Django 1.8.7 release notes#

November 24, 2015

Django 1.8.7 fixes a security issue and several bugs in 1.8.6.

Additionally, Django’s vendored version of six, django.utils.six, has been upgraded to the latest release (1.10.0).

Fixed settings leak possibility in date template filter#

If an application allows users to specify an unvalidated format for dates and passes this format to the date filter, e.g. {{ last_updated|date:user_date_format }}, then a malicious user could obtain any secret in the application’s settings by specifying a settings key instead of a date format. e.g. "SECRET_KEY" instead of "j/m/Y".

To remedy this, the underlying function used by the date template filter, django.utils.formats.get_format(), now only allows accessing the date/time formatting settings.

Bugfixes#

  • Fixed a crash of the debug view during the autumn DST change when USE_TZ is False and pytz is installed.

  • Fixed a regression in 1.8.6 that caused database routers without an allow_migrate() method to crash (#25686).

  • Fixed a regression in 1.8.6 by restoring the ability to use Manager objects for the queryset argument of ModelChoiceField (#25683).

  • Fixed a regression in 1.8.6 that caused an application with South migrations in the migrations directory to fail (#25618).

  • Fixed a data loss possibility with Prefetch if to_attr is set to a ManyToManyField (#25693).

  • Fixed a regression in 1.8 by making gettext() once again return UTF-8 bytestrings on Python 2 if the input is a bytestring (#25720).

  • Fixed serialization of DateRangeField and DateTimeRangeField (#24937).

  • Fixed the exact lookup of ArrayField (#25666).

  • Fixed Model.refresh_from_db() updating of ForeignKey fields with on_delete=models.SET_NULL (#25715).

  • Fixed a duplicate query regression in 1.8 on proxied model deletion (#25685).

  • Fixed set_FOO_order() crash when the ForeignKey of a model with order_with_respect_to references a model with a OneToOneField primary key (#25786).

  • Fixed incorrect validation for PositiveIntegerField and PositiveSmallIntegerField on MySQL resulting in values greater than 4294967295 or 65535, respectively, passing validation and being silently truncated by the database (#25767).