Django 1.11.18 版本发行说明

2019 年 1 月 4 日

Django 1.11.18 修复了 1.11.17 中的一个安全问题。

CVE-2019-3498: Content spoofing possibility in the default 404 page

An attacker could craft a malicious URL that could make spoofed content appear on the default page generated by the django.views.defaults.page_not_found() view.

The URL path is no longer displayed in the default 404 template and the request_path context variable is now quoted to fix the issue for custom templates that use the path.