python-django16 (1.6.6-1ubuntu7) wily; urgency=medium

  * debian/patches/pymysql-replacement.patch: Use pymysql as drop in
    replacement for MySQLdb.

 -- Corey Bryant <corey.bryant@canonical.com>  Tue, 25 Aug 2015 15:18:28 -0400

python-django16 (1.6.6-1ubuntu6) wily; urgency=medium

  * debian/control: Drop python-mysqldb in favor of python-pymysql.

 -- Corey Bryant <corey.bryant@canonical.com>  Mon, 24 Aug 2015 11:03:45 -0400

python-django16 (1.6.6-1ubuntu5) vivid; urgency=medium

  [ Marc Deslauriers ]
  * SECURITY UPDATE: denial-of-service possibility with strip_tags
    - debian/patches/CVE-2015-2316.patch: fix infinite loop possibility
      in django/utils/html.py, added test to
      tests/utils_tests/test_html.py.
    - CVE-2015-2316
  * SECURITY UPDATE: XSS attack via user-supplied redirect URLs
    - debian/patches/CVE-2015-2317.patch: reject URLs that start with
      control characters in django/utils/http.py, added test to
      tests/utils_tests/test_http.py.
    - CVE-2015-2317 

 -- Andres Rodriguez <andreserl@ubuntu.com>  Mon, 23 Mar 2015 16:49:34 -0400

python-django16 (1.6.6-1ubuntu4) vivid; urgency=medium

  * Package as python-django16. This is to allow projects that dont yet
    support django 1.7 migrations, to continue to use django 1.6.

 -- Andres Rodriguez <andreserl@ubuntu.com>  Mon, 23 Mar 2015 11:21:17 -0400

python-django (1.6.6-1ubuntu3) vivid; urgency=medium

  * SECURITY UPDATE: WSGI header spoofing via underscore/dash conflation
    - debian/patches/CVE-2015-0219.patch: strip headers with underscores in
      django/core/servers/basehttp.py, added blurb to
      docs/howto/auth-remote-user.txt, added test to
      tests/servers/test_basehttp.py.
    - CVE-2015-0219
  * SECURITY UPDATE: Mitigated possible XSS attack via user-supplied
    redirect URLs
    - debian/patches/CVE-2015-0220.patch: filter url in
      django/utils/http.py, added test to tests/utils_tests/test_http.py.
    - CVE-2015-0220
  * SECURITY UPDATE: Denial-of-service attack against
    django.views.static.serve
    - debian/patches/CVE-2015-0221.patch: limit large files in
      django/views/static.py, added test to
      tests/view_tests/media/long-line.txt,
      tests/view_tests/tests/test_static.py.
    - CVE-2015-0221
  * SECURITY UPDATE: Database denial-of-service with
    ModelMultipleChoiceField
    - debian/patches/CVE-2015-0222.patch: check values in
      django/forms/models.py, added test to tests/model_forms/tests.py.
    - CVE-2015-0222

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 13 Jan 2015 07:32:43 -0500

python-django (1.6.6-1ubuntu2) utopic; urgency=medium

  * debian/patches/fix_test_encoding.patch: Fix test encoding headers,
    otherwise it FTBFS.

 -- Andres Rodriguez <andreserl@ubuntu.com>  Thu, 18 Sep 2014 19:01:13 -0500

python-django (1.6.6-1ubuntu1) utopic; urgency=medium

  * debian/patches/99_fix_multipart_base64_decoding_large_files.patch:
    Fix Multipart base64 file decoding with large files ensuring that the
    actual base64 content has a length a multiple of 4. (LP: #1363348)

 -- Andres Rodriguez <andreserl@ubuntu.com>  Thu, 18 Sep 2014 17:37:57 -0500

python-django (1.6.6-1) unstable; urgency=high

  * New upstream security release.
    - reverse() can generate URLs pointing to other hosts (CVE-2014-0480)
    - file upload denial of service (CVE-2014-0481)
    - RemoteUserMiddleware session hijacking (CVE-2014-0482)
    - data leakage via querystring manipulation in admin (CVE-2014-0483)

  [ Brian May ]
  * Don't output stuff to stdout in django-admin. Closes: #757145

  [ Raphaël Hertzog ]
  * Update Vcs-* fields since the packaging repository moved to git.

 -- Luke Faraone <lfaraone@debian.org>  Wed, 20 Aug 2014 19:30:21 -0700

python-django (1.6.5-3) unstable; urgency=low

  * Replace django-admin with script that can be run as python and shell.

    This means we can autodetect which python version to use when run as
    shell, while maintaining compatability with processes that try to run it
    with a specific python version.

    e.g. See bugs #755341 and #755321.

 -- Brian May <bam@debian.org>  Mon, 21 Jul 2014 10:18:39 +1000

python-django (1.6.5-2) unstable; urgency=low

  * python3-django package. Closes: #736878.

 -- Brian May <bam@debian.org>  Tue, 24 Jun 2014 10:51:47 +1000

# For older changelog entries, run 'apt-get changelog python-django16'
