test0908
/
django
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[1.4.x] Note that ALLOWED_HOSTS default changes in Django 1.5.

This commit is contained in:
Carl Meyer 2013-02-20 12:26:54 -07:00
parent a6927d8219
commit a57743c9ff
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
docs/ref/settings.txt
View File

@ -118,6 +118,11 @@ This validation only applies via :meth:`~django.http.HttpRequest.get_host()`;
if your code accesses the ``Host`` header directly from ``request.META`` you if your code accesses the ``Host`` header directly from ``request.META`` you
are bypassing this security protection. are bypassing this security protection.
The default value of this setting in Django 1.3.6+ is ``['*']`` (accept any
host) in order to avoid breaking backwards-compatibility in a security update,
but in Django 1.5+ the default is ``[]`` and explicitly configuring this
setting is required.
.. setting:: ALLOWED_INCLUDE_ROOTS .. setting:: ALLOWED_INCLUDE_ROOTS
ALLOWED_INCLUDE_ROOTS ALLOWED_INCLUDE_ROOTS