Django 1.4.2 release notes

This is the second security release in the Django 1.4 series.

Django’s own built-in parsing of the Host header is, however, still vulnerable, as was reported to us recently. The Host header parsing in Django 1.3.3 and Django 1.4.1 – specifically, – was incorrectly handling username/password information in the header. Thus, for example, the following Host header would be accepted by Django when running on “validsite.com”:

To remedy this, the parsing in is being modified; Host headers which contain potentially dangerous content (such as username/password pairs) now raise the exception django.core.exceptions.SuspiciousOperation.

• Subclass HTMLParser only for appropriate Python versions (#18239).
• Added batch_size argument to qs.bulk_create() (#17788).
• Fixed a small regression in the admin filters where wrongly formatted dates passed as url parameters caused an unhandled ValidationError (#18530).
• Fixed some Python 2.5 compatibility issues
• Fixed an issue with quoted filenames in Content-Disposition header (#19006)
• Made the context option in and tags accept literals wrapped in single quotes (#18881).