{"title":"Django 1.8.2 release notes","version":"dev","locale":"en","docname":"releases/1.8.2","url":"/en/dev/releases/1.8.2/","canonical":"https://djangodocs.dev/en/dev/releases/1.8.2/","summary":"Django 1.8.2 fixes a security issue and several bugs in 1.8.1. A change to session.flush() in the cached_db session backend in Django 1.8 mistakenly sets…","html":"<h1>Django 1.8.2 release notes<a class=\"heading-anchor\" href=\"#django-1-8-2-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>May 20, 2015</em></p>\n<p>Django 1.8.2 fixes a security issue and several bugs in 1.8.1.</p>\n<section id=\"fixed-session-flushing-in-the-cached-db-backend\">\n<h2>Fixed session flushing in the <code class=\"docutils literal notranslate\">cached_db</code> backend<a class=\"heading-anchor\" href=\"#fixed-session-flushing-in-the-cached-db-backend\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>A change to <code class=\"docutils literal notranslate\">session.flush()</code> in the <code class=\"docutils literal notranslate\">cached_db</code> session backend in Django\n1.8 mistakenly sets the session key to an empty string rather than <code class=\"docutils literal notranslate\">None</code>. An\nempty string is treated as a valid session key and the session cookie is set\naccordingly. Any users with an empty string in their session cookie will use\nthe same session store. <code class=\"docutils literal notranslate\">session.flush()</code> is called by\n<code class=\"docutils literal notranslate\">django.contrib.auth.logout()</code> and, more seriously, by\n<code class=\"docutils literal notranslate\">django.contrib.auth.login()</code> when a user switches accounts. If a user is\nlogged in and logs in again to a different account (without logging out) the\nsession is flushed to avoid reuse. After the session is flushed (and its\nsession key becomes <code class=\"docutils literal notranslate\">''</code>) the account details are set on the session and the\nsession is saved. Any users with an empty string in their session cookie will\nnow be logged into that account.</p>\n</section>\n<section id=\"bugfixes\">\n<h2>Bugfixes<a class=\"heading-anchor\" href=\"#bugfixes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<ul class=\"simple\">\n<li><p>Fixed check for template engine alias uniqueness (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/24685\">#24685</a>).</p></li>\n<li><p>Fixed crash when reusing the same <code class=\"docutils literal notranslate\">Case</code> instance in a query\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/24752\">#24752</a>).</p></li>\n<li><p>Corrected join promotion for <code class=\"docutils literal notranslate\">Case</code> expressions. For example, annotating a\nquery with a  <code class=\"docutils literal notranslate\">Case</code> expression could unexpectedly filter out results\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/24766\">#24766</a>).</p></li>\n<li><p>Fixed negated <code class=\"docutils literal notranslate\">Q</code> objects in expressions. Cases like\n<code class=\"docutils literal notranslate\">Case(When(~Q(friends__age__lte=30)))</code> tried to generate a subquery which\nresulted in a crash (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/24705\">#24705</a>).</p></li>\n<li><p>Fixed incorrect GROUP BY clause generation on MySQL when the query’s model\nhas a self-referential foreign key (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/24748\">#24748</a>).</p></li>\n<li><p>Implemented <code class=\"docutils literal notranslate\">ForeignKey.get_db_prep_value()</code> so that <code class=\"docutils literal notranslate\">ForeignKey</code>s\npointing to <a class=\"reference internal\" href=\"/en/dev/ref/models/fields/#django.db.models.UUIDField\" title=\"django.db.models.UUIDField\"><code class=\"xref py py-class docutils literal notranslate\">UUIDField</code></a> and inheritance on models\nwith <code class=\"docutils literal notranslate\">UUIDField</code> primary keys work correctly (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/24698\">#24698</a>,\n<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/24712\">#24712</a>).</p></li>\n<li><p>Fixed <code class=\"docutils literal notranslate\">isnull</code> lookup for <code class=\"docutils literal notranslate\">HStoreField</code> (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/24751\">#24751</a>).</p></li>\n<li><p>Fixed a MySQL crash when a migration removes a combined index (\n<code class=\"docutils literal notranslate\">unique_together</code> or <code class=\"docutils literal notranslate\">index_together</code>) containing a foreign key\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/24757\">#24757</a>).</p></li>\n<li><p>Fixed session cookie deletion when using <a class=\"reference internal\" href=\"/en/dev/ref/settings/#std-setting-SESSION_COOKIE_DOMAIN\"><code class=\"xref std std-setting docutils literal notranslate\">SESSION_COOKIE_DOMAIN</code></a>\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/24799\">#24799</a>).</p></li>\n<li><p>On PostgreSQL, when no access is granted for the <code class=\"docutils literal notranslate\">postgres</code> database,\nDjango now falls back to the default database when it normally requires a\n“no database” connection (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/24791\">#24791</a>).</p></li>\n<li><p>Fixed display of <code class=\"docutils literal notranslate\">contrib.admin</code>’s <code class=\"docutils literal notranslate\">ForeignKey</code> widget when it’s used\nin a row with other fields (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/24784\">#24784</a>).</p></li>\n</ul>\n</section>","rootId":"django-1-8-2-release-notes","toc":[{"title":"Fixed session flushing in the cached_db backend","anchor":"fixed-session-flushing-in-the-cached-db-backend","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/1.8.3","title":"Django 1.8.3 release notes","url":"/en/dev/releases/1.8.3/"},"next":{"docname":"releases/1.8.1","title":"Django 1.8.1 release notes","url":"/en/dev/releases/1.8.1/"},"formats":{"html":"/en/dev/releases/1.8.2/","markdown":"/en/dev/releases/1.8.2.md","json":"/en/dev/releases/1.8.2.json"},"source":"https://github.com/django/django/blob/main/docs/releases/1.8.2.txt","official":"https://docs.djangoproject.com/en/dev/releases/1.8.2/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11","1.10","1.9","1.8"],"inLocales":["en"]}