diff options
| author | adam <adam@pkgsrc.org> | 2019-12-19 13:40:36 +0000 |
|---|---|---|
| committer | adam <adam@pkgsrc.org> | 2019-12-19 13:40:36 +0000 |
| commit | 386bd673050d420f4adf3b97e1e02a8b25a9f822 (patch) | |
| tree | 87d05cfd1060dfdb96f3fe07bf0ffa8681625a9f | |
| parent | 702d143d687758a596637d91e148b473eec0a6ff (diff) | |
| download | pkgsrc-386bd673050d420f4adf3b97e1e02a8b25a9f822.tar.gz | |
py-django2: updated to 2.2.9
Django 2.2.9 fixes a security issue and a data loss bug in 2.2.8.
CVE-2019-19844: Potential account hijack via password reset form
By submitting a suitably crafted email address making use of Unicode characters, that compared equal to an existing user email when lower-cased for comparison, an attacker could be sent a password reset token for the matched account.
In order to avoid this vulnerability, password reset requests now compare the submitted email using the stricter, recommended algorithm for case-insensitive comparison of two identifiers from Unicode Technical Report 36, section 2.11.2(B)(2). Upon a match, the email containing the reset token will be sent to the email address on record rather than the submitted address.
Bugfixes
* Fixed a data loss possibility in SplitArrayField. When using with ArrayField(BooleanField()), all values after the first True value were marked as checked instead of preserving passed values
| -rw-r--r-- | www/py-django2/Makefile | 4 | ||||
| -rw-r--r-- | www/py-django2/distinfo | 10 |
2 files changed, 7 insertions, 7 deletions
diff --git a/www/py-django2/Makefile b/www/py-django2/Makefile index 9457f85168f..5013b875300 100644 --- a/www/py-django2/Makefile +++ b/www/py-django2/Makefile @@ -1,6 +1,6 @@ -# $NetBSD: Makefile,v 1.23 2019/12/02 11:46:56 adam Exp $ +# $NetBSD: Makefile,v 1.24 2019/12/19 13:40:36 adam Exp $ -DISTNAME= Django-2.2.8 +DISTNAME= Django-2.2.9 PKGNAME= ${PYPKGPREFIX}-${DISTNAME:tl} CATEGORIES= www python MASTER_SITES= https://www.djangoproject.com/m/releases/${PKGVERSION_NOREV:R}/ diff --git a/www/py-django2/distinfo b/www/py-django2/distinfo index bae47942ac3..2941dfb7133 100644 --- a/www/py-django2/distinfo +++ b/www/py-django2/distinfo @@ -1,6 +1,6 @@ -$NetBSD: distinfo,v 1.21 2019/12/02 11:46:56 adam Exp $ +$NetBSD: distinfo,v 1.22 2019/12/19 13:40:36 adam Exp $ -SHA1 (Django-2.2.8.tar.gz) = 0a631fe2237fea6a60cdd5d02b618632b6e49a1b -RMD160 (Django-2.2.8.tar.gz) = ae25304c6a33c48abaddc4670b8e46de9fe675b3 -SHA512 (Django-2.2.8.tar.gz) = b704c6def495e76651cf8a031ffc2e7bd7d0ac73c68efba903053cd379bcdd7e98f2083d8e1e121bb5a4da7ef8a126d442b12aad33f85f1059b1defcc48d843b -Size (Django-2.2.8.tar.gz) = 8870662 bytes +SHA1 (Django-2.2.9.tar.gz) = c5a1c4bec360b4e98e839fcf6088b8eb1599c1ed +RMD160 (Django-2.2.9.tar.gz) = 3b7ab863a598712df81ce34120ca514482beb509 +SHA512 (Django-2.2.9.tar.gz) = f99c464be8639eb18fe30cf195f7e971c973fa26a0f44d09ab9ad7f331e7e5e1db8d22e1adaf04fe885e8750d38a6d85942e7039f737fe88a617f44514b6fd5b +Size (Django-2.2.9.tar.gz) = 9006404 bytes |