2020-02-03 17:23:54 +08:00
|
|
|
==========================
|
|
|
|
|
Django 3.0.4 release notes
|
|
|
|
|
==========================
|
|
|
|
|
|
2020-02-24 21:46:28 +08:00
|
|
|
*March 4, 2020*
|
2020-02-03 17:23:54 +08:00
|
|
|
|
2020-02-24 21:46:28 +08:00
|
|
|
Django 3.0.4 fixes a security issue and several bugs in 3.0.3.
|
|
|
|
|
|
|
|
|
|
CVE-2020-9402: Potential SQL injection via ``tolerance`` parameter in GIS functions and aggregates on Oracle
|
|
|
|
|
============================================================================================================
|
|
|
|
|
|
|
|
|
|
GIS functions and aggregates on Oracle were subject to SQL injection,
|
|
|
|
|
using a suitably crafted ``tolerance``.
|
2020-02-10 15:13:31 +08:00
|
|
|
|
|
|
|
|
Bugfixes
|
|
|
|
|
========
|
|
|
|
|
|
2020-02-07 09:59:20 +08:00
|
|
|
* Fixed a data loss possibility when using caching from async code
|
|
|
|
|
(:ticket:`31253`).
|
2020-02-07 19:55:59 +08:00
|
|
|
|
|
|
|
|
* Fixed a regression in Django 3.0 that caused a file response using a
|
|
|
|
|
temporary file to be closed incorrectly (:ticket:`31240`).
|
2020-02-08 12:52:09 +08:00
|
|
|
|
|
|
|
|
* Fixed a data loss possibility in the
|
|
|
|
|
:meth:`~django.db.models.query.QuerySet.select_for_update`. When using
|
|
|
|
|
related fields or parent link fields with :ref:`multi-table-inheritance` in
|
|
|
|
|
the ``of`` argument, the corresponding models were not locked
|
|
|
|
|
(:ticket:`31246`).
|
2020-02-18 18:45:12 +08:00
|
|
|
|
|
|
|
|
* Fixed a regression in Django 3.0 that caused misplacing parameters in logged
|
|
|
|
|
SQL queries on Oracle (:ticket:`31271`).
|
2020-02-27 13:34:37 +08:00
|
|
|
|
|
|
|
|
* Fixed a regression in Django 3.0.3 that caused misplacing parameters of SQL
|
|
|
|
|
queries when subtracting ``DateField`` or ``DateTimeField`` expressions on
|
|
|
|
|
MySQL (:ticket:`31312`).
|
2020-03-02 20:20:36 +08:00
|
|
|
|
|
|
|
|
* Fixed a regression in Django 3.0 that didn't include subqueries spanning
|
|
|
|
|
multivalued relations in the ``GROUP BY`` clause (:ticket:`31150`).
|
