django/docs/releases/1.7.7.txt

36 lines
1.5 KiB
Plaintext

==========================
Django 1.7.7 release notes
==========================
*Under development*
Django 1.7.7 fixes several bugs and security issues in 1.7.6.
Denial-of-service possibility with ``strip_tags()``
===================================================
Last year :func:`~django.utils.html.strip_tags` was changed to work
iteratively. The problem is that the size of the input it's processing can
increase on each iteration which results in an infinite loop in
``strip_tags()``. This issue only affects versions of Python that haven't
received `a bugfix in HTMLParser <http://bugs.python.org/issue20288>`_; namely
Python < 2.7.7 and 3.3.5. Some operating system vendors have also backported
the fix for the Python bug into their packages of earlier versions.
To remedy this issue, ``strip_tags()`` will now return the original input if
it detects the length of the string it's processing increases. Remember that
absolutely NO guarantee is provided about the results of ``strip_tags()`` being
HTML safe. So NEVER mark safe the result of a ``strip_tags()`` call without
escaping it first, for example with :func:`~django.utils.html.escape`.
Bugfixes
========
* Fixed renaming of classes in migrations where renaming a subclass would
cause incorrect state to be recorded for objects that referenced the
superclass (:ticket:`24354`).
* Stopped writing migration files in dry run mode when merging migration
conflicts. When ``makemigrations --merge`` is called with ``verbosity=3`` the
migration file is written to ``stdout`` (:ticket: `24427`).