mirror of
https://github.com/django/django.git
synced 2024-12-22 17:16:24 +00:00
fb4c55d9ec
Thanks Moataz Al-Sharida and nawaik for reports. Co-authored-by: Shai Berger <shai@platonix.com> Co-authored-by: nessita <124304+nessita@users.noreply.github.com>
77 lines
3.3 KiB
Plaintext
77 lines
3.3 KiB
Plaintext
==========================
|
|
Django 4.2.1 release notes
|
|
==========================
|
|
|
|
*May 3, 2023*
|
|
|
|
Django 4.2.1 fixes a security issue with severity "low" and several bugs in
|
|
4.2.
|
|
|
|
CVE-2023-31047: Potential bypass of validation when uploading multiple files using one form field
|
|
=================================================================================================
|
|
|
|
Uploading multiple files using one form field has never been supported by
|
|
:class:`.forms.FileField` or :class:`.forms.ImageField` as only the last
|
|
uploaded file was validated. Unfortunately, :ref:`uploading_multiple_files`
|
|
topic suggested otherwise.
|
|
|
|
In order to avoid the vulnerability, :class:`~django.forms.ClearableFileInput`
|
|
and :class:`~django.forms.FileInput` form widgets now raise ``ValueError`` when
|
|
the ``multiple`` HTML attribute is set on them. To prevent the exception and
|
|
keep the old behavior, set ``allow_multiple_selected`` to ``True``.
|
|
|
|
For more details on using the new attribute and handling of multiple files
|
|
through a single field, see :ref:`uploading_multiple_files`.
|
|
|
|
Bugfixes
|
|
========
|
|
|
|
* Fixed a regression in Django 4.2 that caused a crash of ``QuerySet.defer()``
|
|
when deferring fields by attribute names (:ticket:`34458`).
|
|
|
|
* Fixed a regression in Django 4.2 that caused a crash of
|
|
:class:`~django.contrib.postgres.search.SearchVector` function with ``%``
|
|
characters (:ticket:`34459`).
|
|
|
|
* Fixed a regression in Django 4.2 that caused aggregation over query that
|
|
uses explicit grouping to group against the wrong columns (:ticket:`34464`).
|
|
|
|
* Reallowed, following a regression in Django 4.2, setting the
|
|
``"cursor_factory"`` option in :setting:`OPTIONS` on PostgreSQL
|
|
(:ticket:`34466`).
|
|
|
|
* Enforced UTF-8 client encoding on PostgreSQL, following a regression in
|
|
Django 4.2 (:ticket:`34470`).
|
|
|
|
* Fixed a regression in Django 4.2 where ``i18n_patterns()`` didn't respect the
|
|
``prefix_default_language`` argument when a fallback language of the default
|
|
language was used (:ticket:`34455`).
|
|
|
|
* Fixed a regression in Django 4.2 where translated URLs of the default
|
|
language from ``i18n_patterns()`` with ``prefix_default_language`` set to
|
|
``False`` raised 404 errors for a request with a different language
|
|
(:ticket:`34515`).
|
|
|
|
* Fixed a regression in Django 4.2 where creating copies and deep copies of
|
|
``HttpRequest``, ``HttpResponse``, and their subclasses didn't always work
|
|
correctly (:ticket:`34482`, :ticket:`34484`).
|
|
|
|
* Fixed a regression in Django 4.2 where ``timesince`` and ``timeuntil``
|
|
template filters returned incorrect results for a datetime with a non-UTC
|
|
timezone when a time difference is less than 1 day (:ticket:`34483`).
|
|
|
|
* Fixed a regression in Django 4.2 that caused a crash of
|
|
:class:`~django.contrib.postgres.search.SearchHeadline` function with
|
|
``psycopg`` 3 (:ticket:`34486`).
|
|
|
|
* Fixed a regression in Django 4.2 that caused incorrect ``ClearableFileInput``
|
|
margins in the admin (:ticket:`34506`).
|
|
|
|
* Fixed a regression in Django 4.2 where breadcrumbs didn't appear on admin
|
|
site app index views (:ticket:`34512`).
|
|
|
|
* Made squashing migrations reduce ``AddIndex``, ``RemoveIndex``,
|
|
``RenameIndex``, and ``CreateModel`` operations which allows removing a
|
|
deprecated ``Meta.index_together`` option from historical migrations and use
|
|
``Meta.indexes`` instead (:ticket:`34525`).
|