{"title":"Django 1.1.3 release notes","version":"dev","locale":"en","docname":"releases/1.1.3","url":"/en/dev/releases/1.1.3/","canonical":"https://djangodocs.dev/en/dev/releases/1.1.3/","summary":"Welcome to Django 1.1.3! This is the third “bugfix” release in the Django 1.1 series, improving the stability and performance of the Django 1.1 codebase.","html":"<h1>Django 1.1.3 release notes<a class=\"heading-anchor\" href=\"#django-1-1-3-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p>Welcome to Django 1.1.3!</p>\n<p>This is the third “bugfix” release in the Django 1.1 series,\nimproving the stability and performance of the Django 1.1 codebase.</p>\n<p>With one exception, Django 1.1.3 maintains backwards compatibility\nwith Django 1.1.2. It also contains a number of fixes and other\nimprovements. Django 1.1.2 is a recommended upgrade for any\ndevelopment or deployment currently using or targeting Django 1.1.</p>\n<p>For full details on the new features, backwards incompatibilities, and\ndeprecated features in the 1.1 branch, see the <a class=\"reference internal\" href=\"/en/dev/releases/1.1/\"><span class=\"doc\">Django 1.1 release notes</span></a>.</p>\n<section id=\"backwards-incompatible-changes\">\n<h2>Backwards incompatible changes<a class=\"heading-anchor\" href=\"#backwards-incompatible-changes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<section id=\"restricted-filters-in-admin-interface\">\n<h3>Restricted filters in admin interface<a class=\"heading-anchor\" href=\"#restricted-filters-in-admin-interface\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h3>\n<p>The Django administrative interface, <code class=\"docutils literal notranslate\">django.contrib.admin</code>, supports\nfiltering of displayed lists of objects by fields on the corresponding\nmodels, including across database-level relationships. This is\nimplemented by passing lookup arguments in the querystring portion of\nthe URL, and options on the ModelAdmin class allow developers to\nspecify particular fields or relationships which will generate\nautomatic links for filtering.</p>\n<p>One historically-undocumented and -unofficially-supported feature has\nbeen the ability for a user with sufficient knowledge of a model’s\nstructure and the format of these lookup arguments to invent useful\nnew filters on the fly by manipulating the querystring.</p>\n<p>However, it has been demonstrated that this can be abused to gain\naccess to information outside of an admin user’s permissions; for\nexample, an attacker with access to the admin and sufficient knowledge\nof model structure and relations could construct query strings which –\nwith repeated use of regular-expression lookups supported by the\nDjango database API – expose sensitive information such as users’\npassword hashes.</p>\n<p>To remedy this, <code class=\"docutils literal notranslate\">django.contrib.admin</code> will now validate that\nquerystring lookup arguments either specify only fields on the model\nbeing viewed, or cross relations which have been explicitly\nallowed by the application developer using the preexisting\nmechanism mentioned above. This is backwards-incompatible for any\nusers relying on the prior ability to insert arbitrary lookups.</p>\n</section>\n</section>","rootId":"django-1-1-3-release-notes","toc":[{"title":"Backwards incompatible changes","anchor":"backwards-incompatible-changes","children":[{"title":"Restricted filters in admin interface","anchor":"restricted-filters-in-admin-interface","children":[]}]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/1.1.4","title":"Django 1.1.4 release notes","url":"/en/dev/releases/1.1.4/"},"next":{"docname":"releases/1.1.2","title":"Django 1.1.2 release notes","url":"/en/dev/releases/1.1.2/"},"formats":{"html":"/en/dev/releases/1.1.3/","markdown":"/en/dev/releases/1.1.3.md","json":"/en/dev/releases/1.1.3.json"},"source":"https://github.com/django/django/blob/main/docs/releases/1.1.3.txt","official":"https://docs.djangoproject.com/en/dev/releases/1.1.3/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11","1.10","1.9","1.8"],"inLocales":["en"]}