2021-05-13 15:42:26 +08:00
|
|
|
==========================
|
|
|
|
|
Django 3.2.4 release notes
|
|
|
|
|
==========================
|
|
|
|
|
|
2021-06-02 16:19:19 +08:00
|
|
|
*June 2, 2021*
|
2021-05-13 15:42:26 +08:00
|
|
|
|
2021-05-25 16:38:20 +08:00
|
|
|
Django 3.2.4 fixes two security issues and several bugs in 3.2.3.
|
2021-05-13 15:42:26 +08:00
|
|
|
|
2021-05-17 17:26:36 +08:00
|
|
|
CVE-2021-33203: Potential directory traversal via ``admindocs``
|
|
|
|
|
===============================================================
|
|
|
|
|
|
|
|
|
|
Staff members could use the :mod:`~django.contrib.admindocs`
|
|
|
|
|
``TemplateDetailView`` view to check the existence of arbitrary files.
|
|
|
|
|
Additionally, if (and only if) the default admindocs templates have been
|
|
|
|
|
customized by the developers to also expose the file contents, then not only
|
|
|
|
|
the existence but also the file contents would have been exposed.
|
|
|
|
|
|
|
|
|
|
As a mitigation, path sanitation is now applied and only files within the
|
|
|
|
|
template root directories can be loaded.
|
|
|
|
|
|
2021-05-13 15:42:26 +08:00
|
|
|
Bugfixes
|
|
|
|
|
========
|
|
|
|
|
|
2021-05-17 19:21:50 +08:00
|
|
|
* Fixed a bug in Django 3.2 where a final catch-all view in the admin didn't
|
|
|
|
|
respect the server-provided value of ``SCRIPT_NAME`` when redirecting
|
|
|
|
|
unauthenticated users to the login page (:ticket:`32754`).
|
2021-05-11 04:19:29 +08:00
|
|
|
|
|
|
|
|
* Fixed a bug in Django 3.2 where a system check would crash on an abstract
|
|
|
|
|
model (:ticket:`32733`).
|
2021-05-14 17:53:17 +08:00
|
|
|
|
|
|
|
|
* Prevented unnecessary initialization of unused caches following a regression
|
|
|
|
|
in Django 3.2 (:ticket:`32747`).
|
2021-05-12 21:22:34 +08:00
|
|
|
|
|
|
|
|
* Fixed a crash in Django 3.2 that could occur when running ``mod_wsgi`` with
|
|
|
|
|
the recommended settings while the Windows ``colorama`` library was installed
|
|
|
|
|
(:ticket:`32740`).
|
2021-06-02 16:19:19 +08:00
|
|
|
|
2021-05-18 03:53:21 +08:00
|
|
|
* Fixed a bug in Django 3.2 that would trigger the auto-reloader for template
|
|
|
|
|
changes when directory paths were specified with strings (:ticket:`32744`).
|
2021-05-26 17:19:47 +08:00
|
|
|
|
|
|
|
|
* Fixed a regression in Django 3.2 that caused a crash of auto-reloader with
|
|
|
|
|
``AttributeError``, e.g. inside a ``Conda`` environment (:ticket:`32783`).
|
2021-06-01 21:11:42 +08:00
|
|
|
|
|
|
|
|
* Fixed a regression in Django 3.2 that caused a loss of precision for
|
|
|
|
|
operations with ``DecimalField`` on MySQL (:ticket:`32793`).
|
