2016-10-24 23:56:31 +08:00
|
|
|
===========================
|
|
|
|
|
Django 1.9.11 release notes
|
|
|
|
|
===========================
|
|
|
|
|
|
|
|
|
|
*November 1, 2016*
|
|
|
|
|
|
|
|
|
|
Django 1.9.11 fixes two security issues in 1.9.10.
|
2016-10-25 03:22:00 +08:00
|
|
|
|
|
|
|
|
User with hardcoded password created when running tests on Oracle
|
|
|
|
|
=================================================================
|
|
|
|
|
|
|
|
|
|
When running tests with an Oracle database, Django creates a temporary database
|
|
|
|
|
user. In older versions, if a password isn't manually specified in the database
|
|
|
|
|
settings ``TEST`` dictionary, a hardcoded password is used. This could allow
|
|
|
|
|
an attacker with network access to the database server to connect.
|
|
|
|
|
|
|
|
|
|
This user is usually dropped after the test suite completes, but not when using
|
|
|
|
|
the ``manage.py test --keepdb`` option or if the user has an active session
|
|
|
|
|
(such as an attacker's connection).
|
|
|
|
|
|
|
|
|
|
A randomly generated password is now used for each test run.
|
