{"title":"Django 1.8.14 release notes","version":"dev","locale":"en","docname":"releases/1.8.14","url":"/en/dev/releases/1.8.14/","canonical":"https://djangodocs.dev/en/dev/releases/1.8.14/","summary":"Django 1.8.14 fixes a security issue and a bug in 1.8.13. Unsafe usage of JavaScript’s Element.innerHTML could result in XSS in the admin’s add/change…","html":"<h1>Django 1.8.14 release notes<a class=\"heading-anchor\" href=\"#django-1-8-14-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>July 18, 2016</em></p>\n<p>Django 1.8.14 fixes a security issue and a bug in 1.8.13.</p>\n<section id=\"xss-in-admin-s-add-change-related-popup\">\n<h2>XSS in admin’s add/change related popup<a class=\"heading-anchor\" href=\"#xss-in-admin-s-add-change-related-popup\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>Unsafe usage of JavaScript’s <code class=\"docutils literal notranslate\">Element.innerHTML</code> could result in XSS in the\nadmin’s add/change related popup. <code class=\"docutils literal notranslate\">Element.textContent</code> is now used to\nprevent execution of the data.</p>\n<p>The debug view also used <code class=\"docutils literal notranslate\">innerHTML</code>. Although a security issue wasn’t\nidentified there, out of an abundance of caution it’s also updated to use\n<code class=\"docutils literal notranslate\">textContent</code>.</p>\n</section>\n<section id=\"bugfixes\">\n<h2>Bugfixes<a class=\"heading-anchor\" href=\"#bugfixes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<ul class=\"simple\">\n<li><p>Fixed missing <code class=\"docutils literal notranslate\">varchar/text_pattern_ops</code> index on <code class=\"docutils literal notranslate\">CharField</code> and\n<code class=\"docutils literal notranslate\">TextField</code> respectively when using <code class=\"docutils literal notranslate\">AddField</code> on PostgreSQL\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/26889\">#26889</a>).</p></li>\n</ul>\n</section>","rootId":"django-1-8-14-release-notes","toc":[{"title":"XSS in admin’s add/change related popup","anchor":"xss-in-admin-s-add-change-related-popup","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/1.8.15","title":"Django 1.8.15 release notes","url":"/en/dev/releases/1.8.15/"},"next":{"docname":"releases/1.8.13","title":"Django 1.8.13 release notes","url":"/en/dev/releases/1.8.13/"},"formats":{"html":"/en/dev/releases/1.8.14/","markdown":"/en/dev/releases/1.8.14.md","json":"/en/dev/releases/1.8.14.json"},"source":"https://github.com/django/django/blob/main/docs/releases/1.8.14.txt","official":"https://docs.djangoproject.com/en/dev/releases/1.8.14/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11","1.10","1.9","1.8"],"inLocales":["en"]}