mirror of
https://github.com/django/django.git
synced 2025-07-23 05:05:17 +00:00
parent
6d1ae5e27c
commit
4965a77407
15 changed files with 48 additions and 211 deletions
|
@ -226,8 +226,8 @@ User-uploaded content
|
|||
served in ways that do not follow security best practices. Specifically, an
|
||||
HTML file can be uploaded as an image if that file contains a valid PNG
|
||||
header followed by malicious HTML. This file will pass verification of the
|
||||
libraries that Django uses for :class:`~django.db.models.ImageField` image
|
||||
processing (PIL or Pillow). When this file is subsequently displayed to a
|
||||
library that Django uses for :class:`~django.db.models.ImageField` image
|
||||
processing (Pillow). When this file is subsequently displayed to a
|
||||
user, it may be displayed as HTML depending on the type and configuration of
|
||||
your web server.
|
||||
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue