Django 1.7.11 release notes¶
November 24, 2015
Django 1.7.11 fixes a security issue and a data loss bug in 1.7.10.
Fixed settings leak possibility in date template filter¶
If an application allows users to specify an unvalidated format for dates and
passes this format to the date filter, e.g.
{{ last_updated|date:user_date_format }}, then a malicious user could
obtain any secret in the application’s settings by specifying a settings key
instead of a date format. e.g. "SECRET_KEY" instead of "j/m/Y".
To remedy this, the underlying function used by the date template filter,
django.utils.formats.get_format(), now only allows accessing the date/time
formatting settings.
