https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/

CVE-2015-8213: Fixed settings leak possibility in date template filter

If an application allows users to specify an unvalidated format for dates

and passes this format to the date filter, e.g. {{

last_updated|date:user_date_format }}, then a malicious user could obtain

any secret in the application's settings by specifying a settings key

instead of a date format. e.g. "SECRET_KEY" instead of "j/m/Y".

To remedy this, the underlying function used by the date template filter,

django.utils.formats.get_format(), now only allows accessing the date/time

formatting settings.

This is backported from the commit on the 1.7 branch:

    https://github.com/django/django/commit/8a01c6b53169ee079cb21ac5919fdafcc8c5e172

because upstream is no longer maintaining the 1.4 branch.

--- Django-1.4.22/django/utils/formats.py	Tue Aug 18 10:17:02 2015

+++ Django-1.4.22/django/utils/formats.py	Tue Nov 24 15:20:12 2015

@@ -15,6 +15,25 @@

 _format_cache = {}

 _format_modules_cache = {}

+

+FORMAT_SETTINGS = frozenset([

+    'DECIMAL_SEPARATOR',

+    'THOUSAND_SEPARATOR',

+    'NUMBER_GROUPING',

+    'FIRST_DAY_OF_WEEK',

+    'MONTH_DAY_FORMAT',

+    'TIME_FORMAT',

+    'DATE_FORMAT',

+    'DATETIME_FORMAT',

+    'SHORT_DATE_FORMAT',

+    'SHORT_DATETIME_FORMAT',

+    'YEAR_MONTH_FORMAT',

+    'DATE_INPUT_FORMATS',

+    'TIME_INPUT_FORMATS',

+    'DATETIME_INPUT_FORMATS',

+])

+

+

 def reset_format_cache():

     """Clear any cached formats.

@@ -66,6 +85,8 @@

     be localized (or not), overriding the value of settings.USE_L10N.

     """

     format_type = smart_str(format_type)

+    if format_type not in FORMAT_SETTINGS:

+        return format_type

     if use_l10n or (use_l10n is None and settings.USE_L10N):

         if lang is None:

             lang = get_language()

--- Django-1.4.22/tests/regressiontests/i18n/tests.py.orig	Tue Aug 18 10:17:02 2015

+++ Django-1.4.22/tests/regressiontests/i18n/tests.py	Tue Nov 24 15:19:03 2015

@@ -684,6 +684,10 @@

                 self.assertEqual(template2.render(context), output2)

                 self.assertEqual(template3.render(context), output3)

+    def test_format_arbitrary_settings(self):

+        self.assertEqual(get_format('DEBUG'), 'DEBUG')

+

+

 class MiscTests(TestCase):

     def setUp(self):