commit 8a01c6b53169ee079cb21ac5919fdafcc8c5e172
Author: Florian Apolloner <florian@apolloner.eu>
Date:   Wed Nov 11 20:10:55 2015 +0100

    [1.7.x] Fixed a settings leak possibility in the date template filter.
    
    This is a security fix.

--- a/django/utils/formats.py
+++ b/django/utils/formats.py
@@ -15,6 +15,24 @@
 _format_cache = {}
 _format_modules_cache = {}
 
+FORMAT_SETTINGS = frozenset([
+    'DECIMAL_SEPARATOR',
+    'THOUSAND_SEPARATOR',
+    'NUMBER_GROUPING',
+    'FIRST_DAY_OF_WEEK',
+    'MONTH_DAY_FORMAT',
+    'TIME_FORMAT',
+    'DATE_FORMAT',
+    'DATETIME_FORMAT',
+    'SHORT_DATE_FORMAT',
+    'SHORT_DATETIME_FORMAT',
+    'YEAR_MONTH_FORMAT',
+    'DATE_INPUT_FORMATS',
+    'TIME_INPUT_FORMATS',
+    'DATETIME_INPUT_FORMATS',
+])
+
+
 def reset_format_cache():
     """Clear any cached formats.
 
@@ -66,6 +84,8 @@
     be localized (or not), overriding the value of settings.USE_L10N.
     """
     format_type = smart_str(format_type)
+    if format_type not in FORMAT_SETTINGS:
+        return format_type
     if use_l10n or (use_l10n is None and settings.USE_L10N):
         if lang is None:
             lang = get_language()
--- a/tests/regressiontests/i18n/tests.py
+++ b/tests/regressiontests/i18n/tests.py
@@ -817,6 +817,9 @@
                 self.assertEqual(t_plur.render(Context({'percent': 42, 'num': 1})), u'42% stellt 1 Objekt dar')
                 self.assertEqual(t_plur.render(Context({'percent': 42, 'num': 4})), u'42% stellt 4 Objekte dar')
 
+    def test_format_arbitrary_settings(self):
+        self.assertEqual(get_format('DEBUG'), 'DEBUG')
+
 
 class ResolutionOrderI18NTests(TestCase):