Bug 905688 (CVE-2023-31047)

Summary:	<dev-python/django-{3.2.19,4.1.9,4.2.1}: Potential bypass of validation when uploading multiple files using one form field
Product:	Gentoo Security	Reporter:	Michał Górny <mgorny>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	python
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://docs.djangoproject.com/en/4.2/releases/4.2.1/
Whiteboard:	B4 [noglsa]
Package list:		Runtime testing required:	---
Bug Depends on:	905685, 905686, 905687
Bug Blocks:

Description Michał Górny archtester

2023-05-04 07:27:02 UTC

From $URL:

```
CVE-2023-31047: Potential bypass of validation when uploading multiple files using one form field¶

Uploading multiple files using one form field has never been supported by forms.FileField or forms.ImageField as only the last uploaded file was validated. Unfortunately, Uploading multiple files topic suggested otherwise.

In order to avoid the vulnerability, ClearableFileInput and FileInput form widgets now raise ValueError when the multiple HTML attribute is set on them. To prevent the exception and keep the old behavior, set allow_multiple_selected to True.
```

Comment 1 Michał Górny archtester

2023-05-04 15:30:45 UTC

cleanup done.

Comment 2 John Helmert III archtester

2023-05-08 03:59:37 UTC

Thank you! All done.