Commit Graph

17 Commits

Author SHA1 Message Date
Luke Plant 45c7f427ce Fixed #14445 - Use HMAC and constant-time comparison functions where needed.
All adhoc MAC applications have been updated to use HMAC, using SHA1 to
generate unique keys for each application based on the SECRET_KEY, which is
common practice for this situation. In all cases, backwards compatibility
with existing hashes has been maintained, aiming to phase this out as per
the normal deprecation process. In this way, under most normal
circumstances the old hashes will have expired (e.g. by session expiration
etc.) before they become invalid.

In the case of the messages framework and the cookie backend, which was
already using HMAC, there is the possibility of a backwards incompatibility
if the SECRET_KEY is shorter than the default 50 bytes, but the low
likelihood and low impact meant compatibility code was not worth it.

All known instances where tokens/hashes were compared using simple string
equality, which could potentially open timing based attacks, have also been
fixed using a constant-time comparison function.

There are no known practical attacks against the existing implementations,
so these security improvements will not be backported.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@14218 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-10-14 20:54:30 +00:00
Russell Keith-Magee 3c99d06229 Fixed #13951 -- Corrected docstring in formtools wizard. Thanks to suzaku for the report, and lrekucki for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13630 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-08-23 08:11:24 +00:00
Jacob Kaplan-Moss 17c466a57b Fixed a silly bug in [12644].
Kids, please don't drink and code; the commit you save might be your own.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@12646 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-03-01 23:59:22 +00:00
Jacob Kaplan-Moss 4c18facdf7 Fixed #1104: set `FormWizard.extra_context` in `__init__` to avoid context leakage.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@12644 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-03-01 23:26:08 +00:00
Luke Plant 4bff194633 Fixed #12804 - regression with decorating admin views.
This is a BACKWARDS INCOMPATIBLE change, because it removes the flawed
'auto_adapt_to_methods' decorator, and replaces it with 'method_decorator'
which must be applied manually when necessary, as described in the 1.2
release notes.

For users of 1.1 and 1.0, this affects the decorators:

 * login_required
 * permission_required
 * user_passes_test

For those following trunk, this also affects:

 * csrf_protect
 * anything created with decorator_from_middleware 

If a decorator does not depend on the signature of the function it is
supposed to decorate (for example if it only does post-processing of the
result), it will not be affected.
 



git-svn-id: http://code.djangoproject.com/svn/django/trunk@12399 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-02-09 15:02:39 +00:00
Luke Plant 7230a995ce Moved contrib.csrf.* to core code.
There is stub code for backwards compatiblity with Django 1.1 imports.

The documentation has been updated, but has been left in
docs/contrib/csrf.txt for now, in order to avoid dead links to
documentation on the website.



git-svn-id: http://code.djangoproject.com/svn/django/trunk@11661 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27 00:36:34 +00:00
Luke Plant 8e70cef9b6 Fixed #9977 - CsrfMiddleware gets template tag added, session dependency removed, and turned on by default.
This is a large change to CSRF protection for Django.  It includes:

 * removing the dependency on the session framework.
 * deprecating CsrfResponseMiddleware, and replacing with a core template tag.
 * turning on CSRF protection by default by adding CsrfViewMiddleware to
   the default value of MIDDLEWARE_CLASSES.
 * protecting all contrib apps (whatever is in settings.py)
   using a decorator.

For existing users of the CSRF functionality, it should be a seamless update,
but please note that it includes DEPRECATION of features in Django 1.1,
and there are upgrade steps which are detailed in the docs.

Many thanks to 'Glenn' and 'bthomas', who did a lot of the thinking and work
on the patch, and to lots of other people including Simon Willison and
Russell Keith-Magee who refined the ideas.

Details of the rationale for these changes is found here:

http://code.djangoproject.com/wiki/CsrfProtection

As of this commit, the CSRF code is mainly in 'contrib'.  The code will be
moved to core in a separate commit, to make the changeset as readable as
possible.



git-svn-id: http://code.djangoproject.com/svn/django/trunk@11660 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-26 23:23:07 +00:00
Jacob Kaplan-Moss 0c66bac4f3 Marked a handful of missed strings for translation. Fixes #8644, #8617, and #8610.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@8679 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-08-28 20:17:31 +00:00
Jacob Kaplan-Moss 70966cb9c7 Fixed #6893: `FormWizard` now properly updates its `step` value. Thanks, siddhi and wamberg.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@8603 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-08-26 21:33:56 +00:00
Jacob Kaplan-Moss 6056ab1bee Fixed #6209: handle `BooleanField`s in `FormPreview` and `FormWizard`. In the process, broke the the security hash calculation out to a helper function. Thanks to mcroydon and rajeshdhawan.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@8597 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-08-26 20:19:12 +00:00
Gary Wilson Jr c85c8f8891 Fixed #7919 -- md5 and sha modules are deprecated since Python 2.5, use hashlib module when available. Patch from Karen Tracey.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@8193 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-08-02 05:56:57 +00:00
Jacob Kaplan-Moss 46786b4193 Fixed #7741: django.newforms is now django.forms. This is obviously a backwards-incompatible change. There's a warning upon import of django.newforms itself, but deeper imports will raise errors.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@7971 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-07-19 01:22:26 +00:00
Adrian Holovaty 260d3be69f Fixed #7354 -- Fixed a Python 2.3 compatibility issue in formtools/wizard.py. Thanks, mage
git-svn-id: http://code.djangoproject.com/svn/django/trunk@7657 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-06-16 04:06:50 +00:00
Malcolm Tredinnick 9b52f35f35 Added "svn:eol-style native" to every text file in the tree (*.txt, *.html,
*.py, *.xml and AUTHORS, etc). Added "svn:ignore *.pyc" to some directories in
tests/regressiontests/ that were previously missing it.

Fixed #6545, #6801.


git-svn-id: http://code.djangoproject.com/svn/django/trunk@7294 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-03-18 14:54:39 +00:00
Adrian Holovaty 17155d3845 Fixed corner-case bug in formtools wizard.py and preview.py, in case of a None value -- thanks, Honza
git-svn-id: http://code.djangoproject.com/svn/django/trunk@7277 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-03-18 00:17:59 +00:00
Adrian Holovaty b1dbff729f Added parse_params() hook to FormWizard
git-svn-id: http://code.djangoproject.com/svn/django/trunk@7263 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-03-17 15:53:01 +00:00
Adrian Holovaty 48d7a6fb30 Fixed #3218 -- Implemented django.contrib.formtools.wizard. Thanks, Honza and Oyvind. Note that there are no docs yet
git-svn-id: http://code.djangoproject.com/svn/django/trunk@7236 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-03-13 20:12:53 +00:00