#15619: Logout link should be protected
-------------------------------+------------------------------------------
Reporter: void | Owner: ashchristopher
Type: Bug | Status: assigned
Component: contrib.admin | Version: master
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 1
Easy pickings: 0 | UI/UX: 0
-------------------------------+------------------------------------------
Comment (by vzima):
Replying to [comment:29 lukeplant]:
> Replying to [comment:27 vzima]:
>
> > It is the same problem in Django as is in Trac. It would be very easy
to add a lot fake images to whatever site powered by Django, some are
listed at Django homepage. Or Django Project admin itself :)
>
> Please stop arguing with us when we already agree with you. See comment
number 4, which is after mine.
My main point is that this ticket should be closed as soon as possible
because the bug has security consequences. The bug is opened 2 years and
it does not seem its patch will be included into 1.5 either. The last
patch probably requires no update except comment:18 and then it got stuck.
Anyway, based on last patch from ashchristopher I created a github branch
https://github.com/vzima/django/tree/15619-protected-logout with updated
patch which considers comment:18.
Also I moved the base code from admin logout to auth logout so logouts are
protected also outside of admin application.
Feedback welcome, so we can finally close this issue.
--
Ticket URL: <https://code.djangoproject.com/ticket/15619#comment:30>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
