==========================
Django 1.8.7 release notes
==========================

*Under development*

Django 1.8.7 fixes a security issue and several bugs in 1.8.6.

Additionally, Django's vendored version of six, :mod:`django.utils.six`, has
been upgraded to the latest release (1.10.0).

Fixed settings leak possibility in ``date`` template filter
===========================================================

If an application allows users to specify an unvalidated format for dates and
passes this format to the :tfilter:`date` filter, e.g.
``{{ last_updated|date:user_date_format }}``, then a malicious user could
obtain any secret in the application's settings by specifying a settings key
instead of a date format. e.g. ``"SECRET_KEY"`` instead of ``"j/m/Y"``.

To remedy this, the underlying function used by the ``date`` template filter,
``django.utils.formats.get_format()``, now only allows accessing the date/time
formatting settings.

Bugfixes
========

* Fixed a crash of the debug view during the autumn DST change when
  :setting:`USE_TZ` is ``False`` and ``pytz`` is installed.

* Fixed a regression in 1.8.6 that caused database routers without an
  ``allow_migrate()`` method to crash (:ticket:`25686`).

* Fixed a regression in 1.8.6 by restoring the ability to use ``Manager``
  objects for the ``queryset`` argument of ``ModelChoiceField``
  (:ticket:`25683`).

* Fixed a regression in 1.8.6 that caused an application with South migrations
  in the ``migrations`` directory to fail (:ticket:`25618`).

* Fixed a data loss possibility with :class:`~django.db.models.Prefetch` if
  ``to_attr`` is set to a ``ManyToManyField`` (:ticket:`25693`).

* Fixed a regression in 1.8 by making ``gettext()`` once again return UTF-8
  bytestrings on Python 2 if the input is a bytestring (:ticket:`25720`).

* Fixed serialization of
  :class:`~django.contrib.postgres.fields.DateRangeField` and
  :class:`~django.contrib.postgres.fields.DateTimeRangeField` (:ticket:`24937`).

* Fixed the exact lookup of ``ArrayField`` (:ticket:`25666`).

* Fixed ``Model.refresh_from_db()`` updating of ``ForeignKey`` fields with
  ``on_delete=models.SET_NULL`` (:ticket:`25715`).

* Fixed a duplicate query regression in 1.8 on proxied model deletion
  (:ticket:`25685`).

* Fixed ``set_FOO_order()`` crash when the ``ForeignKey`` of a model with
  ``order_with_respect_to`` references a model with a ``OneToOneField``
  primary key (:ticket:`25786`).

* Fixed incorrect validation for ``PositiveIntegerField`` and
  ``PositiveSmallIntegerField`` on MySQL resulting in values greater than
  4294967295 or 65535, respectively, passing validation and being silently
  truncated by the database (:ticket:`25767`).