October 17, 2012
This is the second security release in the Django 1.4 series.
Some parts of Django – independent of end-user-written applications – make use of full URLs, including domain name, which are generated from the HTTP Host header. Some attacks against this are beyond Django’s ability to control, and require the web server to be properly configured; Django’s documentation has for some time contained notes advising users on such configuration.
Django’s own built-in parsing of the Host header is, however, still vulnerable, as was reported to us recently. The Host header parsing en the site of nearly constant activity over the past year, with several major new features landing since the 0.96 release. For features which were new as of Django 1.0 alpha 1, see the 1.0 alpha 1 release notes. For features which were new as of Django 1.0 alpha 2, see the 1.0 alpha 2 release notes.
This beta release does not contain any major new features, but does include several smaller updates and improvements to Django:
A number of other improvements and bugfixes have also been included: some tricky cases involving case-sensitivity in differing MySQL collations have been resolved, Windows packaging and installation has been improved and the method by which Django generates unique session identifiers has been made much more robust.
One of the primary goals of this beta release is to focus attention on the remaining features to be im