{"title":"Django 1.11.5 release notes","version":"dev","locale":"en","docname":"releases/1.11.5","url":"/en/dev/releases/1.11.5/","canonical":"https://djangodocs.dev/en/dev/releases/1.11.5/","summary":"Django 1.11.5 fixes a security issue and several bugs in 1.11.4. In older versions, HTML autoescaping was disabled in a portion of the template for the…","html":"<h1>Django 1.11.5 release notes<a class=\"heading-anchor\" href=\"#django-1-11-5-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>September 5, 2017</em></p>\n<p>Django 1.11.5 fixes a security issue and several bugs in 1.11.4.</p>\n<section id=\"cve-2017-12794-possible-xss-in-traceback-section-of-technical-500-debug-page\">\n<h2>CVE-2017-12794: Possible XSS in traceback section of technical 500 debug page<a class=\"heading-anchor\" href=\"#cve-2017-12794-possible-xss-in-traceback-section-of-technical-500-debug-page\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>In older versions, HTML autoescaping was disabled in a portion of the template\nfor the technical 500 debug page. Given the right circumstances, this allowed\na cross-site scripting attack. This vulnerability shouldn’t affect most\nproduction sites since you shouldn’t run with <code class=\"docutils literal notranslate\">DEBUG = True</code> (which makes\nthis page accessible) in your production settings.</p>\n</section>\n<section id=\"bugfixes\">\n<h2>Bugfixes<a class=\"heading-anchor\" href=\"#bugfixes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<ul class=\"simple\">\n<li><p>Fixed GEOS version parsing if the version has a commit hash at the end (new\nin GEOS 3.6.2) (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/28441\">#28441</a>).</p></li>\n<li><p>Added compatibility for <code class=\"docutils literal notranslate\">cx_Oracle</code> 6 (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/28498\">#28498</a>).</p></li>\n<li><p>Fixed select widget rendering when option values are tuples\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/28502\">#28502</a>).</p></li>\n<li><p>Django 1.11 inadvertently changed the sequence and trigger naming scheme on\nOracle. This causes errors on INSERTs for some tables if\n<code class=\"docutils literal notranslate\">'use_returning_into': False</code> is in the <code class=\"docutils literal notranslate\">OPTIONS</code> part of <code class=\"docutils literal notranslate\">DATABASES</code>.\nThe pre-1.11 naming scheme is now restored. Unfortunately, it necessarily\nrequires an update to Oracle tables created with Django 1.11.[1-4]. Use the\nupgrade script in <a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/28451\">#28451</a> comment 8 to update sequence and trigger\nnames to use the pre-1.11 naming scheme.</p></li>\n<li><p>Added POST request support to <code class=\"docutils literal notranslate\">LogoutView</code>, for equivalence with the\nfunction-based <code class=\"docutils literal notranslate\">logout()</code> view (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/28513\">#28513</a>).</p></li>\n<li><p>Omitted <code class=\"docutils literal notranslate\">pages_per_range</code> from <code class=\"docutils literal notranslate\">BrinIndex.deconstruct()</code> if it’s <code class=\"docutils literal notranslate\">None</code>\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/25809\">#25809</a>).</p></li>\n<li><p>Fixed a regression where <code class=\"docutils literal notranslate\">SelectDateWidget</code> localized the years in the\nselect box (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/28530\">#28530</a>).</p></li>\n<li><p>Fixed a regression in 1.11.4 where <code class=\"docutils literal notranslate\">runserver</code> crashed with non-Unicode\nsystem encodings on Python 2 + Windows (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/28487\">#28487</a>).</p></li>\n<li><p>Fixed a regression in Django 1.10 where changes to a <code class=\"docutils literal notranslate\">ManyToManyField</code>\nweren’t logged in the admin change history (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/27998\">#27998</a>) and prevented\n<code class=\"docutils literal notranslate\">ManyToManyField</code> initial data in model forms from being affected by\nsubsequent model changes (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/28543\">#28543</a>).</p></li>\n<li><p>Fixed non-deterministic results or an <code class=\"docutils literal notranslate\">AssertionError</code> crash in some\nqueries with multiple joins (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/26522\">#26522</a>).</p></li>\n<li><p>Fixed a regression in <code class=\"docutils literal notranslate\">contrib.auth</code>’s <code class=\"docutils literal notranslate\">login()</code> and <code class=\"docutils literal notranslate\">logout()</code> views\nwhere they ignored positional arguments (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/28550\">#28550</a>).</p></li>\n</ul>\n</section>","rootId":"django-1-11-5-release-notes","toc":[{"title":"CVE-2017-12794: Possible XSS in traceback section of technical 500 debug page","anchor":"cve-2017-12794-possible-xss-in-traceback-section-of-technical-500-debug-page","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/1.11.6","title":"Django 1.11.6 release notes","url":"/en/dev/releases/1.11.6/"},"next":{"docname":"releases/1.11.4","title":"Django 1.11.4 release notes","url":"/en/dev/releases/1.11.4/"},"formats":{"html":"/en/dev/releases/1.11.5/","markdown":"/en/dev/releases/1.11.5.md","json":"/en/dev/releases/1.11.5.json"},"source":"https://github.com/django/django/blob/main/docs/releases/1.11.5.txt","official":"https://docs.djangoproject.com/en/dev/releases/1.11.5/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11"],"inLocales":["en"]}