From 7c0b1546341ae5761701c4d667cbb6e87327ba19 Mon Sep 17 00:00:00 2001
From: ianb <devnull@localhost>
Date: Mon, 18 Dec 2006 00:28:21 +0000
Subject: Security fix for StaticURLParser, plus unquote SCRIPT_NAME and
 PATH_INFO, plus don't double-unquote in StaticURLParser

---
 docs/news.txt | 10 ++++++++++
 1 file changed, 10 insertions(+)

(limited to 'docs')

diff --git a/docs/news.txt b/docs/news.txt
index 71e925e..6517f0c 100644
--- a/docs/news.txt
+++ b/docs/news.txt
@@ -6,6 +6,16 @@ News
 svn trunk
 ---------
 
+* Security fix for ``paste.urlparser.StaticURLParser``.  The problem
+  allowed escaping the root (and reading files) when used with
+  ``paste.httpserver`` (this does not effect other servers, and does
+  not apply when proxying requests from Apache to
+  ``paste.httpserver``).
+
+* ``paste.httpserver`` and ``paste.fixture.TestApp`` url-unquote
+  ``SCRIPT_NAME`` and ``PATH_INFO``, as specified in the CGI spec.
+  Thanks to Jon Nelson for pointing out both these issues.
+
 * ``paste.registry`` now works within the ``EvalException``
   interactive debugger.
 
-- 
cgit v1.2.1