1. ==========================

  2. Django 2.1.2 release notes

  3. ==========================

  4. 

  5. *October 1, 2018*

  6. 

  7. Django 2.1.2 fixes a security issue and several bugs in 2.1.1. Also, the latest

  8. string translations from Transifex are incorporated.

  9. 

  10. CVE-2018-16984: Password hash disclosure to "view only" admin users

  11. ===================================================================

  12. 

  13. If an admin user has the change permission to the user model, only part of the

  14. password hash is displayed in the change form. Admin users with the view (but

  15. not change) permission to the user model were displayed the entire hash. While

  16. it's typically infeasible to reverse a strong password hash, if your site uses

  17. weaker password hashing algorithms such as MD5 or SHA1, it could be a problem.

  18. 

  19. Bugfixes

  20. ========

  21. 

  22. * Fixed a regression where nonexistent joins in ``F()`` no longer raised

  23.   ``FieldError`` (:ticket:`29727`).

  24. 

  25. * Fixed a regression where files starting with a tilde or underscore weren't

  26.   ignored by the migrations loader (:ticket:`29749`).

  27. 

  28. * Made migrations detect changes to ``Meta.default_related_name``

  29.   (:ticket:`29755`).

  30. 

  31. * Added compatibility for ``cx_Oracle`` 7 (:ticket:`29759`).

  32. 

  33. * Fixed a regression in Django 2.0 where unique index names weren't quoted

  34.   (:ticket:`29778`).

  35. 

  36. * Fixed a regression where sliced queries with multiple columns with the same

  37.   name crashed on Oracle 12.1 (:ticket:`29630`).

  38. 

  39. * Fixed a crash when a user with the view (but not change) permission made a

  40.   POST request to an admin user change form (:ticket:`29809`).
About Sign Up Leave Feedback Contact