mirror of
https://github.com/django/django.git
synced 2025-03-15 11:50:46 +00:00
54 lines
2.0 KiB
Plaintext
54 lines
2.0 KiB
Plaintext
==========================
|
|
Django 1.6.6 release notes
|
|
==========================
|
|
|
|
*Under development*
|
|
|
|
Django 1.6.6 fixes several security issues and bugs in 1.6.5.
|
|
|
|
:func:`~django.core.urlresolvers.reverse()` could generate URLs pointing to other hosts
|
|
=======================================================================================
|
|
|
|
In certain situations, URL reversing could generate scheme-relative URLs (URLs
|
|
starting with two slashes), which could unexpectedly redirect a user to a
|
|
different host. An attacker could exploit this, for example, by redirecting
|
|
users to a phishing site designed to ask for user's passwords.
|
|
|
|
To remedy this, URL reversing now ensures that no URL starts with two slashes
|
|
(//), replacing the second slash with its URL encoded counterpart (%2F). This
|
|
approach ensures that semantics stay the same, while making the URL relative to
|
|
the domain and not to the scheme.
|
|
|
|
Bugfixes
|
|
========
|
|
|
|
* Corrected email and URL validation to reject a trailing dash
|
|
(:ticket:`22579`).
|
|
|
|
* Prevented indexes on PostgreSQL virtual fields (:ticket:`22514`).
|
|
|
|
* Prevented edge case where values of FK fields could be initialized with a
|
|
wrong value when an inline model formset is created for a relationship
|
|
defined to point to a field other than the PK (:ticket:`13794`).
|
|
|
|
* Restored ``pre_delete`` signals for ``GenericRelation`` cascade deletion
|
|
(:ticket:`22998`).
|
|
|
|
* Fixed transaction handling when specifying non-default database in
|
|
``createcachetable`` and ``flush`` (:ticket:`23089`).
|
|
|
|
* Fixed the "ORA-01843: not a valid month" errors when using Unicode
|
|
with older versions of Oracle server (:ticket:`20292`).
|
|
|
|
* Restored bug fix for sending unicode email with Python 2.6.5 and below
|
|
(:ticket:`19107`).
|
|
|
|
* Prevented ``UnicodeDecodeError`` in ``runserver`` with non-UTF-8 and
|
|
non-English locale (:ticket:`23265`).
|
|
|
|
* Fixed JavaScript errors while editing multi-geometry objects in the OpenLayers
|
|
widget (:ticket:`23137`, :ticket:`23293`).
|
|
|
|
* Prevented a crash on Python 3 with query strings containing unencoded
|
|
non-ASCII characters (:ticket:`22996`).
|