stephenmcd/mezzanine — pull request #720 by Gu1 (2013-07-04 18:13:07+00:00)
Title: UpdateCacheMiddleware trying to access request._message without checking it has been set

UpdateCacheMiddleware try to access request._messages without checking it has been set. This can lead to an exception when MessageMiddleware.process_request has not been run.
Under some circonstances, this can be exploited to make django return an unprocessed response with nevercache tokens, leaking the site's SECRET_KEY.
This can have security implications, notably with cookie-based sessions.

PoC / exploitation scenario:
1. A malicious user send a request with a bad Host header.
2. Django's CommonMiddleware will raise a SuspiciousOperation exception since the bad Host is not present in ALLOWED_HOSTS. No further process_request middleware will be run.
3. The exception is handled [here](https://github.com/django/django/blob/1.5.1/django/core/handlers/base.py#L175). This calls the handle_uncaught_exception method which returns mezzanine's custom 500 response when DEBUG=False.
4. Django still [tries to call the process_response](https://github.com/django/django/blob/1.5.1/django/core/handlers/base.py#L184) on the error response. UpdateCacheMiddleware raise an AttributeError when trying to access request._message
5. Django [call handle_uncaught_exception again](https://github.com/django/django/blob/1.5.1/django/core/handlers/base.py#L191) but this time return the response raw with the nevercache tokens containing the SECRET_KEY
6. ...