delta/python-packages/django.git, branch stable/1.4.x

[1.4.x] Updated xhtml2pdf URL in docs.

2016-02-16T12:10:13+00:00

[1.4.x] Post-release version bump.

2015-08-18T17:32:24+00:00

[1.4.x] Bumped version for 1.4.22 release.

2015-08-18T12:39:59+00:00

[1.4.x] Fixed DoS possiblity in contrib.auth.views.logout()

2015-08-18T12:35:42+00:00

Refs #20936 -- When logging out/ending a session, don't create a new, empty session.

Previously, when logging out, the existing session was overwritten by a
new sessionid instead of deleting the session altogether.

This behavior added overhead by creating a new session record in
whichever backend was in use: db, cache, etc.

This extra session is unnecessary at the time since no session data is
meant to be preserved when explicitly logging out.

Backport of 393c0e24223c701edeb8ce7dc9d0f852f0c081ad,
088579638b160f3716dc81d194be70c72743593f, and
2dee853ed4def42b7ef1b3b472b395055543cc00 from master

Thanks Florian Apolloner and Carl Meyer for review.

This is a security fix.

[1.4.x] Added stub release notes for security releases.

2015-08-18T12:35:33+00:00

[1.4.x] Fixed #25119 -- Disabled wheel support.

2015-07-13T23:57:52+00:00

[1.4.x] Post-release version bump.

2015-07-08T20:01:55+00:00

[1.4.x] Bumped version for 1.4.21 release.

2015-07-08T11:39:43+00:00

[1.4.x] Prevented newlines from being accepted in some validators.

2015-07-08T11:38:06+00:00

This is a security fix; disclosure to follow shortly.

Thanks to Sjoerd Job Postmus for the report and draft patch.

[1.4.x] Fixed #19324 -- Avoided creating a session record when loading the session.

2015-07-08T11:38:06+00:00

The session record is now only created if/when the session is modified. This
prevents a potential DoS via creation of many empty session records.

This is a security fix; disclosure to follow shortly.