1. ==========================

  2. Django 1.9.8 release notes

  3. ==========================

  4. 

  5. *July 18, 2016*

  6. 

  7. Django 1.9.8 fixes a security issue and several bugs in 1.9.7.

  8. 

  9. XSS in admin's add/change related popup

  10. =======================================

  11. 

  12. Unsafe usage of JavaScript's ``Element.innerHTML`` could result in XSS in the

  13. admin's add/change related popup. ``Element.textContent`` is now used to

  14. prevent execution of the data.

  15. 

  16. The debug view also used ``innerHTML``. Although a security issue wasn't

  17. identified there, out of an abundance of caution it's also updated to use

  18. ``textContent``.

  19. 

  20. Bugfixes

  21. ========

  22. 

  23. * Fixed missing ``varchar/text_pattern_ops`` index on ``CharField`` and

  24.   ``TextField`` respectively when using ``AddField`` on PostgreSQL

  25.   (:ticket:`26889`).

  26. 

  27. * Fixed ``makemessages`` crash on Python 2 with non-ASCII file names

  28.   (:ticket:`26897`).
About Sign Up Leave Feedback Contact