django CMS 2.1.4 security release issued
This afternoon a possible security issue in our text plugin was brought to our attention. All django CMS versions are affected, and as a result we released version 2.1.4. Thanks go to Klaas van Schelven for reporting this issue.
The security issue fixed in this release allowed users with administrator accounts that have the right to edit pages to inject javascript into text plugins which could allow them to hijack user accounts with higher permission levels than themselves. As a result, no javascript is allowed in the text plugins anymore, and the 2.1.4 release contains a migration script to clean all existing plugins. The snippet plugin, which also has this flaw, continues to allow javascript and should therefore be used very cautiously.
Full list of changes in this release
- No longer allow javascript in text plugins.
- Clean all javascript from text plugins
- Added html5lib as a dependency to do the javascript filtering.
Affected versions
- all versions
Detailed upgrade instructions
Update your django CMS to 2.1.4 and run the south migration using the migrate text management command.
General note concerning security
Please report any potential security issue you discover via private email to [email protected]. Please do not report it to the github issue tracker or any of the mailing lists.
Christian Bertschy
Release
django CMS 5.1 is here: easier setup, flexible deployments, and a fresh editing experience
This release reduces friction across the whole project lifecycle: creating a new project, adding django CMS to an existing Django application, configuring larger deployments, controlling which plugins editors can use, and working with the CMS every day.
Release
django CMS 5.0.9 released: security, accessibility, and stability improvements
This release addresses three medium-severity security vulnerabilities and includes improvements to accessibility, Django compatibility, permissions, Content Security Policy support, and general editor stability.
Case Studies
How we built our professional services digital platform using django CMS
Compound Partners is a UK digital consultancy specialising in audience-centric user experience and content architecture for professional services firms. Fifteen years ago, a developer's recommendation pointed us at django CMS. Today, our entire business is built on it.