==========================

Django 2.2.2 release notes

==========================

*June 3, 2019*

Django 2.2.2 fixes security issues and several bugs in 2.2.1.

CVE-2019-12308: AdminURLFieldWidget XSS

---------------------------------------

The clickable "Current URL" link generated by ``AdminURLFieldWidget`` displayed

the provided value without validating it as a safe URL. Thus, an unvalidated

value stored in the database, or a value provided as a URL query parameter

payload, could result in an clickable JavaScript link.

``AdminURLFieldWidget`` now validates the provided value using

:class:`~django.core.validators.URLValidator` before displaying the clickable

link. You may customize the validator by passing a ``validator_class`` kwarg to

``AdminURLFieldWidget.__init__()``, e.g. when using

:attr:`~django.contrib.admin.ModelAdmin.formfield_overrides`.

Patched bundled jQuery for CVE-2019-11358: Prototype pollution

--------------------------------------------------------------

jQuery before 3.4.0, mishandles ``jQuery.extend(true, {}, ...)`` because of

``Object.prototype`` pollution. If an unsanitized source object contained an

enumerable ``__proto__`` property, it could extend the native

``Object.prototype``.

The bundled version of jQuery used by the Django admin has been patched to

allow for the ``select2`` library's use of ``jQuery.extend()``.

Bugfixes

========

* Fixed a regression in Django 2.2 that stopped Show/Hide toggles working on

  dynamically added admin inlines (:ticket:`30459`).

* Fixed a regression in Django 2.2 where deprecation message crashes if

  ``Meta.ordering`` contains an expression (:ticket:`30463`).

* Fixed a regression in Django 2.2.1 where

  :class:`~django.contrib.postgres.search.SearchVector` generates SQL with a

  redundant ``Coalesce`` call (:ticket:`30488`).

* Fixed a regression in Django 2.2 where auto-reloader doesn't detect changes

  in ``manage.py`` file when using ``StatReloader`` (:ticket:`30479`).

* Fixed crash of :class:`~django.contrib.postgres.aggregates.ArrayAgg` and

  :class:`~django.contrib.postgres.aggregates.StringAgg` with ``ordering``

  argument when used in a ``Subquery`` (:ticket:`30315`).

* Fixed a regression in Django 2.2 that caused a crash of auto-reloader when

  an exception with custom signature is raised (:ticket:`30516`).

* Fixed a regression in Django 2.2.1 where auto-reloader unnecessarily reloads

  translation files multiple times when using ``StatReloader``

  (:ticket:`30523`).