Carlton Gibson 32124fc41e [1.11.x] Fixed CVE-2019-12781 -- Made HttpRequest always trust SECURE_PROXY_SSL_HEADER if set.
An HTTP request would not be redirected to HTTPS when the
SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings were used if
the proxy connected to Django via HTTPS.

HttpRequest.scheme will now always trust the SECURE_PROXY_SSL_HEADER if
set, rather than falling back to the request scheme when the
SECURE_PROXY_SSL_HEADER did not have the secure value.

Thanks to Gavin Wahl for the report and initial patch suggestion, and
Shai Berger for review.

Backport of 54d0f5e62f54c29a12dd96f44bacd810cbe03ac8 from master.
2019-07-01 08:40:19 +02:00
..
2015-08-22 20:25:42 +02:00
2016-11-14 12:30:46 -05:00
2015-08-22 20:25:42 +02:00
2016-11-14 12:30:46 -05:00
2016-11-14 12:30:46 -05:00
2015-02-06 12:58:45 +01:00

To run the test suite, first, create and activate a virtual environment. Then install some requirements and run the tests:

$ cd tests
$ pip install -e ..
$ pip install -r requirements/py3.txt  # or py2.txt
$ ./runtests.py

For more information about the test suite, see https://docs.djangoproject.com/en/dev/internals/contributing/writing-code/unit-tests/.