2022-03-01 08:58:35 +00:00
|
|
|
==========================
|
|
|
|
|
Django 4.0.4 release notes
|
|
|
|
|
==========================
|
|
|
|
|
|
2022-04-01 06:37:19 +00:00
|
|
|
*April 11, 2022*
|
2022-03-01 08:58:35 +00:00
|
|
|
|
2022-04-09 09:36:26 +00:00
|
|
|
Django 4.0.4 fixes two security issues with severity "high" and two bugs in
|
|
|
|
|
4.0.3.
|
2022-03-01 08:58:35 +00:00
|
|
|
|
2022-04-01 06:10:22 +00:00
|
|
|
CVE-2022-28346: Potential SQL injection in ``QuerySet.annotate()``, ``aggregate()``, and ``extra()``
|
|
|
|
|
====================================================================================================
|
|
|
|
|
|
|
|
|
|
:meth:`.QuerySet.annotate`, :meth:`~.QuerySet.aggregate`, and
|
|
|
|
|
:meth:`~.QuerySet.extra` methods were subject to SQL injection in column
|
|
|
|
|
aliases, using a suitably crafted dictionary, with dictionary expansion, as the
|
|
|
|
|
``**kwargs`` passed to these methods.
|
|
|
|
|
|
2022-04-01 11:48:47 +00:00
|
|
|
CVE-2022-28347: Potential SQL injection via ``QuerySet.explain(**options)`` on PostgreSQL
|
|
|
|
|
=========================================================================================
|
|
|
|
|
|
|
|
|
|
:meth:`.QuerySet.explain` method was subject to SQL injection in option names,
|
|
|
|
|
using a suitably crafted dictionary, with dictionary expansion, as the
|
|
|
|
|
``**options`` argument.
|
|
|
|
|
|
2022-03-01 08:58:35 +00:00
|
|
|
Bugfixes
|
|
|
|
|
========
|
|
|
|
|
|
2022-03-30 05:31:56 +00:00
|
|
|
* Fixed a regression in Django 4.0 that caused ignoring multiple
|
|
|
|
|
``FilteredRelation()`` relationships to the same field (:ticket:`33598`).
|
2022-04-09 09:36:26 +00:00
|
|
|
|
|
|
|
|
* Fixed a regression in Django 3.2.4 that caused the auto-reloader to no longer
|
|
|
|
|
detect changes when the ``DIRS`` option of the ``TEMPLATES`` setting
|
|
|
|
|
contained an empty string (:ticket:`33628`).
|
