637525 - Upgrade Django to Address CSRF Weakness

Status: VERIFIED FIXED

(developer.mozilla.org Graveyard :: User management, task)

Description

[Michael Coates [:mcoates] (acct no longer active)]

Django needs to be upgraded to the current version to address a weakness in CSRF handling. 

Note: This upgrade requires changes to the code in order for AJAX requests to continue working. Specifically, the AJAX requests must be modified to inlclude the CSRF token or the request will fail.

http://www.djangoproject.com/weblog/2011/feb/08/security/


Please schedule MDN to upgrade django as soon as possible

Comment 1

[Michael Coates [:mcoates] (acct no longer active)]

Wil, is this you? Who handles dev.m.o?

Comment 2

[Wil Clouser [:clouserw]]

Might be Les now, some stuff just shifted around.  Morgamic has the chart!

Comment 3

[Eric Shepherd [:sheppy]]

Chart should be on a wiki somewhere. :)

Comment 4

[Les Orchard [:lorchard]]

Still wrapping my head around MDN. The only spot I know that uses Django CSRF in MDN is the submission form for Demo Studio, which also uses a captcha. Not sure if there are more...? lcrouch might know too

Comment 5

[Luke Crouch [:groovecoder]]

Demo submission, but probably also content flagging and/or rating? Anything that does a POST I think.

Comment 6

[Michael Coates [:mcoates] (acct no longer active)]

Ping - is more work needed here to upgrade MDN?

Comment 7

[Luke Crouch [:groovecoder]]

Yeah, we still need to upgrade MDN from 1.2.3 to 1.2.5. I will add this to our next release.

Comment 8

[Luke Crouch [:groovecoder]]

Raymond, we need to pass thru all the MDN stuff - landing, learning, and demos - and make sure 1.2.5 didn't break anything. Good use for the expanded selenium test suite.

Comment 9

[raymond [:retornam] (inactive)]

https://developer-stage9.mozilla.org/ looks good to me so far

Comment 10

[Raymond Forbes[:rforbes]]

has this been propped to production yet?

Comment 11

[Luke Crouch [:groovecoder]]

it's on stage9, I can't check production - unless someone knows how to check without import django; django.VERSION ?

assigning to IT.

python26 manage.py shell
import django
django.VERSION

Comment 12

[Les Orchard [:lorchard]]

(In reply to comment #11)
> it's on stage9, I can't check production - unless someone knows how to check
> without import django; django.VERSION ?
> 
> assigning to IT.
> 
> python26 manage.py shell
> import django
> django.VERSION

Django should be whatever we have in kuma-lib:

https://github.com/mozilla/kuma-lib/tree/master/src

Can't hurt to have IT check this, but we have a problem if it's anything different than what's here (the submodule in kuma-lib):

https://github.com/django/django/blob/b8ac1085778ebed65a5c6d2af6dda4eff82bb66f/django/__init__.py

Comment 13

[Yvan Boily [:ygjb][:yvan]]

Any update on this?

Comment 14

[Corey Shields [:cshields]]

(In reply to comment #13)
> Any update on this?

adding people who deal with mdn nowadays

Comment 15

[Jake Maul [:jakem]]

Production reports this:

In [2]: django.VERSION
Out[2]: (1, 2, 5, 'final', 0)

Comment 16

[Raymond Forbes[:rforbes]]

that is the latest version as of now.

Comment 17

[Will Kahn-Greene [:willkg] ET needinfo? me]

For bugs that are resolved, we remove the security flag. These haven't had their flag removed, so I'm removing it now.