mirror of https://github.com/django/django.git
45c7f427ce
All adhoc MAC applications have been updated to use HMAC, using SHA1 to generate unique keys for each application based on the SECRET_KEY, which is common practice for this situation. In all cases, backwards compatibility with existing hashes has been maintained, aiming to phase this out as per the normal deprecation process. In this way, under most normal circumstances the old hashes will have expired (e.g. by session expiration etc.) before they become invalid. In the case of the messages framework and the cookie backend, which was already using HMAC, there is the possibility of a backwards incompatibility if the SECRET_KEY is shorter than the default 50 bytes, but the low likelihood and low impact meant compatibility code was not worth it. All known instances where tokens/hashes were compared using simple string equality, which could potentially open timing based attacks, have also been fixed using a constant-time comparison function. There are no known practical attacks against the existing implementations, so these security improvements will not be backported. git-svn-id: http://code.djangoproject.com/svn/django/trunk@14218 bcc190cf-cafb-0310-a4f2-bffc1f526a37 |
||
|---|---|---|
| django | ||
| docs | ||
| extras | ||
| scripts | ||
| tests | ||
| AUTHORS | ||
| INSTALL | ||
| LICENSE | ||
| MANIFEST.in | ||
| README | ||
| setup.cfg | ||
| setup.py | ||
README
Django is a high-level Python Web framework that encourages rapid development
and clean, pragmatic design.
All documentation is in the "docs" directory and online at
http://docs.djangoproject.com/en/dev/. If you're just getting started, here's
how we recommend you read the docs:
* First, read docs/intro/install.txt for instructions on installing Django.
* Next, work through the tutorials in order (docs/intro/tutorial01.txt,
docs/intro/tutorial02.txt, etc.).
* If you want to set up an actual deployment server, read
docs/howto/deployment/index.txt for instructions.
* You'll probably want to read through the topical guides (in docs/topics)
next; from there you can jump to the HOWTOs (in docs/howto) for specific
problems, and check out the reference (docs/ref) for gory details.
Docs are updated rigorously. If you find any problems in the docs, or think they
should be clarified in any way, please take 30 seconds to fill out a ticket
here:
http://code.djangoproject.com/newticket
To get more help:
* Join the #django channel on irc.freenode.net. Lots of helpful people
hang out there. Read the archives at http://botland.oebfare.com/logger/django/.
* Join the django-users mailing list, or read the archives, at
http://groups.google.com/group/django-users.
To contribute to Django:
* Check out http://www.djangoproject.com/community/ for information
about getting involved.