{"title":"Django 1.7.11 release notes","version":"dev","locale":"en","docname":"releases/1.7.11","url":"/en/dev/releases/1.7.11/","canonical":"https://djangodocs.dev/en/dev/releases/1.7.11/","summary":"Django 1.7.11 fixes a security issue and a data loss bug in 1.7.10. If an application allows users to specify an unvalidated format for dates and passes…","html":"<h1>Django 1.7.11 release notes<a class=\"heading-anchor\" href=\"#django-1-7-11-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>November 24, 2015</em></p>\n<p>Django 1.7.11 fixes a security issue and a data loss bug in 1.7.10.</p>\n<section id=\"fixed-settings-leak-possibility-in-date-template-filter\">\n<h2>Fixed settings leak possibility in <code class=\"docutils literal notranslate\">date</code> template filter<a class=\"heading-anchor\" href=\"#fixed-settings-leak-possibility-in-date-template-filter\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>If an application allows users to specify an unvalidated format for dates and\npasses this format to the <a class=\"reference internal\" href=\"/en/dev/ref/templates/builtins/#std-templatefilter-date\"><code class=\"xref std std-tfilter docutils literal notranslate\">date</code></a> filter, e.g.\n<code class=\"docutils literal notranslate\">{{ last_updated|date:user_date_format }}</code>, then a malicious user could\nobtain any secret in the application’s settings by specifying a settings key\ninstead of a date format. e.g. <code class=\"docutils literal notranslate\">&quot;SECRET_KEY&quot;</code> instead of <code class=\"docutils literal notranslate\">&quot;j/m/Y&quot;</code>.</p>\n<p>To remedy this, the underlying function used by the <code class=\"docutils literal notranslate\">date</code> template filter,\n<code class=\"docutils literal notranslate\">django.utils.formats.get_format()</code>, now only allows accessing the date/time\nformatting settings.</p>\n</section>\n<section id=\"bugfixes\">\n<h2>Bugfixes<a class=\"heading-anchor\" href=\"#bugfixes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<ul class=\"simple\">\n<li><p>Fixed a data loss possibility with <a class=\"reference internal\" href=\"/en/dev/ref/models/querysets/#django.db.models.Prefetch\" title=\"django.db.models.Prefetch\"><code class=\"xref py py-class docutils literal notranslate\">Prefetch</code></a> if\n<code class=\"docutils literal notranslate\">to_attr</code> is set to a <code class=\"docutils literal notranslate\">ManyToManyField</code> (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/25693\">#25693</a>).</p></li>\n</ul>\n</section>","rootId":"django-1-7-11-release-notes","toc":[{"title":"Fixed settings leak possibility in date template filter","anchor":"fixed-settings-leak-possibility-in-date-template-filter","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/1.8","title":"Django 1.8 release notes","url":"/en/dev/releases/1.8/"},"next":{"docname":"releases/1.7.10","title":"Django 1.7.10 release notes","url":"/en/dev/releases/1.7.10/"},"formats":{"html":"/en/dev/releases/1.7.11/","markdown":"/en/dev/releases/1.7.11.md","json":"/en/dev/releases/1.7.11.json"},"source":"https://github.com/django/django/blob/main/docs/releases/1.7.11.txt","official":"https://docs.djangoproject.com/en/dev/releases/1.7.11/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11","1.10","1.9","1.8"],"inLocales":["en"]}