{"title":"Django 1.11.10 release notes","version":"dev","locale":"en","docname":"releases/1.11.10","url":"/en/dev/releases/1.11.10/","canonical":"https://djangodocs.dev/en/dev/releases/1.11.10/","summary":"Django 1.11.10 fixes a security issue and several bugs in 1.11.9. A regression in Django 1.11.8 made AuthenticationForm run its confirm_login_allowed()…","html":"<h1>Django 1.11.10 release notes<a class=\"heading-anchor\" href=\"#django-1-11-10-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>February 1, 2018</em></p>\n<p>Django 1.11.10 fixes a security issue and several bugs in 1.11.9.</p>\n<section id=\"cve-2018-6188-information-leakage-in-authenticationform\">\n<h2>CVE-2018-6188: Information leakage in <code class=\"docutils literal notranslate\">AuthenticationForm</code><a class=\"heading-anchor\" href=\"#cve-2018-6188-information-leakage-in-authenticationform\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>A regression in Django 1.11.8 made\n<a class=\"reference internal\" href=\"/en/dev/topics/auth/default/#django.contrib.auth.forms.AuthenticationForm\" title=\"django.contrib.auth.forms.AuthenticationForm\"><code class=\"xref py py-class docutils literal notranslate\">AuthenticationForm</code></a> run its\n<code class=\"docutils literal notranslate\">confirm_login_allowed()</code> method even if an incorrect password is entered.\nThis can leak information about a user, depending on what messages\n<code class=\"docutils literal notranslate\">confirm_login_allowed()</code> raises. If <code class=\"docutils literal notranslate\">confirm_login_allowed()</code> isn’t\noverridden, an attacker enter an arbitrary username and see if that user has\nbeen set to <code class=\"docutils literal notranslate\">is_active=False</code>. If <code class=\"docutils literal notranslate\">confirm_login_allowed()</code> is overridden,\nmore sensitive details could be leaked.</p>\n<p>This issue is fixed with the caveat that <code class=\"docutils literal notranslate\">AuthenticationForm</code> can no longer\nraise the “This account is inactive.” error if the authentication backend\nrejects inactive users (the default authentication backend, <code class=\"docutils literal notranslate\">ModelBackend</code>,\nhas done that since Django 1.10). This issue will be revisited for Django 2.1\nas a fix to address the caveat will likely be too invasive for inclusion in\nolder versions.</p>\n</section>\n<section id=\"bugfixes\">\n<h2>Bugfixes<a class=\"heading-anchor\" href=\"#bugfixes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<ul class=\"simple\">\n<li><p>Fixed incorrect foreign key nullification if a model has two foreign keys to\nthe same model and a target model is deleted (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/29016\">#29016</a>).</p></li>\n<li><p>Fixed a regression where <code class=\"docutils literal notranslate\">contrib.auth.authenticate()</code> crashes if an\nauthentication backend doesn’t accept <code class=\"docutils literal notranslate\">request</code> and a later one does\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/29071\">#29071</a>).</p></li>\n<li><p>Fixed crash when entering an invalid uuid in <code class=\"docutils literal notranslate\">ModelAdmin.raw_id_fields</code>\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/29094\">#29094</a>).</p></li>\n</ul>\n</section>","rootId":"django-1-11-10-release-notes","toc":[{"title":"CVE-2018-6188: Information leakage in AuthenticationForm","anchor":"cve-2018-6188-information-leakage-in-authenticationform","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/1.11.11","title":"Django 1.11.11 release notes","url":"/en/dev/releases/1.11.11/"},"next":{"docname":"releases/1.11.9","title":"Django 1.11.9 release notes","url":"/en/dev/releases/1.11.9/"},"formats":{"html":"/en/dev/releases/1.11.10/","markdown":"/en/dev/releases/1.11.10.md","json":"/en/dev/releases/1.11.10.json"},"source":"https://github.com/django/django/blob/main/docs/releases/1.11.10.txt","official":"https://docs.djangoproject.com/en/dev/releases/1.11.10/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11"],"inLocales":["en"]}