Skip to content

Update django to 2.1.2 #360

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 1, 2018
Merged

Conversation

pyup-bot
Copy link
Collaborator

@pyup-bot pyup-bot commented Oct 1, 2018

This PR updates Django from 2.1.1 to 2.1.2.

Changelog

2.1.2

==========================

*October 1, 2018*

Django 2.1.2 fixes a security issue and several bugs in 2.1.1. Also, the latest
string translations from Transifex are incorporated.

CVE-2018-16984: Password hash disclosure to "view only" admin users
===================================================================

If an admin user has the change permission to the user model, only part of the
password hash is displayed in the change form. Admin users with the view (but
not change) permission to the user model were displayed the entire hash. While
it's typically infeasible to reverse a strong password hash, if your site uses
weaker password hashing algorithms such as MD5 or SHA1, it could be a problem.

Bugfixes
========

* Fixed a regression where nonexistent joins in ``F()`` no longer raised
``FieldError`` (:ticket:`29727`).

* Fixed a regression where files starting with a tilde or underscore weren't
ignored by the migrations loader (:ticket:`29749`).

* Made migrations detect changes to ``Meta.default_related_name``
(:ticket:`29755`).

* Added compatibility for ``cx_Oracle`` 7 (:ticket:`29759`).

* Fixed a regression in Django 2.0 where unique index names weren't quoted
(:ticket:`29778`).

* Fixed a regression where sliced queries with multiple columns with the same
name crashed on Oracle 12.1 (:ticket:`29630`).

* Fixed a crash when a user with the view (but not change) permission made a
POST request to an admin user change form (:ticket:`29809`).


==========================
Links

@peterbe peterbe merged commit 2b5d054 into master Oct 1, 2018
@peterbe peterbe deleted the pyup-update-django-2.1.1-to-2.1.2 branch October 1, 2018 15:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants