1. ==========================

  2. Django 2.1.5 release notes

  3. ==========================

  4. 

  5. *January 4, 2019*

  6. 

  7. Django 2.1.5 fixes a security issue and several bugs in 2.1.4.

  8. 

  9. CVE-2019-3498: Content spoofing possibility in the default 404 page

  10. -------------------------------------------------------------------

  11. 

  12. An attacker could craft a malicious URL that could make spoofed content appear

  13. on the default page generated by the ``django.views.defaults.page_not_found()``

  14. view.

  15. 

  16. The URL path is no longer displayed in the default 404 template and the

  17. ``request_path`` context variable is now quoted to fix the issue for custom

  18. templates that use the path.

  19. 

  20. Bugfixes

  21. ========

  22. 

  23. * Fixed compatibility with mysqlclient 1.3.14 (:ticket:`30013`).

  24. 

  25. * Fixed a schema corruption issue on SQLite 3.26+. You might have to drop and

  26.   rebuild your SQLite database if you applied a migration while using an older

  27.   version of Django with SQLite 3.26 or later (:ticket:`29182`).

  28. 

  29. * Prevented SQLite schema alterations while foreign key checks are enabled to

  30.   avoid the possibility of schema corruption (:ticket:`30023`).

  31. 

  32. * Fixed a regression in Django 2.1.4 (which enabled keep-alive connections)

  33.   where request body data isn't properly consumed for such connections

  34.   (:ticket:`30015`).

  35. 

  36. * Fixed a regression in Django 2.1.4 where

  37.   ``InlineModelAdmin.has_change_permission()`` is incorrectly called with a

  38.   non-``None`` ``obj`` argument during an object add (:ticket:`30050`).
About Sign Up Leave Feedback Contact