Security patch for django-filer
The updated release 2.2.5 is now available from our GitHub repository and PyPI.
Details
django filer did not check permissions properly for listing directories, moving files or folders, or uploading files. Effectively, a staff user without any permissions could thereby browse filer's folder tree if they knew the url. This vulnerability would expose the folder tree and the files to a staff user without permissions.
Please see the relevant commits on GitHub for more information about the vulnerability and mitigation.
Thanks to Akshar Tank for the detailed report through our security email.
As ever, we remind our users and contributors that all security reports, patches and concerns be addressed only to our security team by email, at [email protected]
Please do not use GitHub, our email lists or slack to report, address or otherwise discuss matters relating to security.
Fabian Braun
django CMS Fellow
Release
django CMS 5.1 is here: easier setup, flexible deployments, and a fresh editing experience
This release reduces friction across the whole project lifecycle: creating a new project, adding django CMS to an existing Django application, configuring larger deployments, controlling which plugins editors can use, and working with the CMS every day.
Release
django CMS 5.0.9 released: security, accessibility, and stability improvements
This release addresses three medium-severity security vulnerabilities and includes improvements to accessibility, Django compatibility, permissions, Content Security Policy support, and general editor stability.
Case Studies
How we built our professional services digital platform using django CMS
Compound Partners is a UK digital consultancy specialising in audience-centric user experience and content architecture for professional services firms. Fifteen years ago, a developer's recommendation pointed us at django CMS. Today, our entire business is built on it.