Commit 9936fdb1 authored by Carl Meyer's avatar Carl Meyer
Browse files

[1.4.x] Added ALLOWED_HOSTS setting for HTTP host header validation. 

This is a security fix; disclosure and advisory coming shortly.
parent 57b62a74

django/conf/global_settings.py

+4 −0
Original line number Diff line number Diff line
@@ -29,6 +29,10 @@ ADMINS = () 
#   * Receive x-headers

INTERNAL_IPS = ()



# Hosts/domain names that are valid for this site.

# "*" matches anything, ".example.com" matches example.com and all subdomains

ALLOWED_HOSTS = ['*']



# Local time zone for this installation. All choices can be found here:

# http://en.wikipedia.org/wiki/List_of_tz_zones_by_name (although not all

# systems may support all possibilities). When USE_TZ is True, this is

django/conf/project_template/project_name/settings.py

+4 −0
Original line number Diff line number Diff line
@@ -20,6 +20,10 @@ DATABASES = { 
    }

}



# Hosts/domain names that are valid for this site; required if DEBUG is False

# See https://docs.djangoproject.com/en/{{ docs_version }}/ref/settings/#allowed-hosts

ALLOWED_HOSTS = []



# Local time zone for this installation. Choices can be found here:

# http://en.wikipedia.org/wiki/List_of_tz_zones_by_name

# although not all choices may be available on all operating systems.

django/contrib/auth/tests/views.py

+1 −0
Original line number Diff line number Diff line
@@ -107,6 +107,7 @@ class PasswordResetTest(AuthViewsTestCase): 
        self.assertEqual(len(mail.outbox), 1)

        self.assertEqual("staffmember@example.com", mail.outbox[0].from_email)



    @override_settings(ALLOWED_HOSTS=['adminsite.com'])

    def test_admin_reset(self):

        "If the reset view is marked as being for admin, the HTTP_HOST header is used for a domain override."

        response = self.client.post('/admin_password_reset/',

django/contrib/contenttypes/tests.py

+2 −0
Original line number Diff line number Diff line
@@ -9,6 +9,7 @@ from django.contrib.sites.models import Site 
from django.http import HttpRequest, Http404

from django.test import TestCase

from django.utils.encoding import smart_str

from django.test.utils import override_settings





class FooWithoutUrl(models.Model):
@@ -114,6 +115,7 @@ class ContentTypesTests(TestCase): 
            FooWithUrl: ContentType.objects.get_for_model(FooWithUrl),

        })



    @override_settings(ALLOWED_HOSTS=['example.com'])

    def test_shortcut_view(self):

        """

        Check that the shortcut view (used for the admin "view on site"

django/contrib/sites/tests.py

+2 −0
Original line number Diff line number Diff line
@@ -3,6 +3,7 @@ from django.contrib.sites.models import Site, RequestSite, get_current_site 
from django.core.exceptions import ObjectDoesNotExist

from django.http import HttpRequest

from django.test import TestCase

from django.test.utils import override_settings





class SitesFrameworkTests(TestCase):
@@ -39,6 +40,7 @@ class SitesFrameworkTests(TestCase): 
        site = Site.objects.get_current()

        self.assertEqual(u"Example site", site.name)



    @override_settings(ALLOWED_HOSTS=['example.com'])

    def test_get_current_site(self):

        # Test that the correct Site object is returned

        request = HttpRequest()