django/django — pull request #3216 by jdufresne (2014-09-13 01:31:31+00:00)
Title: Fixed 23482 -- Allow both pk and slug lookup in SingleObjectMixin

Previously, if a URL contained both a pk and slug kwarg, the object
would be looked up by only the pk. The slug was ignored. This could
potentially allow for an insecure direct object reference [0] security
hole in a Django applications. Now, when both the pk and slug are
available, look up the object by both fields. If the look up fails, 404
as before.

[0] https://www.owasp.org/index.php/Top_10_2013-A4-Insecure_Direct_Object_References