{"title":"Django 1.7.6 release notes","version":"dev","locale":"en","docname":"releases/1.7.6","url":"/en/dev/releases/1.7.6/","canonical":"https://djangodocs.dev/en/dev/releases/1.7.6/","summary":"Django 1.7.6 fixes a security issue and several bugs in 1.7.5. The ModelAdmin.readonly_fields attribute in the Django admin allows displaying model fields…","html":"<h1>Django 1.7.6 release notes<a class=\"heading-anchor\" href=\"#django-1-7-6-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>March 9, 2015</em></p>\n<p>Django 1.7.6 fixes a security issue and several bugs in 1.7.5.</p>\n<section id=\"mitigated-an-xss-attack-via-properties-in-modeladmin-readonly-fields\">\n<h2>Mitigated an XSS attack via properties in <code class=\"docutils literal notranslate\">ModelAdmin.readonly_fields</code><a class=\"heading-anchor\" href=\"#mitigated-an-xss-attack-via-properties-in-modeladmin-readonly-fields\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>The <a class=\"reference internal\" href=\"/en/dev/ref/contrib/admin/#django.contrib.admin.ModelAdmin.readonly_fields\" title=\"django.contrib.admin.ModelAdmin.readonly_fields\"><code class=\"xref py py-attr docutils literal notranslate\">ModelAdmin.readonly_fields</code></a> attribute in the Django\nadmin allows displaying model fields and model attributes. While the former\nwere correctly escaped, the latter were not. Thus untrusted content could be\ninjected into the admin, presenting an exploitation vector for XSS attacks.</p>\n<p>In this vulnerability, every model attribute used in <code class=\"docutils literal notranslate\">readonly_fields</code> that\nis not an actual model field (e.g. a <a class=\"reference external\" href=\"https://docs.python.org/3/library/functions.html#property\" title=\"(in Python v3.14)\"><code class=\"xref py py-class docutils literal notranslate\">property</code></a>) will <strong>fail to be\nescaped</strong> even if that attribute is not marked as safe. In this release,\nautoescaping is now correctly applied.</p>\n</section>\n<section id=\"bugfixes\">\n<h2>Bugfixes<a class=\"heading-anchor\" href=\"#bugfixes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<ul class=\"simple\">\n<li><p>Fixed crash when coercing <code class=\"docutils literal notranslate\">ManyRelatedManager</code> to a string\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/24352\">#24352</a>).</p></li>\n<li><p>Fixed a bug that prevented migrations from adding a foreign key constraint\nwhen converting an existing field to a foreign key (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/24447\">#24447</a>).</p></li>\n</ul>\n</section>","rootId":"django-1-7-6-release-notes","toc":[{"title":"Mitigated an XSS attack via properties in ModelAdmin.readonly_fields","anchor":"mitigated-an-xss-attack-via-properties-in-modeladmin-readonly-fields","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/1.7.7","title":"Django 1.7.7 release notes","url":"/en/dev/releases/1.7.7/"},"next":{"docname":"releases/1.7.5","title":"Django 1.7.5 release notes","url":"/en/dev/releases/1.7.5/"},"formats":{"html":"/en/dev/releases/1.7.6/","markdown":"/en/dev/releases/1.7.6.md","json":"/en/dev/releases/1.7.6.json"},"source":"https://github.com/django/django/blob/main/docs/releases/1.7.6.txt","official":"https://docs.djangoproject.com/en/dev/releases/1.7.6/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11","1.10","1.9","1.8"],"inLocales":["en"]}