Re: 1.9 release planning

2015-04-05 Thread Cheng Chi
If 5 versions between LTS are too many, what about change LTS interval to 2 years instead 3 years, like Ubuntu, so there are only 3 versions between two LTS versions. Benefits: - Easier to stick with one LTS instead of catching edge as you are only 1 or 2 versions behind in most time. (If you

Re: Possible security issue using request.read()

2015-04-05 Thread Florian Apolloner
Technically we'd set the sockettimeout already in the __init__ of LimitedStream, but in the end I think this is better fixed at the loadbalancer/webserver level as with any other attack similar/equal to "slowloris". There speaks nothing against docs though… Cheers, Florian -- You received thi

Possible security issue using request.read()

2015-04-05 Thread Andriy Sokolovskiy (coldmind)
(I discussed this issue before with Florian Apolloner in secur...@djangoproject.com, and we decided to open a thread here). Consider simple view: class MyView(View): def patch(self, request, *args, **kwargs): request.read() return HttpResponse('test') Next, consider requ