django/django — pull request #365 by bouchardsyl (2012-09-09 20:47:10+00:00)
Title: Fixed #17869 - security improvement to RemoteUserMiddleware

- RemoteUserMiddleware forces logout when REMOTE_USER header disappears
during a same browser session.
- Added a test and documentation for the 1.5 release.

Notes :
- Target version is 1.5
- Originally fixed during DjangoCon sprints in Zurich. I made a new commit based on today's fork (Sept 9, 2012)
- Test with this command : ./runtests.py --settings=test_sqlite auth
- Quoting an email from Paul McMillan : "this is a minor security fix so it should be backported to 1.4"