django/docs/releases/1.8.11.txt

===========================
Django 1.8.11 release notes
===========================

*March 5, 2016*

Django 1.8.11 fixes a regression on Python 2 in the 1.8.10 security release
where ``utils.http.is_safe_url()`` crashes on bytestring URLs (:ticket:`26308`).
Added stub release notes for 1.8.11. 2016-03-04 22:47:43 +08:00			`===========================`
			`Django 1.8.11 release notes`
			`===========================`

Added safety to URL decoding in is_safe_url() on Python 2 The errors='replace' parameter to force_text altered the URL before checking it, which wasn't considered sane. Refs 24fc935218 and ada7a4aef. 2016-03-05 06:33:35 +08:00			`March 5, 2016`
Added stub release notes for 1.8.11. 2016-03-04 22:47:43 +08:00
Fixed #26308 -- Prevented crash with binary URLs in is_safe_url() This fixes a regression introduced by c5544d28923. Thanks John Eskew for the reporti and Tim Graham for the review. 2016-03-04 22:41:52 +08:00			`Django 1.8.11 fixes a regression on Python 2 in the 1.8.10 security release`
			where ``utils.http.is_safe_url()`` crashes on bytestring URLs (:ticket:`26308`).