p15693087
/
django
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[1.3.X] Updated the contributing document to accurately reflect our security process. 

Backport of [16032] from trunk.

git-svn-id: http://code.djangoproject.com/svn/django/branches/releases/1.3.X@16033 bcc190cf-cafb-0310-a4f2-bffc1f526a37
This commit is contained in:
Jacob Kaplan-Moss 2011-04-17 14:27:53 +00:00
parent cdd75e078a
commit 9b21a0c921
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
docs/internals/contributing.txt
View File

@ -104,19 +104,19 @@ following actions:
fix is forthcoming. We'll give a rough timeline and ask the reporter
to keep the issue confidential until we announce it.
* Halt all other development as long as is needed to develop a fix,
including patches against the current and two previous releases.
* Focus on developing a fix as quickly as possible and produce patches
against the current and two previous releases.
* Determine a go-public date for announcing the vulnerability and the fix.
To try to mitigate a possible "arms race" between those applying the
patch and those trying to exploit the hole, we will not announce
security problems immediately.
* Pre-notify everyone we know to be running the affected version(s) of
Django. We will send these notifications through private e-mail
which will include documentation of the vulnerability, links to the
relevant patch(es), and a request to keep the vulnerability
confidential until the official go-public date.
* Pre-notify third-party distributors of Django ("vendors"). We will send
these vendor notifications through private email which will include
documentation of the vulnerability, links to the relevant patch(es), and a
request to keep the vulnerability confidential until the official
go-public date.
* Publicly announce the vulnerability and the fix on the pre-determined
go-public date. This will probably mean a new release of Django, but