|
@@ -797,7 +797,7 @@ Historically, :mod:`django.contrib.sessions` used :mod:`pickle` to serialize
|
|
|
session data before storing it in the backend. If you're using the :ref:`signed
|
|
|
cookie session backend<cookie-session-backend>` and :setting:`SECRET_KEY` is
|
|
|
known by an attacker (there isn't an inherent vulnerability in Django that
|
|
|
-would cause it to leak), the attacker could insert a string into his session
|
|
|
+would cause it to leak), the attacker could insert a string into their session
|
|
|
which, when unpickled, executes arbitrary code on the server. The technique for
|
|
|
doing so is simple and easily available on the internet. Although the cookie
|
|
|
session storage signs the cookie-stored data to prevent tampering, a
|