1. ==========================

  2. Django 2.1.6 release notes

  3. ==========================

  4. 

  5. *February 11, 2019*

  6. 

  7. Django 2.1.6 fixes a security issue and a bug in 2.1.5.

  8. 

  9. CVE-2019-6975: Memory exhaustion in ``django.utils.numberformat.format()``

  10. --------------------------------------------------------------------------

  11. 

  12. If ``django.utils.numberformat.format()`` -- used by ``contrib.admin`` as well

  13. as the ``floatformat``, ``filesizeformat``, and ``intcomma`` templates filters

  14. -- received a ``Decimal`` with a large number of digits or a large exponent, it

  15. could lead to significant memory usage due to a call to ``'{:f}'.format()``.

  16. 

  17. To avoid this, decimals with more than 200 digits are now formatted using

  18. scientific notation.

  19. 

  20. Bugfixes

  21. ========

  22. 

  23. * Made the ``obj`` argument of ``InlineModelAdmin.has_add_permission()``

  24.   optional to restore backwards compatibility with third-party code that

  25.   doesn't provide it (:ticket:`30097`).
About Sign Up Leave Feedback Contact