2016-06-05 07:57:56 +08:00
|
|
|
==========================
|
|
|
|
|
Django 1.9.8 release notes
|
|
|
|
|
==========================
|
|
|
|
|
|
2016-07-07 03:41:06 +08:00
|
|
|
*July 18, 2016*
|
2016-06-05 07:57:56 +08:00
|
|
|
|
2016-07-07 03:41:06 +08:00
|
|
|
Django 1.9.8 fixes a security issue and several bugs in 1.9.7.
|
|
|
|
|
|
|
|
|
|
XSS in admin's add/change related popup
|
|
|
|
|
=======================================
|
|
|
|
|
|
|
|
|
|
Unsafe usage of JavaScript's ``Element.innerHTML`` could result in XSS in the
|
|
|
|
|
admin's add/change related popup. ``Element.textContent`` is now used to
|
|
|
|
|
prevent execution of the data.
|
|
|
|
|
|
|
|
|
|
The debug view also used ``innerHTML``. Although a security issue wasn't
|
|
|
|
|
identified there, out of an abundance of caution it's also updated to use
|
|
|
|
|
``textContent``.
|
2016-06-05 07:57:56 +08:00
|
|
|
|
|
|
|
|
Bugfixes
|
|
|
|
|
========
|
|
|
|
|
|
2016-07-13 08:50:17 +08:00
|
|
|
* Fixed missing ``varchar/text_pattern_ops`` index on ``CharField`` and
|
|
|
|
|
``TextField`` respectively when using ``AddField`` on PostgreSQL
|
|
|
|
|
(:ticket:`26889`).
|
2016-07-15 00:24:40 +08:00
|
|
|
|
|
|
|
|
* Fixed ``makemessages`` crash on Python 2 with non-ASCII file names
|
|
|
|
|
(:ticket:`26897`).
|
