Commit a7e33c5b authored by Carl Meyer's avatar Carl Meyer
Browse files

[1.5.x] Added a new required ALLOWED_HOSTS setting for HTTP host header validation. 

This is a security fix; disclosure and advisory coming shortly.
parent 5d853db9

django/conf/global_settings.py

+4 −0
Original line number Diff line number Diff line
@@ -29,6 +29,10 @@ ADMINS = () 
#   * Receive x-headers

INTERNAL_IPS = ()



# Hosts/domain names that are valid for this site.

# "*" matches anything, ".example.com" matches example.com and all subdomains

ALLOWED_HOSTS = []



# Local time zone for this installation. All choices can be found here:

# http://en.wikipedia.org/wiki/List_of_tz_zones_by_name (although not all

# systems may support all possibilities). When USE_TZ is True, this is

django/conf/project_template/project_name/settings.py

+4 −0
Original line number Diff line number Diff line
@@ -21,6 +21,10 @@ DATABASES = { 
    }

}



# Hosts/domain names that are valid for this site; required if DEBUG is False

# See https://docs.djangoproject.com/en/{{ docs_version }}/ref/settings/#allowed-hosts

ALLOWED_HOSTS = []



# Local time zone for this installation. Choices can be found here:

# http://en.wikipedia.org/wiki/List_of_tz_zones_by_name

# although not all choices may be available on all operating systems.

django/contrib/auth/tests/views.py

+1 −0
Original line number Diff line number Diff line
@@ -105,6 +105,7 @@ class PasswordResetTest(AuthViewsTestCase): 
        self.assertEqual(len(mail.outbox), 1)

        self.assertEqual("staffmember@example.com", mail.outbox[0].from_email)



    @override_settings(ALLOWED_HOSTS=['adminsite.com'])

    def test_admin_reset(self):

        "If the reset view is marked as being for admin, the HTTP_HOST header is used for a domain override."

        response = self.client.post('/admin_password_reset/',

django/contrib/contenttypes/tests.py

+2 −0
Original line number Diff line number Diff line
@@ -6,6 +6,7 @@ from django.contrib.contenttypes.views import shortcut 
from django.contrib.sites.models import Site, get_current_site

from django.http import HttpRequest, Http404

from django.test import TestCase

from django.test.utils import override_settings

from django.utils.http import urlquote

from django.utils import six

from django.utils.encoding import python_2_unicode_compatible
@@ -203,6 +204,7 @@ class ContentTypesTests(TestCase): 
        })





    @override_settings(ALLOWED_HOSTS=['example.com'])

    def test_shortcut_view(self):

        """

        Check that the shortcut view (used for the admin "view on site"

django/contrib/sites/tests.py

+2 −0
Original line number Diff line number Diff line
@@ -5,6 +5,7 @@ from django.contrib.sites.models import Site, RequestSite, get_current_site 
from django.core.exceptions import ObjectDoesNotExist

from django.http import HttpRequest

from django.test import TestCase

from django.test.utils import override_settings





class SitesFrameworkTests(TestCase):
@@ -41,6 +42,7 @@ class SitesFrameworkTests(TestCase): 
        site = Site.objects.get_current()

        self.assertEqual("Example site", site.name)



    @override_settings(ALLOWED_HOSTS=['example.com'])

    def test_get_current_site(self):

        # Test that the correct Site object is returned

        request = HttpRequest()