41 lines
1.7 KiB
Plaintext
41 lines
1.7 KiB
Plaintext
==========================
|
||
Django 1.5.4 release notes
|
||
==========================
|
||
|
||
*September 14, 2013*
|
||
|
||
This is Django 1.5.4, the fourth release in the Django 1.5 series. It addresses
|
||
two security issues and one bug.
|
||
|
||
Denial-of-service via password hashers
|
||
--------------------------------------
|
||
|
||
In previous versions of Django, no limit was imposed on the plaintext
|
||
length of a password. This allowed a denial-of-service attack through
|
||
submission of bogus but extremely large passwords, tying up server
|
||
resources performing the (expensive, and increasingly expensive with
|
||
the length of the password) calculation of the corresponding hash.
|
||
|
||
As of 1.5.4, Django's authentication framework imposes a 4096-byte
|
||
limit on passwords, and will fail authentication with any submitted
|
||
password of greater length.
|
||
|
||
Corrected usage of :func:`~django.views.decorators.debug.sensitive_post_parameters` in :mod:`django.contrib.auth`’s admin
|
||
-------------------------------------------------------------------------------------------------------------------------
|
||
|
||
The decoration of the ``add_view`` and ``user_change_password`` user admin
|
||
views with :func:`~django.views.decorators.debug.sensitive_post_parameters`
|
||
did not include :func:`~django.utils.decorators.method_decorator` (required
|
||
since the views are methods) resulting in the decorator not being properly
|
||
applied. This usage has been fixed and
|
||
:func:`~django.views.decorators.debug.sensitive_post_parameters` will now
|
||
throw an exception if it's improperly used.
|
||
|
||
Bugfixes
|
||
========
|
||
|
||
* Fixed a bug that prevented a ``QuerySet`` that uses
|
||
:meth:`~django.db.models.query.QuerySet.prefetch_related` from being pickled
|
||
and unpickled more than once (the second pickling attempt raised an
|
||
exception) (#21102).
|