django/docs/releases/1.6.6.txt

==========================
Django 1.6.6 release notes
==========================

*Under development*

Django 1.6.6 fixes several security issues and bugs in 1.6.5.

:func:`~django.core.urlresolvers.reverse()` could generate URLs pointing to other hosts
=======================================================================================

In certain situations, URL reversing could generate scheme-relative URLs  (URLs
starting with two slashes), which could unexpectedly redirect a user  to a
different host. An attacker could exploit this, for example, by redirecting
users to a phishing site designed to ask for user's passwords.

To remedy this, URL reversing now ensures that no URL starts with two slashes
(//), replacing the second slash with its URL encoded counterpart (%2F). This
approach ensures that semantics stay the same, while making the URL relative to
the domain and not to the scheme.

Bugfixes
========

* Corrected email and URL validation to reject a trailing dash
  (:ticket:`22579`).

* Prevented indexes on PostgreSQL virtual fields (:ticket:`22514`).

* Prevented edge case where values of FK fields could be initialized with a
  wrong value when an inline model formset is created for a relationship
  defined to point to a field other than the PK (:ticket:`13794`).

* Restored ``pre_delete``  signals for ``GenericRelation`` cascade deletion
  (:ticket:`22998`).

* Fixed transaction handling when specifying non-default database in
  ``createcachetable`` and ``flush`` (:ticket:`23089`).

* Fixed the "ORA-01843: not a valid month" errors when using Unicode
  with older versions of Oracle server (:ticket:`20292`).

* Restored bug fix for sending unicode email with Python 2.6.5 and below
  (:ticket:`19107`).

* Prevented ``UnicodeDecodeError`` in ``runserver`` with non-UTF-8 and
  non-English locale (:ticket:`23265`).

* Fixed JavaScript errors while editing multi-geometry objects in the OpenLayers
  widget (:ticket:`23137`, :ticket:`23293`).

* Prevented a crash on Python 3 with query strings containing unencoded
  non-ASCII characters (:ticket:`22996`).