#24239: Possible problem in CVE-2015-0219 fix for 1.4.x
-------------------------------+--------------------
Reporter: rhertzog | Owner: nobody
Type: Bug | Status: new
Component: Uncategorized | Version: 1.4
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------+--------------------
Looking at
https://github.com/django/django/commit/4f6fffc1dc429f1ad428ecf8e6620739e8837450
you will see that the commit adds a get_environ() method to the
WSGIRequestHandler class.
But in fact, the class already has such a method, so this change
effectively replaces the initial get_environ() implementation with another
one that relies on ancestors providing the bulk of the code while the
original implementation does everything alone.
I would have expected this to blow up in some interesting ways... I'm not
using 1.4 myself so I haven't verified. I discovered this while trying to
backport this patch for an even older version of Django (1.2 in Debian
Squeeze).
--
Ticket URL: <https://code.djangoproject.com/ticket/24239>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/051.ff14b368f3d7a6dea7a25d2a8d2a6966%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
