Django security releases issued: 5.1.5, 5.0.11, and 4.2.18

2025-01-14 Thread Natalia Bidart
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2025/jan/14/security-releases/ -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from i

Re: Django security releases issued: 5.1.4, 5.0.10, and 4.2.17

2024-12-04 Thread ReynardSec
://www.djangoproject.com/weblog/2024/dec/04/security-releases/ -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from it, send an email to django-users...@googlegroups.com. To view this discus

Re: Django security releases issued: 5.1.4, 5.0.10, and 4.2.17

2024-12-04 Thread Sam Brown
Heads up, I’m getting a bad link error. Anyone else? On Wed, Dec 4, 2024 at 9:37 AM Sarah Boyce wrote: > Details are available on the Django project weblog: > https://www.djangoproject.com/weblog/2024/dec/04/security-releases/ > > -- > You received this message because you are su

Django security releases issued: 5.1.4, 5.0.10, and 4.2.17

2024-12-04 Thread Sarah Boyce
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2024/dec/04/security-releases/ -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from i

Re: Django security releases issued: 5.1.1, 5.0.9, and 4.2.16

2024-09-03 Thread אורי
On Tue, Sep 3, 2024 at 5:30 PM Natalia Bidart < nataliabid...@djangoproject.com> wrote: > Details are available on the Django project weblog: > https://www.djangoproject.com/weblog/2024/sep/03/security-releases/ > > -- > You received this message because you are subscribed

Django security releases issued: 5.1.1, 5.0.9, and 4.2.16

2024-09-03 Thread Natalia Bidart
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2024/sep/03/security-releases/ -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from i

Re: Django security releases issued: 5.0.8 and 4.2.15

2024-08-19 Thread Montego King
Thanks On Tue, Aug 6, 2024, 3:35 PM Sarah Boyce wrote: > Details are available on the Django project weblog: > > https://www.djangoproject.com/weblog/2024/aug/06/security-releases/ > > -- > You received this message because you are subscribed to the Google Groups > "

Django security releases issued: 5.0.8 and 4.2.15

2024-08-06 Thread Sarah Boyce
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2024/aug/06/security-releases/ -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from i

Django security releases issued: 5.0.7 and 4.2.14

2024-07-09 Thread Natalia Bidart
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2024/jul/09/security-releases/ -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from i

Re: Django security releases issued: 5.0.3, 4.2.11, and 3.2.25

2024-03-04 Thread Ayoub ANSAIR
Thank you ! Le lun. 4 mars 2024 à 09:58, Mariusz Felisiak a écrit : > Details are available on the Django project weblog: > > https://www.djangoproject.com/weblog/2024/mar/04/security-releases/ > > -- > You received this message because you are subscribed to the Google Grou

Django security releases issued: 5.0.3, 4.2.11, and 3.2.25

2024-03-04 Thread Mariusz Felisiak
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2024/mar/04/security-releases/ -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from i

Short note on security

2024-02-21 Thread ReynardSec
Dear Django Group Members, I hope I'm not breaking any rules, because I'd like to share with you a brief article I wrote on the security of applications, including those written in Django. Django does a great job in protecting developers and the users of your applications from man

Django security releases issued: 5.0.2, 4.2.10, and 3.2.24

2024-02-06 Thread Natalia Bidart
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2024/feb/06/security-releases/ -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from i

Django security releases issued: 4.2.7, 4.1.13, and 3.2.23

2023-11-01 Thread Mariusz Felisiak
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2023/nov/01/security-releases/ -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from i

Django security releases issued: 4.2.6, 4.1.12, and 3.2.22

2023-10-04 Thread Natalia Bidart
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2023/oct/04/security-releases/ -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from i

Django security releases issued: 4.2.5, 4.1.11, and 3.2.21

2023-09-04 Thread Mariusz Felisiak
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2023/sep/04/security-releases/ -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from i

Django security releases issued: 4.2.3, 4.1.10, and 3.2.20

2023-07-03 Thread Mariusz Felisiak
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2023/jul/03/security-releases/ -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from i

Django security releases issued: 4.2.1, 4.1.9, and 3.2.19

2023-05-03 Thread Mariusz Felisiak
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2023/may/03/security-releases/ -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from i

Django security releases issued: 4.1.7, 4.0.10, and 3.2.18

2023-02-14 Thread Carlton Gibson
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2023/feb/14/security-releases/ -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from i

Django security releases issued: 4.1.6, 4.0.9, and 3.2.17

2023-02-01 Thread Mariusz Felisiak
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2023/feb/01/security-releases/ -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from i

Django security releases issued: 4.0.7 and 3.2.15.

2022-08-03 Thread Carlton Gibson
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2022/aug/03/security-releases/ -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from i

Re: Static Code analysis and Security Scanning tools for Django Web Applications

2022-07-13 Thread Paul Tiplady
Tools Run: dodgy, mccabe, profile-validator, pycodestyle, >> pyflakes, pylint >> Messages Found: 17186 > > > but wondering if you guys use any other better tools than this. Our goal > is find out gaps and error from the following items: > > 1. Security scanning >

Re: Static Code analysis and Security Scanning tools for Django Web Applications

2022-07-10 Thread Ram
mccabe, profile-validator, pycodestyle, >>> pyflakes, pylint >>> Messages Found: 17186 >> >> >> but wondering if you guys use any other better tools than this. Our goal >> is find out gaps and error from the following items: >> >> 1. Securit

Re: Static Code analysis and Security Scanning tools for Django Web Applications

2022-07-08 Thread Christian Ledermann
you guys use any other better tools than this. Our goal > is find out gaps and error from the following items: > > 1. Security scanning > 2. Static code analysis > 3. Vulnerabilities scanning > > Best regards, > ~Ram > > > > > -- > You received this message bec

Static Code analysis and Security Scanning tools for Django Web Applications

2022-07-05 Thread Ram
ycodestyle, pyflakes, > pylint > Messages Found: 17186 but wondering if you guys use any other better tools than this. Our goal is find out gaps and error from the following items: 1. Security scanning 2. Static code analysis 3. Vulnerabilities scanning Best regards, ~Ram -- You r

Re: Django security releases issued: 4.0.6 and 3.2.14.

2022-07-04 Thread אורי
Hi, Bugfixes are empty on https://docs.djangoproject.com/en/4.0/releases/4.0.6/ אורי u...@speedy.net On Mon, Jul 4, 2022 at 11:00 AM Mariusz Felisiak wrote: > Details are available on the Django project weblog: > > https://www.djangoproject.com/weblog/2022/jul/04/security

Django security releases issued: 4.0.6 and 3.2.14.

2022-07-04 Thread Mariusz Felisiak
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2022/jul/04/security-releases/ -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from i

Django security releases issued: 4.0.4, 3.2.13, and 2.2.28

2022-04-11 Thread Mariusz Felisiak
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2022/apr/11/security-releases/ -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from i

Re: Report to security@ bounced as "spam"

2022-03-26 Thread Jason
this might be good to report to https://groups.google.com/g/django-developers, both the security issue and spam reception. If you sent the mail from the brainonfire.net domain, might be worth checking your spam configuration. Spamhaus shows no issues, so curious why this happened. On

Report to security@ bounced as "spam"

2022-03-23 Thread cor...@brainonfire.net
I tried to send in a message to the security team at the email advertised at https://docs.djangoproject.com/en/dev/internals/security/ but Google rejected it: > Your email to group secur...@djangoproject.com was rejected due to spam classification. > > The owner of the group can

Django security releases issued: 4.0.2, 3.2.12, and 2.2.27

2022-01-31 Thread Mariusz Felisiak
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2022/feb/01/security-releases/ -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from i

Django security releases issued: 4.0.1, 3.2.11, and 2.2.26

2022-01-04 Thread Carlton Gibson
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2022/jan/04/security-releases/ -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from i

Re: Django security releases issued: 3.2.10, 3.1.14, and 2.2.25

2021-12-07 Thread kayhan
Okay, thank you. I really like open source technologies On Tue, Dec 7, 2021 at 11:12 AM Mariusz Felisiak wrote: > Details are available on the Django project weblog: > > https://www.djangoproject.com/weblog/2021/dec/07/security-releases/ > > -- > You received this messa

Django security releases issued: 3.2.10, 3.1.14, and 2.2.25

2021-12-06 Thread Mariusz Felisiak
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2021/dec/07/security-releases/ -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from i

Django security releases issued: 3.2.5 and 3.1.13

2021-07-01 Thread Mariusz Felisiak
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2021/jul/01/security-releases/ -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from i

Django security releases issued: 3.2.4, 3.1.12, and 2.2.24

2021-06-02 Thread Carlton Gibson
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2021/jun/02/security-releases/ <https://www.djangoproject.com/weblog/2021/jun/02/security-releases/> -- You received this message because you are subscribed to the Google Groups "Django users

Re: [django-announce] Django security releases issued: 3.2.1, 3.1.9 and 2.2.21

2021-05-07 Thread Markus Holtermann
> On 5/4/21 4:54 AM, Carlton Gibson wrote: > > Details are available on the Django project weblog: > > > > https://www.djangoproject.com/weblog/2021/may/04/security-releases/ > > > > -- > > You received this message because you are subscribed to the Google Groups

Re: [django-announce] Django security releases issued: 3.2.1, 3.1.9 and 2.2.21

2021-05-07 Thread Ned Batchelder
): >     raise SuspiciousFileOperation("File name '%s' includes path elements" % name) Is this level of strictness necessary? --Ned. On 5/4/21 4:54 AM, Carlton Gibson wrote: Details are available on the Django project weblog: https://www.djangoproject.com/webl

Django security releases issued: 3.2.2, 3.1.10, and 2.2.22

2021-05-06 Thread Mariusz Felisiak
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2021/may/06/security-releases/ -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from i

Django security releases issued: 3.2.1, 3.1.9 and 2.2.21

2021-05-04 Thread Carlton Gibson
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2021/may/04/security-releases/ <https://www.djangoproject.com/weblog/2021/may/04/security-releases/> -- You received this message because you are subscribed to the Google Groups "Django users

Django Debug Toolbar security releases issued: 3.2.1, 2.2.1 and 1.11.1.

2021-04-14 Thread Carlton Gibson
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2021/apr/14/debug-toolbar-security-releases/ <https://www.djangoproject.com/weblog/2021/apr/14/debug-toolbar-security-releases/> -- You received this message because you are subscribed to the

Django security releases issued: 3.1.8, 3.0.14, and 2.2.20

2021-04-06 Thread Mariusz Felisiak
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2021/apr/06/security-releases/ -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from i

Django security releases issued: 3.1.7, 3.0.13 and 2.2.19

2021-02-19 Thread Carlton Gibson
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2021/feb/19/security-releases/ -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from i

Django security releases issued: 3.1.6, 3.0.12, and 2.2.18

2021-02-01 Thread Mariusz Felisiak
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2021/feb/01/security-releases/ -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from i

Re: Django security releases issued: 3.1.1, 3.0.10 and 2.2.16

2020-09-02 Thread Annick Sakoua
Thanks :), didn't see that Le mardi 1 septembre 2020 à 10:20:39 UTC+1, carlton...@gmail.com a écrit : > Today the Django team issued 3.1.1, 3.0.10 and 2.2.16 as part of our > security process. These releases address two security issues, and we > encourage all users to upgr

Django security releases issued: 3.1.1, 3.0.10 and 2.2.16

2020-09-01 Thread Carlton Gibson
Today the Django team issued 3.1.1, 3.0.10 and 2.2.16 as part of our security process. These releases address two security issues, and we encourage all users to upgrade as soon as possible: https://www.djangoproject.com/weblog/2020/sep/01/security-releases/ -- You received this message

Re: User registration with security features

2020-08-17 Thread Andréas Kühne
oes DJango have built in functions for user registration with following > security features? > > 1. Initial registration should be successful as it is new user registration > 1.1. Upon successful registration and login, device will be registered in > account history > > 2. When login

User registration with security features

2020-08-16 Thread Ram
Hi, Does DJango have built in functions for user registration with following security features? 1. Initial registration should be successful as it is new user registration 1.1. Upon successful registration and login, device will be registered in account history 2. When login is attempted from

Re: Security issue in django.db.models

2020-08-10 Thread Juan Díaz
Thanks for the answers! El dom., 9 ago. 2020 a las 11:16, Liu Zheng () escribió: > All the previous answers are great to explain the reason. Just want to > add: if you do not desire empty string in form and in shell, you probably > need to add a min_length validation condition > > On Sun, Aug 9,

Re: Security issue in django.db.models

2020-08-09 Thread Liu Zheng
All the previous answers are great to explain the reason. Just want to add: if you do not desire empty string in form and in shell, you probably need to add a min_length validation condition On Sun, Aug 9, 2020 at 12:42 PM Stephen J. Butler wrote: > If you look at the documentation for 'blank' i

Re: Security issue in django.db.models

2020-08-08 Thread Stephen J. Butler
If you look at the documentation for 'blank' it says: """ Note that this is different than null. null is purely database-related, whereas blank is validation-related. If a field has blank=True, *form validation* will allow entry of an empty value. If a field has blank=False, the field will be requ

Re: Security issue in django.db.models

2020-08-07 Thread ule...@gmail.com
Null value is not the same as an empty string !!! You have to validate the robot_name see also : https://stackoverflow.com/questions/6940499/how-can-you-create-a-non-empty-charfield-in-django Op vrijdag 7 augustus 2020 om 15:11:48 UTC+2 schreef neera...@gmail.com: > It basically sets a null val

Re: Security issue in django.db.models

2020-08-07 Thread neeraj garg
It basically sets a null value i.e. "" for the fields that you don't pass while creating an object in shell. And "" it acceptable value. If you want to restrict "" then add some validations. On Fri, Aug 7, 2020, 5:16 PM Juan D. wrote: > I've created a model with null and blank set to False in ro

Security issue in django.db.models

2020-08-07 Thread Juan D.
I've created a model with null and blank set to False in robot_name: class Robot(models.Model): robot_name = models.CharField(max_length=200, null=False, blank=False) version = models.CharField(max_length=20, blank=True, null=True) class Meta: unique_together = ('robot_name',

Model security error in shell

2020-08-07 Thread Juan D.
Hi. This is something that only occurs in the shell environment, not in the web. If I have this model: class Phone_App(models.Model): phone= models.ForeignKey(Phone, on_delete=models.CASCADE) app_name = models.ForeignKey(App, on_delete=models.CASCADE) downloads = models.IntegerField(d

Basic security check

2020-07-06 Thread Exactly musty
Bro you should probably host it before talking about security,I am talking about buying a domain name and hosting for yourself -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emai

Basic security check

2020-07-05 Thread Anirudh choudhary
Hello everyone I have deployed a website on heroku https://apnaganna.herokuapp.com/ What should be my next step to see that my website data is secured. How to stop unauthorised request to view your django rest api urls Thanks 😊 -- You received this message because you are subscribed to the Goo

Path parameters and security scanners best practice

2020-06-15 Thread Dan Davis
I have an odd question. When I have a path parameter that is validated to be alphanumeric, and a security scanner sends a non-alphanumeric value, Django properly validates and then returns 404. However, this gives the security scanner the mistaken impression that there is some some sort of

Re: Django 1.11 security backports

2020-06-09 Thread carlos
i think no! On Tue, Jun 9, 2020 at 10:21 AM Nikolas J. Nyby wrote: > Is anyone maintaining an unofficial Django 1.11 security backports branch? > > I'm migrating to Django 2.2 as soon as possible, but I was just curious if > anyone has a branch with the recent security fixes po

Django 1.11 security backports

2020-06-09 Thread Nikolas J. Nyby
Is anyone maintaining an unofficial Django 1.11 security backports branch? I'm migrating to Django 2.2 as soon as possible, but I was just curious if anyone has a branch with the recent security fixes ported in to Django 1.11. -- You received this message because you are subscribed t

Security question: Can Django templates be used to execute arbitrary code on the server?

2020-05-05 Thread jrief
Is it safe to keep Django template strings inside a TextField of a Django model and allow users with staff privileges to edit them? I'm asking because I'm unsure how safe/dangerous this could be. Would it be possible to abuse a built-in templatetag to execute arbitrary code on the server? What

Django security releases issued: 3.0.4, 2.2.11, and 1.11.29

2020-03-04 Thread Mariusz Felisiak
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2020/mar/04/security-releases/ -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from i

Django security releases issued: 3.0.3, 2.2.10 and 1.11.28

2020-02-03 Thread Carlton Gibson
Today the Django team issued 3.0.3, 2.2.10 and 1.11.28 as part of our security process. These releases address a security issue, and we encourage all users to upgrade as soon as possible: https://www.djangoproject.com/weblog/2020/feb/03/security-releases/ <https://www.djangoproject.com/web

Re: Necessary Precautions to be taken in Software to pass security Audit

2019-12-18 Thread Mike Dewhirst
On 19/12/2019 12:37 am, Balaji Shetty wrote: Good Evening  One query raised. My project is Government and it must pass through Security Audits. Company may be indian Government. It was built in Django with Sqlite backend. It is hosted on Pythonanywhere. 90% work is accomplished in backend

Necessary Precautions to be taken in Software to pass security Audit

2019-12-18 Thread Balaji Shetty
Good Evening One query raised. My project is Government and it must pass through Security Audits. Company may be indian Government. It was built in Django with Sqlite backend. It is hosted on Pythonanywhere. 90% work is accomplished in backend only. Only report and graph display are in

Re: Django security releases issued: 3.0.1, 2.2.9, and 1.11.27

2019-12-18 Thread אורי
else: logger.error("PasswordResetForm::User doesn't have a matching email address, site_name={site_name}, user={user}, email={email}".format(site_name=_(site_name), user=user, email=email)) אורי u...@speedy.net On Wed, Dec 18, 2019 at 11:23 AM Mariusz Fe

Django security releases issued: 3.0.1, 2.2.9, and 1.11.27

2019-12-18 Thread Mariusz Felisiak
Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2019/dec/18/security-releases/ -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from i

Re: Django security releases issued: 2.2.8 and 2.1.15.

2019-12-02 Thread Integr@te System
>> Today the Django team issued 2.2.8 and 2.1.15 as part of our security >> process. These releases address security issues, and we encourage all users >> to upgrade as soon as possible: >> >> https://www.djangoproject.com/weblog/2019/dec/02/security-releases/ >>

Re: Django security releases issued: 2.2.8 and 2.1.15.

2019-12-02 Thread אורי
Bugfixes is empty on https://docs.djangoproject.com/en/2.2/releases/2.1.15/ אורי u...@speedy.net On Mon, Dec 2, 2019 at 11:12 AM Carlton Gibson wrote: > Today the Django team issued 2.2.8 and 2.1.15 as part of our security > process. These releases address security issues, and we enc

Django security releases issued: 2.2.8 and 2.1.15.

2019-12-02 Thread Carlton Gibson
Today the Django team issued 2.2.8 and 2.1.15 as part of our security process. These releases address security issues, and we encourage all users to upgrade as soon as possible: https://www.djangoproject.com/weblog/2019/dec/02/security-releases/ <https://www.djangoproject.com/weblog/2019/

Re: How can i share one Database Sqlite between 2 app on pythonanywhere -. Should I prefer postgresql or MySQL - Security

2019-09-05 Thread Amirhosein Rajabi
osted on pythonAnywhere. > > Is it possible for postgresql. > > Should I prefer postgresql or MySQL regarding security issues . > > Can you please tell me how to achieve in MySQL. > > Also how can I backup daily data of server on my local machine . > > Can any DB also pr

Re: How can i share one Database Sqlite between 2 app on pythonanywhere -. Should I prefer postgresql or MySQL - Security

2019-09-05 Thread Balaji Shetty
Thanks for your reply. I hosted on pythonAnywhere. Is it possible for postgresql. Should I prefer postgresql or MySQL regarding security issues . Can you please tell me how to achieve in MySQL. Also how can I backup daily data of server on my local machine . Can any DB also provide front-end

Custom action with security

2019-08-22 Thread Ezequias Rocha
Hi everyone I am using a custom action in admin, it is simple but not secure. I would like some custom actions would work only for some users and i think it could be done with a different url and a differente authorization role (in Admin). Could you give me some advice to make this issue work

Django security releases issued: 2.2.4, 2.1.11, and 1.11.23.

2019-08-01 Thread Carlton Gibson
Today the Django team issued 2.2.4, 2.1.11, and 1.11.23 as part of our security process. These releases address security issues, and we encourage all users to upgrade as soon as possible: https://www.djangoproject.com/weblog/2019/aug/01/security-releases/ -- You received this message because

Django security releases issued: 2.2.3, 2.1.10 and 1.11.22

2019-07-01 Thread Mariusz Felisiak
Today the Django team issued 2.2.3, 2.1.10, and 1.11.22 as part of our security process. These releases address security issues, and we encourage all users to upgrade as soon as possible: https://www.djangoproject.com/weblog/2019/jul/01/security-releases/ -- You received this message because

Django security releases issued: 2.2.3, 2.1.10 and 1.11.22

2019-07-01 Thread Mariusz Felisiak
Today the Django team issued 2.2.3, 2.1.10, and 1.11.22 as part of our security process. These releases address security issues, and we encourage all users to upgrade as soon as possible: https://www.djangoproject.com/weblog/2019/jul/01/security-releases/ -- You received this message because

Re: Django security releases issued: 2.2.2, 2.1.9 and 1.11.21

2019-06-03 Thread wanbao jin
Oh, i missed that link, thanks. 😀 ‪On Mon, Jun 3, 2019 at 9:45 PM ‫אורי‬‎ wrote:‬ > wanbao Did you read > https://www.djangoproject.com/weblog/2019/jun/03/security-releases/ ? > אורי > u...@speedy.net > > > On Mon, Jun 3, 2019 at 4:42 PM wanbao jin wrote: > >> W

Re: Django security releases issued: 2.2.2, 2.1.9 and 1.11.21

2019-06-03 Thread אורי
wanbao Did you read https://www.djangoproject.com/weblog/2019/jun/03/security-releases/ ? אורי u...@speedy.net On Mon, Jun 3, 2019 at 4:42 PM wanbao jin wrote: > What were those security issues? Could you briefly explain about it? > > Thanks > > On Mon, Jun 3, 2019 at 7:17 PM

Re: Django security releases issued: 2.2.2, 2.1.9 and 1.11.21

2019-06-03 Thread Michal Petrucha
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On Mon, Jun 03, 2019 at 09:41:59PM +0800, wanbao jin wrote: > What were those security issues? Could you briefly explain about it? > > Thanks They are described in the blog post that Carlton linked to in the first ema

Re: Django security releases issued: 2.2.2, 2.1.9 and 1.11.21

2019-06-03 Thread wanbao jin
What were those security issues? Could you briefly explain about it? Thanks On Mon, Jun 3, 2019 at 7:17 PM Carlton Gibson wrote: > Today the Django team issued 2.2.2, 2.1.9, and 1.11.21 as part of our > security process. These releases address security issues, and we encourage > all

Django security releases issued: 2.2.2, 2.1.9 and 1.11.21

2019-06-03 Thread Carlton Gibson
Today the Django team issued 2.2.2, 2.1.9, and 1.11.21 as part of our security process. These releases address security issues, and we encourage all users to upgrade as soon as possible: https://www.djangoproject.com/weblog/2019/jun/03/security-releases/ -- You received this message because

Django security releases issued: 2.1.6, 2.0.11, and 1.11.19

2019-02-11 Thread Carlton Gibson
Today the Django team issued 2.1.6, 2.0.11, and 1.11.19 as part of our security process. These releases address a security issue, and we encourage all users to upgrade as soon as possible: https://www.djangoproject.com/weblog/2019/feb/11/security-releases/ -- You received this message

Django security releases issued: 2.1.5, 2.0.10, and 1.11.18

2019-01-04 Thread Tim Graham
Today the Django team issued 2.1.5, 2.0.10, and 1.11.18 as part of our security process. These releases address a security issue, and we encourage all users to upgrade as soon as possible: https://www.djangoproject.com/weblog/2019/jan/04/security-releases/ The issue was publicly reported through

Django security release issued: 2.1.2

2018-10-01 Thread Carlton Gibson
Today the Django team issued 2.1.2 as part of our security process. This release address a security issue, and we encourage all users to upgrade as soon as possible: https://www.djangoproject.com/weblog/2018/oct/01/security-release/ <https://www.djangoproject.com/weblog/2018/oct/01/secur

Django security releases issued: 1.11.15 and 2.0.8

2018-08-01 Thread Tim Graham
Today the Django team issued 1.11.15 and 2.0.8 as part of our security process. These releases address a security issue, and we encourage all users to upgrade as soon as possible: https://www.djangoproject.com/weblog/2018/aug/01/security-releases/ As a reminder, we ask that potential security

Security Check in Django

2018-06-20 Thread Jerrina Paul
Hi, We started migrating a java project to Django .Our present code we are using different filters for security. Mainly we are checking below filters · Session hijacking check · XSS attach check · CSRF check · Path manipulation check(directory traversal attack

Django security releases issued: 2.0.3, 1.11.11, and 1.8.19

2018-03-06 Thread Tim Graham
Today the Django team issued Django 2.0.3, 1.11.11, and 1.8.19 as part of our security process. These releases address two security issues, and we encourage all users to upgrade as soon as possible: https://www.djangoproject.com/weblog/2018/mar/06/security-releases/ As a reminder, we ask that

Django security releases issued: 1.11.5 and 1.10.8

2017-09-05 Thread Tim Graham
Today the Django team issued 1.11.5 and 1.10.8 as part of our security process. These releases address a security issue, and we encourage all users to upgrade as soon as possible: https://www.djangoproject.com/weblog/2017/sep/05/security-releases/ As a reminder, we ask that potential security

Django authentication security check against LDAP

2017-05-03 Thread Uzair Tariq
While studying the Authentication Views in Django I came across some of the build in views including password reset view. I got hang of its basic working mechanism while reading the documentation I encountered the line promoting the use of *set_unusable_password()* in Djagno authentication agai

Django security releases issued: 1.10.7, 1.9.13, and 1.8.18

2017-04-04 Thread Tim Graham
Today the Django team issued 1.10.7, 1.9.13, and 1.8.18 as part of our security process. These releases address two security issues, and we encourage all users to upgrade as soon as possible: https://www.djangoproject.com/weblog/2017/apr/04/security-releases/ As a reminder, we ask that

Re: Django Security issue

2016-12-05 Thread 'Aaron C. de Bruyn' via Django users
lic IP, it start generating huge outbound HTTP > traffic, event though nobody access the server. > > do anyone has idea about any similar security issues/fix. what could be the > possible cause and how to trace the issue? > > Thanks, > Deepak > > -- > You received this

Django Security issue

2016-12-04 Thread deepak gupta
, event though nobody access the server. do anyone has idea about any similar security issues/fix. what could be the possible cause and how to trace the issue? Thanks, Deepak -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubs

Re: [ANNOUNCE] Django security advisory: Vulnerability in password reset (master branch only)

2016-11-23 Thread William Hakizimana
While we are at it, could we implement these NIST new password guidelines <https://nakedsecurity.sophos.com/2016/08/18/nists-new-password-rules-what-you-need-to-know/> into django? Just On Monday, November 21, 2016 at 3:13:21 PM UTC-6, Tim Graham wrote: > > We don't norma

[ANNOUNCE] Django security advisory: Vulnerability in password reset (master branch only)

2016-11-21 Thread Tim Graham
We don't normally give security advisories for issues that affect only the master branch, but in this case we've made an exception as the issue could be high impact. Please see the blog post for details: https://www.djangoproject.com/weblog/2016/nov/21/passwordresetconfirmview-securit

[ANNOUNCE] Django security releases issued: 1.10.3, 1.9.11, and 1.8.16

2016-11-01 Thread Tim Graham
Today the Django team issued 1.10.3, 1.9.11, and 1.8.16 as part of our security process. These releases address two security issues, and we encourage all users to upgrade as soon as possible. Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2016/nov/01

[ANNOUNCE] Django security releases issued: 1.9.10 and 1.8.15

2016-09-26 Thread Tim Graham
Today the Django team issued 1.9.10 and 1.8.15 as part of our security process. These releases address a security issue, and we encourage all users to upgrade as soon as possible. Details are available on the Django project weblog: https://www.djangoproject.com/weblog/2016/sep/26/security

[ANNOUNCE] Django security releases issued: 1.10 release candidate 1, 1.9.8, and 1.8.14

2016-07-18 Thread Tim Graham
Today the Django team issued 1.10 release candidate 1, 1.9.8, and 1.8.14 as part of our security process. This releases address a security issue, and we encourage all users to upgrade as soon as possible. Details are available on the Django project weblog: https://www.djangoproject.com/weblog

Re: Django formset security and injecting PKs in formset hidden id fields

2016-05-06 Thread Carl Meyer
mset |clean()| or |save()| methods don't bat an eye. First of all, if you believe that you've found a security issue in Django, please err on the side of caution and email secur...@djangoproject.com, rather than reporting it in public. Thanks! Second: can you provide a sample project demonstrati

Re: Django formset security and injecting PKs in formset hidden id fields

2016-05-04 Thread Tim Graham
How would you keep track of which objects were in the original formset? If you generate the same queryset in the formset for both formset creation and formset submission you shouldn't run into any security issues. On Tuesday, May 3, 2016 at 2:23:12 PM UTC-4, Rob Ladd wrote: > > I

Django formset security and injecting PKs in formset hidden id fields

2016-05-03 Thread Rob Ladd
n't be too complicated to keep track of which objects were in the original formset queryset, and compare them on save. Given all the other convenient security methods we have, I wonder why Django doesn't do this already? -- You received this message because you are subscribed

  1   2   3   4   >