2022-01-04 18:10:53 +08:00
|
|
|
==========================
|
|
|
|
|
Django 4.0.2 release notes
|
|
|
|
|
==========================
|
|
|
|
|
|
2022-01-11 16:57:01 +08:00
|
|
|
*February 1, 2022*
|
2022-01-04 18:10:53 +08:00
|
|
|
|
2022-01-11 16:57:01 +08:00
|
|
|
Django 4.0.2 fixes two security issues with severity "medium" and several bugs
|
2022-01-30 01:59:17 +08:00
|
|
|
in 4.0.1. Also, the latest string translations from Transifex are incorporated,
|
|
|
|
|
with a special mention for Bulgarian (fully translated).
|
2022-01-04 18:10:53 +08:00
|
|
|
|
2022-01-02 07:37:40 +08:00
|
|
|
CVE-2022-22818: Possible XSS via ``{% debug %}`` template tag
|
|
|
|
|
=============================================================
|
|
|
|
|
|
|
|
|
|
The ``{% debug %}`` template tag didn't properly encode the current context,
|
|
|
|
|
posing an XSS attack vector.
|
|
|
|
|
|
|
|
|
|
In order to avoid this vulnerability, ``{% debug %}`` no longer outputs an
|
|
|
|
|
information when the ``DEBUG`` setting is ``False``, and it ensures all context
|
|
|
|
|
variables are correctly escaped when the ``DEBUG`` setting is ``True``.
|
|
|
|
|
|
2022-01-04 18:10:53 +08:00
|
|
|
Bugfixes
|
|
|
|
|
========
|
|
|
|
|
|
2022-01-05 06:06:46 +08:00
|
|
|
* Fixed a bug in Django 4.0 where ``TestCase.captureOnCommitCallbacks()`` could
|
|
|
|
|
execute callbacks multiple times (:ticket:`33410`).
|
2022-01-07 15:46:55 +08:00
|
|
|
|
|
|
|
|
* Fixed a regression in Django 4.0 where ``help_text`` was HTML-escaped in
|
|
|
|
|
automatically-generated forms (:ticket:`33419`).
|
2022-01-07 20:57:03 +08:00
|
|
|
|
|
|
|
|
* Fixed a regression in Django 4.0 that caused displaying an incorrect name for
|
|
|
|
|
class-based views on the technical 404 debug page (:ticket:`33425`).
|
2022-01-10 21:01:35 +08:00
|
|
|
|
|
|
|
|
* Fixed a regression in Django 4.0 that caused an incorrect ``repr`` of
|
|
|
|
|
``ResolverMatch`` for class-based views (:ticket:`33426`).
|
2022-01-19 23:27:07 +08:00
|
|
|
|
|
|
|
|
* Fixed a regression in Django 4.0 that caused a crash of ``makemigrations`` on
|
|
|
|
|
models without ``Meta.order_with_respect_to`` but with a field named
|
|
|
|
|
``_order`` (:ticket:`33449`).
|
2022-01-19 19:06:38 +08:00
|
|
|
|
|
|
|
|
* Fixed a regression in Django 4.0 that caused incorrect
|
|
|
|
|
:attr:`.ModelAdmin.radio_fields` layout in the admin (:ticket:`33407`).
|
2022-01-28 01:51:39 +08:00
|
|
|
|
|
|
|
|
* Fixed a duplicate operation regression in Django 4.0 that caused a migration
|
|
|
|
|
crash when altering a primary key type for a concrete parent model referenced
|
|
|
|
|
by a foreign key (:ticket:`33462`).
|
2022-01-31 18:33:24 +08:00
|
|
|
|
|
|
|
|
* Fixed a bug in Django 4.0 that caused a crash of ``QuerySet.aggregate()``
|
|
|
|
|
after ``annotate()`` on an aggregate function with a
|
|
|
|
|
:ref:`default <aggregate-default>` (:ticket:`33468`).
|
2022-02-01 03:29:49 +08:00
|
|
|
|
|
|
|
|
* Fixed a regression in Django 4.0 that caused a crash of ``makemigrations``
|
|
|
|
|
when renaming a field of a renamed model (:ticket:`33480`).
|
