Changeset 7522 for django

Timestamp:

05/10/08 08:36:17 (2 months ago)

Author:

russellm

Message:

newforms-admin: Removed mark_safe from the saved request path on the admin login form. This prevents a potential XSS attack. Formal announcement will be forthcoming.

Files:

• django/branches/newforms-admin/django/contrib/admin/views/decorators.py (modified) (1 diff)

django/branches/newforms-admin/django/contrib/admin/views/decorators.py

@@ -30 +30 @@
-    return render_to_response('admin/login.html', {
-        'title': _('Log in'),
-mark_safe(request.path)
+request.path
-        'post_data': post_data,
-        'error_message': error_message