search

sourabhtk37 / CodeShare

A django application for sharing code snippets.
GNU General Public License v3.0
3 stars 12 forks source link

Update django to 2.2.3 #81

Closed pyup-bot closed 5 years ago

pyup-bot commented 5 years ago

This PR updates Django from 1.11.2 to 2.2.3.

Changelog ### 2.2.3 ``` ========================== *Expected July 1, 2019* Django 2.2.3 fixes several bugs in 2.2.2. Also, the latest string translations from Transifex are incorporated. Bugfixes ======== * Fixed a regression in Django 2.2 where :class:`~django.db.models.Avg`, :class:`~django.db.models.StdDev`, and :class:`~django.db.models.Variance` crash with ``filter`` argument (:ticket:`30542`). * Fixed a regression in Django 2.2.2 where auto-reloader crashes with ``AttributeError``, e.g. when using ``ipdb`` (:ticket:`30588`). ========================== ``` ### 2.2.2 ``` ========================== *June 3, 2019* Django 2.2.2 fixes security issues and several bugs in 2.2.1. CVE-2019-12308: AdminURLFieldWidget XSS --------------------------------------- The clickable "Current URL" link generated by ``AdminURLFieldWidget`` displayed the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link. ``AdminURLFieldWidget`` now validates the provided value using :class:`~django.core.validators.URLValidator` before displaying the clickable link. You may customize the validator by passing a ``validator_class`` kwarg to ``AdminURLFieldWidget.__init__()``, e.g. when using :attr:`~django.contrib.admin.ModelAdmin.formfield_overrides`. Patched bundled jQuery for CVE-2019-11358: Prototype pollution -------------------------------------------------------------- jQuery before 3.4.0, mishandles ``jQuery.extend(true, {}, ...)`` because of ``Object.prototype`` pollution. If an unsanitized source object contained an enumerable ``__proto__`` property, it could extend the native ``Object.prototype``. The bundled version of jQuery used by the Django admin has been patched to allow for the ``select2`` library's use of ``jQuery.extend()``. Bugfixes ======== * Fixed a regression in Django 2.2 that stopped Show/Hide toggles working on dynamically added admin inlines (:ticket:`30459`). * Fixed a regression in Django 2.2 where deprecation message crashes if ``Meta.ordering`` contains an expression (:ticket:`30463`). * Fixed a regression in Django 2.2.1 where :class:`~django.contrib.postgres.search.SearchVector` generates SQL with a redundant ``Coalesce`` call (:ticket:`30488`). * Fixed a regression in Django 2.2 where auto-reloader doesn't detect changes in ``manage.py`` file when using ``StatReloader`` (:ticket:`30479`). * Fixed crash of :class:`~django.contrib.postgres.aggregates.ArrayAgg` and :class:`~django.contrib.postgres.aggregates.StringAgg` with ``ordering`` argument when used in a ``Subquery`` (:ticket:`30315`). * Fixed a regression in Django 2.2 that caused a crash of auto-reloader when an exception with custom signature is raised (:ticket:`30516`). * Fixed a regression in Django 2.2.1 where auto-reloader unnecessarily reloads translation files multiple times when using ``StatReloader`` (:ticket:`30523`). ========================== ``` ### 2.2.1 ``` ========================== *May 1, 2019* Django 2.2.1 fixes several bugs in 2.2. Bugfixes ======== * Fixed a regression in Django 2.1 that caused the incorrect quoting of database user password when using :djadmin:`dbshell` on Oracle (:ticket:`30307`). * Added compatibility for ``psycopg2`` 2.8 (:ticket:`30331`). * Fixed a regression in Django 2.2 that caused a crash when loading the template for the technical 500 debug page (:ticket:`30324`). * Fixed crash of ``ordering`` argument in :class:`~django.contrib.postgres.aggregates.ArrayAgg` and :class:`~django.contrib.postgres.aggregates.StringAgg` when it contains an expression with params (:ticket:`30332`). * Fixed a regression in Django 2.2 that caused a single instance fast-delete to not set the primary key to ``None`` (:ticket:`30330`). * Prevented :djadmin:`makemigrations` from generating infinite migrations for check constraints and partial indexes when ``condition`` contains a :class:`~python:range` object (:ticket:`30350`). * Reverted an optimization in Django 2.2 (:ticket:`29725`) that caused the inconsistent behavior of ``count()`` and ``exists()`` on a reverse many-to-many relationship with a custom manager (:ticket:`30325`). * Fixed a regression in Django 2.2 where :class:`~django.core.paginator.Paginator` crashes if ``object_list`` is a queryset ordered or aggregated over a nested ``JSONField`` key transform (:ticket:`30335`). * Fixed a regression in Django 2.2 where ``IntegerField`` validation of database limits crashes if ``limit_value`` attribute in a custom validator is callable (:ticket:`30328`). * Fixed a regression in Django 2.2 where :class:`~django.contrib.postgres.search.SearchVector` generates SQL that is not indexable (:ticket:`30385`). * Fixed a regression in Django 2.2 that caused an exception to be raised when a custom error handler could not be imported (:ticket:`30318`). * Relaxed the system check added in Django 2.2 for the admin app's dependencies to reallow use of :class:`~django.contrib.sessions.middleware.SessionMiddleware` subclasses, rather than requiring :mod:`django.contrib.sessions` to be in :setting:`INSTALLED_APPS` (:ticket:`30312`). * Increased the default timeout when using ``Watchman`` to 5 seconds to prevent falling back to ``StatReloader`` on larger projects and made it customizable via the ``DJANGO_WATCHMAN_TIMEOUT`` environment variable (:ticket:`30361`). * Fixed a regression in Django 2.2 that caused a crash when migrating permissions for proxy models if the target permissions already existed. For example, when a permission had been created manually or a model had been migrated from concrete to proxy (:ticket:`30351`). * Fixed a regression in Django 2.2 that caused a crash of :djadmin:`runserver` when URLConf modules raised exceptions (:ticket:`30323`). * Fixed a regression in Django 2.2 where changes were not reliably detected by auto-reloader when using ``StatReloader`` (:ticket:`30323`). * Fixed a migration crash on Oracle and PostgreSQL when adding a check constraint with a ``contains``, ``startswith``, or ``endswith`` lookup (or their case-insensitive variant) (:ticket:`30408`). * Fixed a migration crash on Oracle and SQLite when adding a check constraint with ``condition`` contains ``|`` (``OR``) operator (:ticket:`30412`). ======================== ``` ### 2.2 ``` ======================== *April 1, 2019* Welcome to Django 2.2! These release notes cover the :ref:`new features <whats-new-2.2>`, as well as some :ref:`backwards incompatible changes <backwards-incompatible-2.2>` you'll want to be aware of when upgrading from Django 2.1 or earlier. We've :ref:`begun the deprecation process for some features <deprecated-features-2.2>`. See the :doc:`/howto/upgrade-version` guide if you're updating an existing project. Django 2.2 is designated as a :term:`long-term support release`. It will receive security updates for at least three years after its release. Support for the previous LTS, Django 1.11, will end in April 2020. Python compatibility ==================== Django 2.2 supports Python 3.5, 3.6, and 3.7. We **highly recommend** and only officially support the latest release of each series. .. _whats-new-2.2: What's new in Django 2.2 ======================== Constraints ----------- The new :class:`~django.db.models.CheckConstraint` and :class:`~django.db.models.UniqueConstraint` classes enable adding custom database constraints. Constraints are added to models using the :attr:`Meta.constraints <django.db.models.Options.constraints>` option. Minor features -------------- :mod:`django.contrib.admin` ~~~~~~~~~~~~~~~~~~~~~~~~~~~ * Added a CSS class to the column headers of :class:`~django.contrib.admin.TabularInline`. :mod:`django.contrib.auth` ~~~~~~~~~~~~~~~~~~~~~~~~~~ * The ``HttpRequest`` is now passed as the first positional argument to :meth:`.RemoteUserBackend.configure_user`, if it accepts it. :mod:`django.contrib.gis` ~~~~~~~~~~~~~~~~~~~~~~~~~ * Added Oracle support for the :class:`~django.contrib.gis.db.models.functions.Envelope` function. * Added SpatiaLite support for the :lookup:`coveredby` and :lookup:`covers` lookups. :mod:`django.contrib.postgres` ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ * The new ``ordering`` argument for :class:`~django.contrib.postgres.aggregates.ArrayAgg` and :class:`~django.contrib.postgres.aggregates.StringAgg` determines the ordering of the aggregated elements. * The new :class:`~django.contrib.postgres.indexes.BTreeIndex`, :class:`~django.contrib.postgres.indexes.HashIndex` and :class:`~django.contrib.postgres.indexes.SpGistIndex` classes allow creating ``B-Tree``, ``hash``, and ``SP-GiST`` indexes in the database. * :class:`~django.contrib.postgres.indexes.BrinIndex` now has the ``autosummarize`` parameter. * The new ``search_type`` parameter of :class:`~django.contrib.postgres.search.SearchQuery` allows searching for a phrase or raw expression. :mod:`django.contrib.staticfiles` ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ * Added path matching to the :option:`collectstatic --ignore` option so that patterns like ``/vendor/*.js`` can be used. Database backends ~~~~~~~~~~~~~~~~~ * Added result streaming for :meth:`.QuerySet.iterator` on SQLite. Generic Views ~~~~~~~~~~~~~ * The new :meth:`View.setup <django.views.generic.base.View.setup>` hook initializes view attributes before calling :meth:`~django.views.generic.base.View.dispatch`. It allows mixins to setup instance attributes for reuse in child classes. Internationalization ~~~~~~~~~~~~~~~~~~~~ * Added support and translations for the Armenian language. Management Commands ~~~~~~~~~~~~~~~~~~~ * The new :option:`--force-color` option forces colorization of the command output. * :djadmin:`inspectdb` now creates models for foreign tables on PostgreSQL. * :option:`inspectdb --include-views` now creates models for materialized views on Oracle and PostgreSQL. * The new :option:`inspectdb --include-partitions` option allows creating models for partition tables on PostgreSQL. In older versions, models are created child tables instead the parent. * :djadmin:`inspectdb` now introspects :class:`~django.db.models.DurationField` for Oracle and PostgreSQL, and :class:`~django.db.models.AutoField` for SQLite. * On Oracle, :djadmin:`dbshell` is wrapped with ``rlwrap``, if available. ``rlwrap`` provides a command history and editing of keyboard input. * The new :option:`makemigrations --no-header` option avoids writing header comments in generated migration file(s). This option is also available for :djadmin:`squashmigrations`. * :djadmin:`runserver` can now use `Watchman <https://facebook.github.io/watchman/>`_ to improve the performance of watching a large number of files for changes. Migrations ~~~~~~~~~~ * The new :option:`migrate --plan` option prints the list of migration operations that will be performed. * ``NoneType`` can now be serialized in migrations. * You can now :ref:`register custom serializers <custom-migration-serializers>` for migrations. Models ~~~~~~ * Added support for PostgreSQL operator classes (:attr:`.Index.opclasses`). * Added support for partial indexes (:attr:`.Index.condition`). * Added the :class:`~django.db.models.functions.NullIf` and :class:`~django.db.models.functions.Reverse` database functions, as well as many :ref:`math database functions <math-functions>`. * Setting the new ``ignore_conflicts`` parameter of :meth:`.QuerySet.bulk_create` to ``True`` tells the database to ignore failure to insert rows that fail uniqueness constraints or other checks. * The new :class:`~django.db.models.functions.ExtractIsoYear` function extracts ISO-8601 week-numbering years from :class:`~django.db.models.DateField` and :class:`~django.db.models.DateTimeField`, and the new :lookup:`iso_year` lookup allows querying by an ISO-8601 week-numbering year. * The new :meth:`.QuerySet.bulk_update` method allows efficiently updating specific fields on multiple model instances. * Django no longer always starts a transaction when a single query is being performed, such as ``Model.save()``, ``QuerySet.update()``, and ``Model.delete()``. This improves the performance of autocommit by reducing the number of database round trips. * Added SQLite support for the :class:`~django.db.models.StdDev` and :class:`~django.db.models.Variance` functions. * The handling of ``DISTINCT`` aggregation is added to the :class:`~django.db.models.Aggregate` class. Adding :attr:`allow_distinct = True <django.db.models.Aggregate.allow_distinct>` as a class attribute on ``Aggregate`` subclasses allows a ``distinct`` keyword argument to be specified on initialization to ensure that the aggregate function is only called for each distinct value of ``expressions``. * The :meth:`.RelatedManager.add`, :meth:`~.RelatedManager.create`, :meth:`~.RelatedManager.remove`, :meth:`~.RelatedManager.set`, ``get_or_create()``, and ``update_or_create()`` methods are now allowed on many-to-many relationships with intermediate models. The new ``through_defaults`` argument is used to specify values for new intermediate model instance(s). Requests and Responses ~~~~~~~~~~~~~~~~~~~~~~ * Added :attr:`.HttpRequest.headers` to allow simple access to a request's headers. Serialization ~~~~~~~~~~~~~ * You can now deserialize data using natural keys containing :ref:`forward references <natural-keys-and-forward-references>` by passing ``handle_forward_references=True`` to ``serializers.deserialize()``. Additionally, :djadmin:`loaddata` handles forward references automatically. Tests ~~~~~ * The new :meth:`.SimpleTestCase.assertURLEqual` assertion checks for a given URL, ignoring the ordering of the query string. :meth:`~.SimpleTestCase.assertRedirects` uses the new assertion. * The test :class:`~.django.test.Client` now supports automatic JSON serialization of list and tuple ``data`` when ``content_type='application/json'``. * The new :setting:`ORACLE_MANAGED_FILES <TEST_ORACLE_MANAGED_FILES>` test database setting allows using Oracle Managed Files (OMF) tablespaces. * Deferrable database constraints are now checked at the end of each :class:`~django.test.TestCase` test on SQLite 3.20+, just like on other backends that support deferrable constraints. These checks aren't implemented for older versions of SQLite because they would require expensive table introspection there. * :class:`~django.test.runner.DiscoverRunner` now skips the setup of databases not :ref:`referenced by tests<testing-multi-db>`. URLs ~~~~ * The new :attr:`.ResolverMatch.route` attribute stores the route of the matching URL pattern. Validators ~~~~~~~~~~ * :class:`.MaxValueValidator`, :class:`.MinValueValidator`, :class:`.MinLengthValidator`, and :class:`.MaxLengthValidator` now accept a callable ``limit_value``. .. _backwards-incompatible-2.2: Backwards incompatible changes in 2.2 ===================================== Database backend API -------------------- This section describes changes that may be needed in third-party database backends. * Third-party database backends must implement support for table check constraints or set ``DatabaseFeatures.supports_table_check_constraints`` to ``False``. * Third party database backends must implement support for ignoring constraints or uniqueness errors while inserting or set ``DatabaseFeatures.supports_ignore_conflicts`` to ``False``. * Third party database backends must implement introspection for ``DurationField`` or set ``DatabaseFeatures.can_introspect_duration_field`` to ``False``. * ``DatabaseFeatures.uses_savepoints`` now defaults to ``True``. * Third party database backends must implement support for partial indexes or set ``DatabaseFeatures.supports_partial_indexes`` to ``False``. * ``DatabaseIntrospection.table_name_converter()`` and ``column_name_converter()`` are removed. Third party database backends may need to instead implement ``DatabaseIntrospection.identifier_converter()``. In that case, the constraint names that ``DatabaseIntrospection.get_constraints()`` returns must be normalized by ``identifier_converter()``. * SQL generation for indexes is moved from :class:`~django.db.models.Index` to ``SchemaEditor`` and these ``SchemaEditor`` methods are added: * ``_create_primary_key_sql()`` and ``_delete_primary_key_sql()`` * ``_delete_index_sql()`` (to pair with ``_create_index_sql()``) * ``_delete_unique_sql`` (to pair with ``_create_unique_sql()``) * ``_delete_fk_sql()`` (to pair with ``_create_fk_sql()``) * ``_create_check_sql()`` and ``_delete_check_sql()`` * The third argument of ``DatabaseWrapper.__init__()``, ``allow_thread_sharing``, is removed. Admin actions are no longer collected from base ``ModelAdmin`` classes ---------------------------------------------------------------------- For example, in older versions of Django:: from django.contrib import admin class BaseAdmin(admin.ModelAdmin): actions = ['a'] class SubAdmin(BaseAdmin): actions = ['b'] ``SubAdmin`` would have actions ``'a'`` and ``'b'``. Now ``actions`` follows standard Python inheritance. To get the same result as before:: class SubAdmin(BaseAdmin): actions = BaseAdmin.actions + ['b'] :mod:`django.contrib.gis` ------------------------- * Support for GDAL 1.9 and 1.10 is dropped. ``TransactionTestCase`` serialized data loading ----------------------------------------------- Initial data migrations are now loaded in :class:`~django.test.TransactionTestCase` at the end of the test, after the database flush. In older versions, this data was loaded at the beginning of the test, but this prevents the :option:`test --keepdb` option from working properly (the database was empty at the end of the whole test suite). This change shouldn't have an impact on your tests unless you've customized :class:`~django.test.TransactionTestCase`'s internals. ``sqlparse`` is required dependency ----------------------------------- To simplify a few parts of Django's database handling, `sqlparse <https://pypi.org/project/sqlparse/>`_ is now a required dependency. It's automatically installed along with Django. ``cached_property`` aliases --------------------------- In usage like:: from django.utils.functional import cached_property class A: cached_property def base(self): return ... alias = base ``alias`` is not cached. Where the problem can be detected (Python 3.6 and later), such usage now raises ``TypeError: Cannot assign the same cached_property to two different names ('base' and 'alias').`` Use this instead:: import operator class A: ... alias = property(operator.attrgetter('base')) Permissions for proxy models ---------------------------- :ref:`Permissions for proxy models <proxy-models-permissions-topic>` are now created using the content type of the proxy model rather than the content type of the concrete model. A migration will update existing permissions when you run :djadmin:`migrate`. In the admin, the change is transparent for proxy models having the same ``app_label`` as their concrete model. However, in older versions, users with permissions for a proxy model with a *different* ``app_label`` than its concrete model couldn't access the model in the admin. That's now fixed, but you might want to audit the permissions assignments for such proxy models (``[add|view|change|delete]_myproxy``) prior to upgrading to ensure the new access is appropriate. Finally, proxy model permission strings must be updated to use their own ``app_label``. For example, for ``app.MyProxyModel`` inheriting from ``other_app.ConcreteModel``, update ``user.has_perm('other_app.add_myproxymodel')`` to ``user.has_perm('app.add_myproxymodel')``. Merging of form ``Media`` assets -------------------------------- Form ``Media`` assets are now merged using a topological sort algorithm, as the old pairwise merging algorithm is insufficient for some cases. CSS and JavaScript files which don't include their dependencies may now be sorted incorrectly (where the old algorithm produced results correctly by coincidence). Audit all ``Media`` classes for any missing dependencies. For example, widgets depending on ``django.jQuery`` must specify ``js=['admin/js/jquery.init.js', ...]`` when :ref:`declaring form media assets <assets-as-a-static-definition>`. Miscellaneous ------------- * To improve readability, the ``UUIDField`` form field now displays values with dashes, e.g. ``550e8400-e29b-41d4-a716-446655440000`` instead of ``550e8400e29b41d4a716446655440000``. * On SQLite, ``PositiveIntegerField`` and ``PositiveSmallIntegerField`` now include a check constraint to prevent negative values in the database. If you have existing invalid data and run a migration that recreates a table, you'll see ``CHECK constraint failed``. * For consistency with WSGI servers, the test client now sets the ``Content-Length`` header to a string rather than an integer. * The return value of :func:`django.utils.text.slugify` is no longer marked as HTML safe. * The default truncation character used by the :tfilter:`urlizetrunc`, :tfilter:`truncatechars`, :tfilter:`truncatechars_html`, :tfilter:`truncatewords`, and :tfilter:`truncatewords_html` template filters is now the real ellipsis character (``…``) instead of 3 dots. You may have to adapt some test output comparisons. * Support for bytestring paths in the template filesystem loader is removed. * :func:`django.utils.http.urlsafe_base64_encode` now returns a string instead of a bytestring, and :func:`django.utils.http.urlsafe_base64_decode` may no longer be passed a bytestring. * Support for ``cx_Oracle`` < 6.0 is removed. * The minimum supported version of ``mysqlclient`` is increased from 1.3.7 to 1.3.13. * The minimum supported version of SQLite is increased from 3.7.15 to 3.8.3. * In an attempt to provide more semantic query data, ``NullBooleanSelect`` now renders ``<option>`` values of ``unknown``, ``true``, and ``false`` instead of ``1``, ``2``, and ``3``. For backwards compatibility, the old values are still accepted as data. * :attr:`Group.name <django.contrib.auth.models.Group.name>` ``max_length`` is increased from 80 to 150 characters. * Tests that violate deferrable database constraints now error when run on SQLite 3.20+, just like on other backends that support such constraints. * To catch usage mistakes, the test :class:`~django.test.Client` and :func:`django.utils.http.urlencode` now raise ``TypeError`` if ``None`` is passed as a value to encode because ``None`` can't be encoded in GET and POST data. Either pass an empty string or omit the value. * The :djadmin:`ping_google` management command now defaults to ``https`` instead of ``http`` for the sitemap's URL. If your site uses http, use the new :option:`ping_google --sitemap-uses-http` option. If you use the :func:`~django.contrib.sitemaps.ping_google` function, set the new ``sitemap_uses_https`` argument to ``False``. * :djadmin:`runserver` no longer supports `pyinotify` (replaced by Watchman). * The :class:`~django.db.models.Avg`, :class:`~django.db.models.StdDev`, and :class:`~django.db.models.Variance` aggregate functions now return a ``Decimal`` instead of a ``float`` when the input is ``Decimal``. * Tests will fail on SQLite if apps without migrations have relations to apps with migrations. This has been a documented restriction since migrations were added in Django 1.7, but it fails more reliably now. You'll see tests failing with errors like ``no such table: <app_label>_<model>``. This was observed with several third-party apps that had models in tests without migrations. You must add migrations for such models. .. _deprecated-features-2.2: Features deprecated in 2.2 ========================== Model ``Meta.ordering`` will no longer affect ``GROUP BY`` queries ------------------------------------------------------------------ A model's ``Meta.ordering`` affecting ``GROUP BY`` queries (such as ``.annotate().values()``) is a common source of confusion. Such queries now issue a deprecation warning with the advice to add an ``order_by()`` to retain the current query. ``Meta.ordering`` will be ignored in such queries starting in Django 3.1. Miscellaneous ------------- * ``django.utils.timezone.FixedOffset`` is deprecated in favor of :class:`datetime.timezone`. * The undocumented ``QuerySetPaginator`` alias of ``django.core.paginator.Paginator`` is deprecated. * The ``FloatRangeField`` model and form fields in ``django.contrib.postgres`` are deprecated in favor of a new name, ``DecimalRangeField``, to match the underlying ``numrange`` data type used in the database. * The ``FILE_CHARSET`` setting is deprecated. Starting with Django 3.1, files read from disk must be UTF-8 encoded. * ``django.contrib.staticfiles.storage.CachedStaticFilesStorage`` is deprecated due to the intractable problems that it has. Use :class:`.ManifestStaticFilesStorage` or a third-party cloud storage instead. * :meth:`.RemoteUserBackend.configure_user` is now passed ``request`` as the first positional argument, if it accepts it. Support for overrides that don't accept it will be removed in Django 3.1. * The :attr:`.SimpleTestCase.allow_database_queries`, :attr:`.TransactionTestCase.multi_db`, and :attr:`.TestCase.multi_db` attributes are deprecated in favor of :attr:`.SimpleTestCase.databases`, :attr:`.TransactionTestCase.databases`, and :attr:`.TestCase.databases`. These new attributes allow databases dependencies to be declared in order to prevent unexpected queries against non-default databases to leak state between tests. The previous behavior of ``allow_database_queries=True`` and ``multi_db=True`` can be achieved by setting ``databases='__all__'``. =========================== ``` ### 2.1.10 ``` =========================== *July 1, 2019* Django 2.1.10 fixes a security issue in 2.1.9. ============================ ``` ### 2.1.9 ``` ============================ *June 3, 2019* Django 2.1.9 fixes security issues in 2.1.8. CVE-2019-12308: AdminURLFieldWidget XSS --------------------------------------- The clickable "Current URL" link generated by ``AdminURLFieldWidget`` displayed the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link. ``AdminURLFieldWidget`` now validates the provided value using :class:`~django.core.validators.URLValidator` before displaying the clickable link. You may customize the validator by passing a ``validator_class`` kwarg to ``AdminURLFieldWidget.__init__()``, e.g. when using :attr:`~django.contrib.admin.ModelAdmin.formfield_overrides`. Patched bundled jQuery for CVE-2019-11358: Prototype pollution -------------------------------------------------------------- jQuery before 3.4.0, mishandles ``jQuery.extend(true, {}, ...)`` because of ``Object.prototype`` pollution. If an unsanitized source object contained an enumerable ``__proto__`` property, it could extend the native ``Object.prototype``. The bundled version of jQuery used by the Django admin has been patched to allow for the ``select2`` library's use of ``jQuery.extend()``. ========================== ``` ### 2.1.8 ``` ========================== *April 1, 2019* Django 2.1.8 fixes a bug in 2.1.7. Bugfixes ======== * Prevented admin inlines for a ``ManyToManyField``\'s implicit through model from being editable if the user only has the view permission (:ticket:`30289`). ========================== ``` ### 2.1.7 ``` ========================== *February 11, 2019* Django 2.1.7 fixes a packaging error in 2.1.6. Bugfixes ======== * Corrected packaging error from 2.1.6 (:ticket:`30175`). ========================== ``` ### 2.1.5 ``` ========================== *January 4, 2019* Django 2.1.5 fixes a security issue and several bugs in 2.1.4. CVE-2019-3498: Content spoofing possibility in the default 404 page ------------------------------------------------------------------- An attacker could craft a malicious URL that could make spoofed content appear on the default page generated by the ``django.views.defaults.page_not_found()`` view. The URL path is no longer displayed in the default 404 template and the ``request_path`` context variable is now quoted to fix the issue for custom templates that use the path. Bugfixes ======== * Fixed compatibility with mysqlclient 1.3.14 (:ticket:`30013`). * Fixed a schema corruption issue on SQLite 3.26+. You might have to drop and rebuild your SQLite database if you applied a migration while using an older version of Django with SQLite 3.26 or later (:ticket:`29182`). * Prevented SQLite schema alterations while foreign key checks are enabled to avoid the possibility of schema corruption (:ticket:`30023`). * Fixed a regression in Django 2.1.4 (which enabled keep-alive connections) where request body data isn't properly consumed for such connections (:ticket:`30015`). * Fixed a regression in Django 2.1.4 where ``InlineModelAdmin.has_change_permission()`` is incorrectly called with a non-``None`` ``obj`` argument during an object add (:ticket:`30050`). ========================== ``` ### 2.1.4 ``` ========================== *December 3, 2018* Django 2.1.4 fixes several bugs in 2.1.3. Bugfixes ======== * Corrected the default password list that ``CommonPasswordValidator`` uses by lowercasing all passwords to match the format expected by the validator (:ticket:`29952`). * Prevented repetitive calls to ``geos_version_tuple()`` in the ``WKBWriter`` class in an attempt to fix a random crash involving ``LooseVersion`` (:ticket:`29959`). * Fixed keep-alive support in ``runserver`` after it was disabled to fix another issue in Django 2.0 (:ticket:`29849`). * Fixed admin view-only change form crash when using ``ModelAdmin.prepopulated_fields`` (:ticket:`29929`). * Fixed "Please correct the errors below" error message when editing an object in the admin if the user only has the "view" permission on inlines (:ticket:`29930`). ========================== ``` ### 2.1.3 ``` ========================== *November 1, 2018* Django 2.1.3 fixes several bugs in 2.1.2. Bugfixes ======== * Fixed a regression in Django 2.0 where combining ``Q`` objects with ``__in`` lookups and lists crashed (:ticket:`29838`). * Fixed a regression in Django 1.11 where ``django-admin shell`` may hang on startup (:ticket:`29774`). * Fixed a regression in Django 2.0 where test databases aren't reused with ``manage.py test --keepdb`` on MySQL (:ticket:`29827`). * Fixed a regression where cached foreign keys that use ``to_field`` were incorrectly cleared in ``Model.save()`` (:ticket:`29896`). * Fixed a regression in Django 2.0 where ``FileSystemStorage`` crashes with ``FileExistsError`` if concurrent saves try to create the same directory (:ticket:`29890`). ========================== ``` ### 2.1.2 ``` ========================== *October 1, 2018* Django 2.1.2 fixes a security issue and several bugs in 2.1.1. Also, the latest string translations from Transifex are incorporated. CVE-2018-16984: Password hash disclosure to "view only" admin users =================================================================== If an admin user has the change permission to the user model, only part of the password hash is displayed in the change form. Admin users with the view (but not change) permission to the user model were displayed the entire hash. While it's typically infeasible to reverse a strong password hash, if your site uses weaker password hashing algorithms such as MD5 or SHA1, it could be a problem. Bugfixes ======== * Fixed a regression where nonexistent joins in ``F()`` no longer raised ``FieldError`` (:ticket:`29727`). * Fixed a regression where files starting with a tilde or underscore weren't ignored by the migrations loader (:ticket:`29749`). * Made migrations detect changes to ``Meta.default_related_name`` (:ticket:`29755`). * Added compatibility for ``cx_Oracle`` 7 (:ticket:`29759`). * Fixed a regression in Django 2.0 where unique index names weren't quoted (:ticket:`29778`). * Fixed a regression where sliced queries with multiple columns with the same name crashed on Oracle 12.1 (:ticket:`29630`). * Fixed a crash when a user with the view (but not change) permission made a POST request to an admin user change form (:ticket:`29809`). ========================== ``` ### 2.1.1 ``` ========================== *August 31, 2018* Django 2.1.1 fixes several bugs in 2.1. Bugfixes ======== * Fixed a race condition in ``QuerySet.update_or_create()`` that could result in data loss (:ticket:`29499`). * Fixed a regression where ``QueryDict.urlencode()`` crashed if the dictionary contains a non-string value (:ticket:`29627`). * Fixed a regression in Django 2.0 where using ``manage.py test --keepdb`` fails on PostgreSQL if the database exists and the user doesn't have permission to create databases (:ticket:`29613`). * Fixed a regression in Django 2.0 where combining ``Q`` objects with ``__in`` lookups and lists crashed (:ticket:`29643`). * Fixed translation failure of ``DurationField``'s "overflow" error message (:ticket:`29623`). * Fixed a regression where the admin change form crashed if the user doesn't have the 'add' permission to a model that uses ``TabularInline`` (:ticket:`29637`). * Fixed a regression where a ``related_query_name`` reverse accessor wasn't set up when a ``GenericRelation`` is declared on an abstract base model (:ticket:`29653`). * Fixed the test client's JSON serialization of a request data dictionary for structured content type suffixes (:ticket:`29662`). * Made the admin change view redirect to the changelist view after a POST if the user has the 'view' permission (:ticket:`29663`). * Fixed admin change view crash for view-only users if the form has an extra form field (:ticket:`29682`). * Fixed a regression in Django 2.0.5 where ``QuerySet.values()`` or ``values_list()`` after combining querysets with ``extra()`` with ``union()``, ``difference()``, or ``intersection()`` crashed due to mismatching columns (:ticket:`29694`). * Fixed crash if ``InlineModelAdmin.has_add_permission()`` doesn't accept the ``obj`` argument (:ticket:`29723`). ======================== ``` ### 2.1 ``` ======================== *August 1, 2018* Welcome to Django 2.1! These release notes cover the :ref:`new features <whats-new-2.1>`, as well as some :ref:`backwards incompatible changes <backwards-incompatible-2.1>` you'll want to be aware of when upgrading from Django 2.0 or earlier. We've :ref:`dropped some features<removed-features-2.1>` that have reached the end of their deprecation cycle, and we've :ref:`begun the deprecation process for some features <deprecated-features-2.1>`. See the :doc:`/howto/upgrade-version` guide if you're updating an existing project. Python compatibility ==================== Django 2.1 supports Python 3.5, 3.6, and 3.7. Django 2.0 is the last version to support Python 3.4. We **highly recommend** and only officially support the latest release of each series. .. _whats-new-2.1: What's new in Django 2.1 ======================== Model "view" permission ----------------------- A "view" permission is added to the model :attr:`Meta.default_permissions <django.db.models.Options.default_permissions>`. The new permissions will be created automatically when running :djadmin:`migrate`. This allows giving users read-only access to models in the admin. :meth:`.ModelAdmin.has_view_permission` is new. The implementation is backwards compatible in that there isn't a need to assign the "view" permission to allow users who have the "change" permission to edit objects. There are a couple of :ref:`backwards incompatible considerations <view_permission_backwards_incompatible>`. Minor features -------------- :mod:`django.contrib.admin` ~~~~~~~~~~~~~~~~~~~~~~~~~~~ * :attr:`.ModelAdmin.search_fields` now accepts any lookup such as ``field__exact``. * jQuery is upgraded from version 2.2.3 to 3.3.1. * The new :meth:`.ModelAdmin.delete_queryset` method allows customizing the deletion process of the "delete selected objects" action. * You can now :ref:`override the default admin site <overriding-default-admin-site>`. * The new :attr:`.ModelAdmin.sortable_by` attribute and :meth:`.ModelAdmin.get_sortable_by` method allow limiting the columns that can be sorted in the change list page. * The ``admin_order_field`` attribute for elements in :attr:`.ModelAdmin.list_display` may now be a query expression. * The new :meth:`.ModelAdmin.get_deleted_objects()` method allows customizing the deletion process of the delete view and the "delete selected" action. * The ``actions.html``, ``change_list_results.html``, ``date_hierarchy.html``, ``pagination.html``, ``prepopulated_fields_js.html``, ``search_form.html``, and ``submit_line.html`` templates can now be :ref:`overridden per app or per model <admin-templates-overridden-per-app-or-model>` (besides overridden globally). * The admin change list and change form object tools can now be :ref:`overridden per app, per model, or globally <admin-templates-overridden-per-app-or-model>` with ``change_list_object_tools.html`` and ``change_form_object_tools.html`` templates. * :meth:`.InlineModelAdmin.has_add_permission` is now passed the parent object as the second positional argument, ``obj``. * Admin actions may now :ref:`specify permissions <admin-action-permissions>` to limit their availability to certain users. :mod:`django.contrib.auth` ~~~~~~~~~~~~~~~~~~~~~~~~~~ * :djadmin:`createsuperuser` now gives a prompt to allow bypassing the :setting:`AUTH_PASSWORD_VALIDATORS` checks. :mod:`django.contrib.gis` ~~~~~~~~~~~~~~~~~~~~~~~~~ * The new :meth:`.GEOSGeometry.buffer_with_style` method is a version of :meth:`~.GEOSGeometry.buffer` that allows customizing the style of the buffer. * :class:`~django.contrib.gis.forms.widgets.OpenLayersWidget` is now based on OpenLayers 4.6.5 (previously 3.20.1). :mod:`django.contrib.sessions` ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ * Added the :setting:`SESSION_COOKIE_SAMESITE` setting to set the ``SameSite`` cookie flag on session cookies. Cache ~~~~~ * The :ref:`local-memory cache backend <local-memory-caching>` now uses a least-recently-used (LRU) culling strategy rather than a pseudo-random one. * The new :meth:`~django.core.caches.cache.touch` method of the :ref:`low-level cache API <low-level-cache-api>` updates the timeout of cache keys. CSRF ~~~~ * Added the :setting:`CSRF_COOKIE_SAMESITE` setting to set the ``SameSite`` cookie flag on CSRF cookies. Forms ~~~~~ * The widget for ``ImageField`` now renders with the HTML attribute ``accept="image/*"``. Internationalization ~~~~~~~~~~~~~~~~~~~~ * Added the :meth:`~django.utils.translation.get_supported_language_variant` function. * Untranslated strings for territorial language variants now use the translations of the generic language. For example, untranslated ``pt_BR`` strings use ``pt`` translations. Management Commands ~~~~~~~~~~~~~~~~~~~ * The new :option:`inspectdb --include-views` option allows creating models for database views. * The :class:`~django.core.management.BaseCommand` class now uses a custom help formatter so that the standard options like ``--verbosity`` or ``--settings`` appear last in the help output, giving a more prominent position to subclassed command's options. Migrations ~~~~~~~~~~ * Added support for serialization of ``functools.partialmethod`` objects. * To support frozen environments, migrations may be loaded from ``.pyc`` files. Models ~~~~~~ * Models can now use ``__init_subclass__()`` from :pep:`487`. * A ``BinaryField`` may now be set to ``editable=True`` if you wish to include it in model forms. * A number of new text database functions are added: :class:`~django.db.models.functions.Chr`, :class:`~django.db.models.functions.Left`, :class:`~django.db.models.functions.LPad`, :class:`~django.db.models.functions.LTrim`, :class:`~django.db.models.functions.Ord`, :class:`~django.db.models.functions.Repeat`, :class:`~django.db.models.functions.Replace`, :class:`~django.db.models.functions.Right`, :class:`~django.db.models.functions.RPad`, :class:`~django.db.models.functions.RTrim`, and :class:`~django.db.models.functions.Trim`. * The new :class:`~django.db.models.functions.TruncWeek` function truncates :class:`~django.db.models.DateField` and :class:`~django.db.models.DateTimeField` to the Monday of a week. * Query expressions can now be negated using a minus sign. * :meth:`.QuerySet.order_by` and :meth:`distinct(*fields) <.QuerySet.distinct>` now support using field transforms. * :class:`~django.db.models.BooleanField` can now be ``null=True``. This is encouraged instead of :class:`~django.db.models.NullBooleanField`, which will likely be deprecated in the future. * The new :meth:`.QuerySet.explain` method displays the database's execution plan of a queryset's query. * :meth:`.QuerySet.raw` now supports :meth:`~.QuerySet.prefetch_related`. Requests and Responses ~~~~~~~~~~~~~~~~~~~~~~ * Added :meth:`.HttpRequest.get_full_path_info`. * Added the ``samesite`` argument to :meth:`.HttpResponse.set_cookie` to allow setting the ``SameSite`` cookie flag. * The new ``as_attachment`` argument for :class:`~django.http.FileResponse` sets the ``Content-Disposition`` header to make the browser ask if the user wants to download the file. ``FileResponse`` also tries to set the ``Content-Type`` and ``Content-Length`` headers where appropriate. Templates ~~~~~~~~~ * The new :tfilter:`json_script` filter safely outputs a Python object as JSON, wrapped in a ``<script>`` tag, ready for use with JavaScript. Tests ~~~~~ * Added test :class:`~django.test.Client` support for 307 and 308 redirects. * The test :class:`~django.test.Client` now serializes a request data dictionary as JSON if ``content_type='application/json'``. You can customize the JSON encoder with test client's ``json_encoder`` parameter. * The new :meth:`.SimpleTestCase.assertWarnsMessage` method is a simpler version of :meth:`~unittest.TestCase.assertWarnsRegex`. .. _backwards-incompatible-2.1: Backwards incompatible changes in 2.1 ===================================== Database backend API -------------------- This section describes changes that may be needed in third-party database backends. * To adhere to :pep:`249`, exceptions where a database doesn't support a feature are changed from :exc:`NotImplementedError` to :exc:`django.db.NotSupportedError`. * Renamed the ``allow_sliced_subqueries`` database feature flag to ``allow_sliced_subqueries_with_in``. * ``DatabaseOperations.distinct_sql()`` now requires an additional ``params`` argument and returns a tuple of SQL and parameters instead of a SQL string. * ``DatabaseFeatures.introspected_boolean_field_type`` is changed from a method to a property. :mod:`django.contrib.gis` ------------------------- * Support for SpatiaLite 4.0 is removed. Dropped support for MySQL 5.5 ----------------------------- The end of upstream support for MySQL 5.5 is December 2018. Django 2.1 supports MySQL 5.6 and higher. Dropped support for PostgreSQL 9.3 ---------------------------------- The end of upstream support for PostgreSQL 9.3 is September 2018. Django 2.1 supports PostgreSQL 9.4 and higher. Removed ``BCryptPasswordHasher`` from the default ``PASSWORD_HASHERS`` setting ------------------------------------------------------------------------------ If you used bcrypt with Django 1.4 or 1.5 (before ``BCryptSHA256PasswordHasher`` was added in Django 1.6), you might have some passwords that use the ``BCryptPasswordHasher`` hasher. You can check if that's the case like this:: from django.contrib.auth import get_user_model User = get_user_model() User.objects.filter(password__startswith='bcrypt$$') If you want to continue to allow those passwords to be used, you'll have to define the :setting:`PASSWORD_HASHERS` setting (if you don't already) and include ``'django.contrib.auth.hashers.BCryptPasswordHasher'``. Moved ``wrap_label`` widget template context variable ----------------------------------------------------- To fix the lack of ``<label>`` when using ``RadioSelect`` and ``CheckboxSelectMultiple`` with ``MultiWidget``, the ``wrap_label`` context variable now appears as an attribute of each option. For example, in a custom ``input_option.html`` template, change ``{% if wrap_label %}`` to ``{% if widget.wrap_label %}``. ``SameSite`` cookies -------------------- The cookies used for ``django.contrib.sessions``, ``django.contrib.messages``, and Django's CSRF protection now set the ``SameSite`` flag to ``Lax`` by default. Browsers that respect this flag won't send these cookies on cross-origin requests. If you rely on the old behavior, set the :setting:`SESSION_COOKIE_SAMESITE` and/or :setting:`CSRF_COOKIE_SAMESITE` setting to ``None``. .. _view_permission_backwards_incompatible: Considerations for the new model "view" permission -------------------------------------------------- Custom admin forms need to take the view-only case into account ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ With the new "view" permission, existing custom admin forms may raise errors when a user doesn't have the change permission because the form might access nonexistent fields. Fix this by overriding :meth:`.ModelAdmin.get_form` and checking if the user has the "change" permissions and returning the default form if not:: class MyAdmin(admin.ModelAdmin): def get_form(self, request, obj=None, **kwargs): if not self.has_change_permission(request, obj): return super().get_form(request, obj, **kwargs) return CustomForm New default view permission could allow unwanted access to admin views ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ If you have a custom permission with a codename of the form ``view_<modelname>``, the new view permission handling in the admin will allow view access to the changelist and detail pages for those models. If this is unwanted, you must change your custom permission codename. Miscellaneous ------------- * The minimum supported version of ``mysqlclient`` is increased from 1.3.3 to 1.3.7. * Support for SQLite < 3.7.15 is removed. * The date format of ``Set-Cookie``'s ``Expires`` directive is changed to follow :rfc:`7231section-7.1.1.1` instead of Netscape's cookie standard. Hyphens present in dates like ``Tue, 25-Dec-2018 22:26:13 GMT`` are removed. This change should be merely cosmetic except perhaps for antiquated browsers that don't parse the new format. * ``allowed_hosts`` is now a required argument of private API ``django.utils.http.is_safe_url()``. * The ``multiple`` attribute rendered by the :class:`~django.forms.SelectMultiple` widget now uses HTML5 boolean syntax rather than XHTML's ``multiple="multiple"``. * HTML rendered by form widgets no longer includes a closing slash on void elements, e.g. ``<br>``. This is incompatible within XHTML, although some widgets already used aspects of HTML5 such as boolean attributes. * The value of :class:`~django.forms.SelectDateWidget`'s empty options is changed from 0 to an empty string, which mainly may require some adjustments in tests that compare HTML. * :meth:`.User.has_usable_password` and the :func:`~django.contrib.auth.hashers.is_password_usable` function no longer return ``False`` if the password is ``None`` or an empty string, or if the password uses a hasher that's not in the :setting:`PASSWORD_HASHERS` setting. This undocumented behavior was a regression in Django 1.6 and prevented users with such passwords from requesting a password reset. Audit your code to confirm that your usage of these APIs don't rely on the old behavior. * Since migrations are now loaded from ``.pyc`` files, you might need to delete them if you're working in a mixed Python 2 and Python 3 environment. * Using ``None`` as a :class:`~django.contrib.postgres.fields.JSONField` lookup value now matches objects that have the specified key and a null value rather than objects that don't have the key. * The admin CSS class ``field-box`` is renamed to ``fieldBox`` to prevent conflicts with the class given to model fields named "box". * Since the admin's ``actions.html``, ``change_list_results.html``, ``date_hierarchy.html``, ``pagination.html``, ``prepopulated_fields_js.html``, ``search_form.html``, and ``submit_line.html`` templates can now be overridden per app or per model, you may need to rename existing templates with those names that were written for a different purpose. * ``QuerySet.raw()`` now caches its results like regular querysets. Use ``iterator()`` if you don't want caching. * The database router :meth:`allow_relation` method is called in more cases. Improperly written routers may need to be updated accordingly. * Translations are no longer deactivated before running management commands. If your custom command requires translations to be deactivated (for example, to insert untranslated content into the database), use the new :ref:`no_translations decorator <management-commands-and-locales>`. * Management commands no longer allow the abbreviated forms of the ``--settings`` and ``--pythonpath`` arguments. * The private ``django.db.models.sql.constants.QUERY_TERMS`` constant is removed. The :meth:`~.RegisterLookupMixin.get_lookup` and :meth:`~.RegisterLookupMixin.get_lookups` methods of the :ref:`Lookup Registration API <lookup-registration-api>` may be suitable alternatives. Compared to the ``QUERY_TERMS`` constant, they allow your code to also account for any custom lookups that have been registered. * Compatibility with ``py-bcrypt`` is removed as it's unmaintained. Use `bcrypt <https://pypi.org/project/bcrypt/>`_ instead. .. _deprecated-features-2.1: Features deprecated in 2.1 ========================== Miscellaneous ------------- * The ``ForceRHR`` GIS function is deprecated in favor of the new :class:`~django.contrib.gis.db.models.functions.ForcePolygonCW` function. * ``django.utils.http.cookie_date()`` is deprecated in favor of :func:`~django.utils.http.http_date`, which follows the format of the latest RFC. * ``{% load staticfiles %}`` and ``{% load admin_static %}`` are deprecated in favor of ``{% load static %}``, which works the same. * ``django.contrib.staticfiles.templatetags.static()`` is deprecated in favor of ``django.templatetags.static.static()``. * Support for :meth:`.InlineModelAdmin.has_add_permission` methods that don't accept ``obj`` as the second positional argument will be removed in Django 3.0. .. _removed-features-2.1: Features removed in 2.1 ======================= These features have reached the end of their deprecation cycle and are removed in Django 2.1. See :ref:`deprecated-features-1.11` for details, including how to remove usage of these features. * ``contrib.auth.views.login()``, ``logout()``, ``password_change()``, ``password_change_done()``, ``password_reset()``, ``password_reset_done()``, ``password_reset_confirm()``, and ``password_reset_complete()`` are removed. * The ``extra_context`` parameter of ``contrib.auth.views.logout_then_login()`` is removed. * ``django.test.runner.setup_databases()`` is removed. * ``django.utils.translation.string_concat()`` is removed. * ``django.core.cache.backends.memcached.PyLibMCCache`` no longer supports passing ``pylibmc`` behavior settings as top-level attributes of ``OPTIONS``. * The ``host`` parameter of ``django.utils.http.is_safe_url()`` is removed. * Silencing of exceptions raised while rendering the ``{% include %}`` template tag is removed. * ``DatabaseIntrospection.get_indexes()`` is removed. * The ``authenticate()`` method of authentication backends requires ``request`` as the first positional argument. * The ``django.db.models.permalink()`` decorator is removed. * The ``USE_ETAGS`` setting is removed. ``CommonMiddleware`` and ``django.utils.cache.patch_response_headers()`` no longer set ETags. * The ``Model._meta.has_auto_field`` attribute is removed. * ``url()``'s support for inline flags in regular expression groups (``(?i)``, ``(?L)``, ``(?m)``, ``(?s)``, and ``(?u)``) is removed. * Support for ``Widget.render()`` methods without the ``renderer`` argument is removed. =========================== ``` ### 2.0.13 ``` =========================== *February 12, 2019* Django 2.0.13 fixes a regression in 2.0.12/2.0.11. Bugfixes ======== * Fixed crash in ``django.utils.numberformat.format_number()`` when the number has over 200 digits (:ticket:`30177`). =========================== ``` ### 2.0.12 ``` =========================== *February 11, 2019* Django 2.0.12 fixes a packaging error in 2.0.11. Bugfixes ======== * Corrected packaging error from 2.0.11 (:ticket:`30175`). =========================== ``` ### 2.0.10 ``` =========================== *January 4, 2019* Django 2.0.10 fixes a security issue and several bugs in 2.0.9. CVE-2019-3498: Content spoofing possibility in the default 404 page ------------------------------------------------------------------- An attacker could craft a malicious URL that could make spoofed content appear on the default page generated by the ``django.views.defaults.page_not_found()`` view. The URL path is no longer displayed in the default 404 template and the ``request_path`` context variable is now quoted to fix the issue for custom templates that use the path. Bugfixes ======== * Prevented repetitive calls to ``geos_version_tuple()`` in the ``WKBWriter`` class in an attempt to fix a random crash involving ``LooseVersion`` since Django 2.0.6 (:ticket:`29959`). * Fixed a schema corruption issue on SQLite 3.26+. You might have to drop and rebuild your SQLite database if you applied a migration while using an older version of Django with SQLite 3.26 or later (:ticket:`29182`). * Prevented SQLite schema alterations while foreign key checks are enabled to avoid the possibility of schema corruption (:ticket:`30023`). ========================== ``` ### 2.0.9 ``` ========================== *October 1, 2018* Django 2.0.9 fixes a data loss bug in 2.0.8. Bugfixes ======== * Fixed a race condition in ``QuerySet.update_or_create()`` that could result in data loss (:ticket:`29499`). ========================== ``` ### 2.0.8 ``` ========================== *August 1, 2018* Django 2.0.8 fixes a security issue and several bugs in 2.0.7. CVE-2018-14574: Open redirect possibility in ``CommonMiddleware`` ================================================================= If the :class:`~django.middleware.common.CommonMiddleware` and the :setting:`APPEND_SLASH` setting are both enabled, and if the project has a URL pattern that accepts any path ending in a slash (many content management systems have such a pattern), then a request to a maliciously crafted URL of that site could lead to a redirect to another site, enabling phishing and other attacks. ``CommonMiddleware`` now escapes leading slashes to prevent redirects to other domains. Bugfixes ======== * Fixed a regression in Django 2.0.7 that broke the ``regex`` lookup on MariaDB (even though MariaDB isn't officially supported) (:ticket:`29544`). * Fixed a regression where ``django.template.Template`` crashed if the ``template_string`` argument is lazy (:ticket:`29617`). ========================== ``` ### 2.0.7 ``` ========================== *July 2, 2018* Django 2.0.7 fixes several bugs in 2.0.6. Bugfixes ======== * Fixed admin changelist crash when using a query expression without ``asc()`` or ``desc()`` in the page's ordering (:ticket:`29428`). * Fixed admin check crash when using a query expression in ``ModelAdmin.ordering`` (:ticket:`29428`). * Fixed ``__regex`` and ``__iregex`` lookups with MySQL 8 (:ticket:`29451`). * Fixed migrations crash with namespace packages on Python 3.7 (:ticket:`28814`). ========================== ``` ### 2.0.6 ``` ========================== *June 1, 2018* Django 2.0.6 fixes several bugs in 2.0.5. Bugfixes ======== * Fixed a regression that broke custom template filters that use decorators (:ticket:`29400`). * Fixed detection of custom URL converters in included patterns (:ticket:`29415`). * Fixed a regression that added an unnecessary subquery to the ``GROUP BY`` clause on MySQL when using a ``RawSQL`` annotation (:ticket:`29416`). * Fixed ``WKBWriter.write()`` and ``write_hex()`` for empty polygons on GEOS 3.6.1+ (:ticket:`29460`). * Fixed a regression in Django 1.10 that could result in large memory usage when making edits using ``ModelAdmin.list_editable`` (:ticket:`28462`). ========================== ``` ### 2.0.5 ``` ========================== *May 1, 2018* Django 2.0.5 fixes several bugs in 2.0.4. Bugfixes ======== * Corrected the import paths that ``inspectdb`` generates for ``django.contrib.postgres`` fields (:ticket:`29307`). * Fixed a regression in Django 1.11.8 where altering a field with a unique constraint may drop and rebuild more foreign keys than necessary (:ticket:`29193`). * Fixed crashes in ``django.contrib.admindocs`` when a view is a callable object, such as ``django.contrib.syndication.views.Feed`` (:ticket:`29296`). * Fixed a regression in Django 2.0.4 where ``QuerySet.values()`` or ``values_list()`` after combining an annotated and unannotated queryset with ``union()``, ``difference()``, or ``intersection()`` crashed due to mismatching columns (:ticket:`29286`). ========================== ``` ### 2.0.4 ``` ========================== *April 2, 2018* Django 2.0.4 fixes several bugs in 2.0.3. Bugfixes ======== * Fixed a crash when filtering with an ``Exists()`` annotation of a queryset containing a single field (:ticket:`29195`). * Fixed admin autocomplete widget's translations for `zh-hans` and `zh-hant` languages (:ticket:`29213`). * Corrected admin's autocomplete widget to add a space after custom classes (:ticket:`29221`). * Fixed ``PasswordResetConfirmView`` crash when using a user model with a ``UUIDField`` primary key and the reset URL contains an encoded primary key value that decodes to an invalid UUID (:ticket:`29206`). * Fixed a regression in Django 1.11.8 where combining two annotated ``values_list()`` querysets with ``union()``, ``difference()``, or ``intersection()`` crashed due to mismatching columns (:ticket:`29229`). * Fixed a regression in Django 1.11 where an empty choice could be initially selected for the ``SelectMultiple`` and ``CheckboxSelectMultiple`` widgets (:ticket:`29273`). * Fixed a regression in Django 2.0 where ``OpenLayersWidget`` deserialization ignored the widget map's SRID and assumed 4326 (WGS84) (:ticket:`29116`). ========================== ``` ### 2.0.3 ``` ========================== *March 6, 2018* Django 2.0.3 fixes two security issues and several bugs in 2.0.2. Also, the latest string translations from Transifex are incorporated. CVE-2018-7536: Denial-of-service possibility in ``urlize`` and ``urlizetrunc`` template filters =============================================================================================== The ``django.utils.html.urlize()`` function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions. The ``urlize()`` function is used to implement the ``urlize`` and ``urlizetrunc`` template filters, which were thus vulnerable. The problematic regular expressions are replaced with parsing logic that behaves similarly. CVE-2018-7537: Denial-of-service possibility in ``truncatechars_html`` and ``truncatewords_html`` template filters ================================================================================================================== If ``django.utils.text.Truncator``'s ``chars()`` and ``words()`` methods were passed the ``html=True`` argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The ``chars()`` and ``words()`` methods are used to implement the ``truncatechars_html`` and ``truncatewords_html`` template filters, which were thus vulnerable. The backtracking problem in the regular expression is fixed. Bugfixes ======== * Fixed a regression that caused sliced ``QuerySet.distinct().order_by()`` followed by ``count()`` to crash (:ticket:`29108`). * Prioritized the datetime and time input formats without ``%f`` for the Thai locale to fix the admin time picker widget displaying "undefined" (:ticket:`29109`). * Fixed crash with ``QuerySet.order_by(Exists(...))`` (:ticket:`29118`). * Made ``Q.deconstruct()`` deterministic with multiple keyword arguments (:ticket:`29125`). You may need to modify ``Q``'s in existing migrations, or accept an autogenerated migration. * Fixed a regression where a ``When()`` expression with a list argument crashes (:ticket:`29166`). * Fixed crash when using a ``Window()`` expression in a subquery (:ticket:`29172`). * Fixed ``AbstractBaseUser.normalize_username()`` crash if the ``username`` argument isn't a string (:ticket:`29176`). ========================== ``` ### 2.0.2 ``` ========================== *February 1, 2018* Django 2.0.2 fixes a security issue and several bugs in 2.0.1. CVE-2018-6188: Information leakage in ``AuthenticationForm`` ============================================================ A regression in Django 1.11.8 made :class:`~django.contrib.auth.forms.AuthenticationForm` run its ``confirm_login_allowed()`` method even if an incorrect password is entered. This can leak information about a user, depending on what messages ``confirm_login_allowed()`` raises. If ``confirm_login_allowed()`` isn't overridden, an attacker enter an arbitrary username and see if that user has been set to ``is_active=False``. If ``confirm_login_allowed()`` is overridden, more sensitive details could be leaked. This issue is fixed with the caveat that ``AuthenticationForm`` can no longer raise the "This account is inactive." error if the authentication backend rejects inactive users (the default authentication backend, ``ModelBackend``, has done that since Django 1.10). This issue will be revisited for Django 2.1 as a fix to address the caveat will likely be too invasive for inclusion in older versions. Bugfixes ======== * Fixed hidden content at the bottom of the "The install worked successfully!" page for some languages (:ticket:`28885`). * Fixed incorrect foreign key nullification if a model has two foreign keys to the same model and a target model is deleted (:ticket:`29016`). * Fixed regression in the use of ``QuerySet.values_list(..., flat=True)`` followed by ``annotate()`` (:ticket:`29067`). * Fixed a regression where a queryset that annotates with geometry objects crashes (:ticket:`29054`). * Fixed a regression where ``contrib.auth.authenticate()`` crashes if an authentication backend doesn't accept ``request`` and a later one does (:ticket:`29071`). * Fixed a r
pyup-bot commented 5 years ago

Closing this in favor of #83