{"title":"Django 1.5.4 release notes","version":"dev","locale":"en","docname":"releases/1.5.4","url":"/en/dev/releases/1.5.4/","canonical":"https://djangodocs.dev/en/dev/releases/1.5.4/","summary":"This is Django 1.5.4, the fourth release in the Django 1.5 series. It addresses two security issues and one bug.","html":"<h1>Django 1.5.4 release notes<a class=\"heading-anchor\" href=\"#django-1-5-4-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>September 14, 2013</em></p>\n<p>This is Django 1.5.4, the fourth release in the Django 1.5 series. It addresses\ntwo security issues and one bug.</p>\n<section id=\"denial-of-service-via-password-hashers\">\n<h2>Denial-of-service via password hashers<a class=\"heading-anchor\" href=\"#denial-of-service-via-password-hashers\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>In previous versions of Django, no limit was imposed on the plaintext\nlength of a password. This allowed a denial-of-service attack through\nsubmission of bogus but extremely large passwords, tying up server\nresources performing the (expensive, and increasingly expensive with\nthe length of the password) calculation of the corresponding hash.</p>\n<p>As of 1.5.4, Django’s authentication framework imposes a 4096-byte\nlimit on passwords, and will fail authentication with any submitted\npassword of greater length.</p>\n</section>\n<section id=\"corrected-usage-of-sensitive-post-parameters-in-django-contrib-auths-admin\">\n<h2>Corrected usage of <a class=\"reference internal\" href=\"/en/dev/howto/error-reporting/#django.views.decorators.debug.sensitive_post_parameters\" title=\"django.views.decorators.debug.sensitive_post_parameters\"><code class=\"xref py py-func docutils literal notranslate\">sensitive_post_parameters()</code></a> in <a class=\"reference internal\" href=\"/en/dev/topics/auth/#module-django.contrib.auth\" title=\"django.contrib.auth: Django's authentication framework.\"><code class=\"xref py py-mod docutils literal notranslate\">django.contrib.auth</code></a>’s admin<a class=\"heading-anchor\" href=\"#corrected-usage-of-sensitive-post-parameters-in-django-contrib-auths-admin\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>The decoration of the <code class=\"docutils literal notranslate\">add_view</code> and <code class=\"docutils literal notranslate\">user_change_password</code> user admin\nviews with <a class=\"reference internal\" href=\"/en/dev/howto/error-reporting/#django.views.decorators.debug.sensitive_post_parameters\" title=\"django.views.decorators.debug.sensitive_post_parameters\"><code class=\"xref py py-func docutils literal notranslate\">sensitive_post_parameters()</code></a>\ndid not include <a class=\"reference internal\" href=\"/en/dev/ref/utils/#django.utils.decorators.method_decorator\" title=\"django.utils.decorators.method_decorator\"><code class=\"xref py py-func docutils literal notranslate\">method_decorator()</code></a> (required\nsince the views are methods) resulting in the decorator not being properly\napplied. This usage has been fixed and\n<a class=\"reference internal\" href=\"/en/dev/howto/error-reporting/#django.views.decorators.debug.sensitive_post_parameters\" title=\"django.views.decorators.debug.sensitive_post_parameters\"><code class=\"xref py py-func docutils literal notranslate\">sensitive_post_parameters()</code></a> will now\nthrow an exception if it’s improperly used.</p>\n</section>\n<section id=\"bugfixes\">\n<h2>Bugfixes<a class=\"heading-anchor\" href=\"#bugfixes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<ul class=\"simple\">\n<li><p>Fixed a bug that prevented a <code class=\"docutils literal notranslate\">QuerySet</code> that uses\n<a class=\"reference internal\" href=\"/en/dev/ref/models/querysets/#django.db.models.query.QuerySet.prefetch_related\" title=\"django.db.models.query.QuerySet.prefetch_related\"><code class=\"xref py py-meth docutils literal notranslate\">prefetch_related()</code></a> from being pickled\nand unpickled more than once (the second pickling attempt raised an\nexception) (#21102).</p></li>\n</ul>\n</section>","rootId":"django-1-5-4-release-notes","toc":[{"title":"Denial-of-service via password hashers","anchor":"denial-of-service-via-password-hashers","children":[]},{"title":"Corrected usage of sensitive_post_parameters() in django.contrib.auth’s admin","anchor":"corrected-usage-of-sensitive-post-parameters-in-django-contrib-auths-admin","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/1.5.5","title":"Django 1.5.5 release notes","url":"/en/dev/releases/1.5.5/"},"next":{"docname":"releases/1.5.3","title":"Django 1.5.3 release notes","url":"/en/dev/releases/1.5.3/"},"formats":{"html":"/en/dev/releases/1.5.4/","markdown":"/en/dev/releases/1.5.4.md","json":"/en/dev/releases/1.5.4.json"},"source":"https://github.com/django/django/blob/main/docs/releases/1.5.4.txt","official":"https://docs.djangoproject.com/en/dev/releases/1.5.4/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11","1.10","1.9","1.8"],"inLocales":["en"]}