to (since, both within Django's own supplied applications and many third-party applications, accepting a user-supplied redirect target is a common pattern). Since then ... is added; this function takes a URL and a hostname, and checks that the URL is either relative, or if absolute matches the supplied hostname. This function is intended for use whenever user-supplied redirect targets are accepted, to ensure that such redi ... ary third-party sites. 2. All of Django's own built-in views -- primarily in the authentication system -- which allow user-supplied redirect targets now use is_safe_url to validate the supplied URL. 目次 Django 1.3.5 リリースノート Host header poisoning ... ... edirect classes, performing additional validation of the scheme of the URL to redirect to (since, both within Django's own supplied applications and many third-party applications, accepting a user-supplied redirect target is a common pattern). Since then ... is added; this function takes a URL and a hostname, and checks that the URL is either relative, or if absolute matches the supplied hostname. This function is intended for use whenever user-supplied redirect targets are accepted, to ensure that such redi ... ary third-party sites. 2. All of Django's own built-in views -- primarily in the authentication system -- which allow user-supplied redirect targets now use is_safe_url to validate the supplied URL. 目次 Django 1.4.3 リリースノート Host header poisoning ... ... racters at the start of a URL in an anchor href . 目次 Django 1.4.20 リリースノート Mitigated possible XSS attack via user-supplied redirect URLs 前のトピックへ Django 1.4.21 リリースノート 次のトピックへ Django 1.4.19 リリースノート 関連キーワード URLs ... safe user redirect control characters security issue attack relies browsers ignore リリースノート March fixes Mitigated supplied input cases contrib auth views login success checks クイック検索 Last update: 2026年10月09日 « previous | up | next » ... ... one other bug. This is the sixth bugfix/security release in the Django 1.4 series. Mitigated possible XSS attack via user-supplied redirect URLs ¶ Django relies on user input in some cases (e.g. django.contrib.auth.views.login() , django.contrib.comment ... ed_hosts' exception, it's probably fixed (#20636). 目次 Django 1.4.6 リリースノート Mitigated possible XSS attack via user-supplied redirect URLs バグ修正 前のトピックへ Django 1.4.7 リリースノート 次のトピックへ Django 1.4.5 リリースノート 関連キーワード ... URLs contrib http allowed リリースノート August fixes issue present previous releases well sixth bugfix release Mitigated supplied relies input クイック検索 Last update: 2026年10月09日 « previous | up | next » ... ... via user-supplied numeric redirect URLs ¶ Django relies on user input in some cases (e.g. django.contrib.auth.views.login() and i18n ) to re ... only as a development aid. 目次 Django 1.8.18 リリースノート CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() 前のトピックへ Django 1.8. ... fe user they view attack numeric URLs relies views redirects http provide serve リリースノート April fixes security issues supplied input cases contrib auth login クイック検索 Last update: 2026年10月09日 « previous | up | next » ... ... XSS attack via user-supplied numeric redirect URLs ¶ Django relies on user input in some cases (e.g. django.contrib.auth.views.login() and i18n ) to re ... SelectMultiple ( #27993 ). 目次 Django 1.10.7 リリースノート CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() バグ修正 前のトピックへ Dj ... fe user they view attack numeric URLs relies views redirects http provide serve リリースノート April fixes security issues supplied input cases contrib auth login クイック検索 Last update: 2026年10月09日 « previous | up | next » ... ... 、1.9.x シリーズの最終リリースとなります。 CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs ¶ Django relies on user input in some cases (e.g. django.contrib.auth.views.login() and i18n ) to re ... in a leap year ( #27637 ). 目次 Django 1.9.13 リリースノート CVE-2017-7233: Open redirect and possible XSS attack via user-supplied numeric redirect URLs CVE-2017-7234: Open redirect vulnerability in django.views.static.serve() バグ修正 前のトピックへ Dj ... ース attack numeric URLs relies views redirects http provide serve リリースノート April セキュリティ 問題 今回 シリーズ 最終 supplied クイック検索 Last update: 2026年10月09日 « previous | up | next » ... ... user-supplied redirect URLs ¶ Django relies on user input in some cases (e.g. django.contrib.auth.views.login() , django.contrib.comment ... ed_hosts' exception, it's probably fixed (#20636). 目次 Django 1.5.2 リリースノート Mitigated possible XSS attack via user-supplied redirect URLs XSS vulnerability in django.contrib.admin バグ修正 前のトピックへ Django 1.5.3 リリースノート 次のトピックへ ... curity attack URLs cases http link admin prefetch related databases aliases リリースノート August bugfix release Mitigated supplied relies input クイック検索 Last update: 2026年10月09日 « previous | up | next » ... 2026年10月08日