{"title":"Django 1.8.4 release notes","version":"dev","locale":"en","docname":"releases/1.8.4","url":"/en/dev/releases/1.8.4/","canonical":"https://djangodocs.dev/en/dev/releases/1.8.4/","summary":"Django 1.8.4 fixes a security issue and several bugs in 1.8.3. Previously, a session could be created when anonymously accessing the django.contrib.auth.view…","html":"<h1>Django 1.8.4 release notes<a class=\"heading-anchor\" href=\"#django-1-8-4-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>August 18, 2015</em></p>\n<p>Django 1.8.4 fixes a security issue and several bugs in 1.8.3.</p>\n<section id=\"denial-of-service-possibility-in-logout-view-by-filling-session-store\">\n<h2>Denial-of-service possibility in <code class=\"docutils literal notranslate\">logout()</code> view by filling session store<a class=\"heading-anchor\" href=\"#denial-of-service-possibility-in-logout-view-by-filling-session-store\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>Previously, a session could be created when anonymously accessing the\n<code class=\"docutils literal notranslate\">django.contrib.auth.views.logout()</code> view (provided it wasn’t decorated\nwith <a class=\"reference internal\" href=\"/en/dev/topics/auth/default/#django.contrib.auth.decorators.login_required\" title=\"django.contrib.auth.decorators.login_required\"><code class=\"xref py py-func docutils literal notranslate\">login_required()</code></a> as done in the\nadmin). This could allow an attacker to easily create many new session records\nby sending repeated requests, potentially filling up the session store or\ncausing other users’ session records to be evicted.</p>\n<p>The <a class=\"reference internal\" href=\"/en/dev/ref/middleware/#django.contrib.sessions.middleware.SessionMiddleware\" title=\"django.contrib.sessions.middleware.SessionMiddleware\"><code class=\"xref py py-class docutils literal notranslate\">SessionMiddleware</code></a> has been\nmodified to no longer create empty session records, including when\n<a class=\"reference internal\" href=\"/en/dev/ref/settings/#std-setting-SESSION_SAVE_EVERY_REQUEST\"><code class=\"xref std std-setting docutils literal notranslate\">SESSION_SAVE_EVERY_REQUEST</code></a> is active.</p>\n</section>\n<section id=\"bugfixes\">\n<h2>Bugfixes<a class=\"heading-anchor\" href=\"#bugfixes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<ul class=\"simple\">\n<li><p>Added the ability to serialize values from the newly added\n<a class=\"reference internal\" href=\"/en/dev/ref/models/fields/#django.db.models.UUIDField\" title=\"django.db.models.UUIDField\"><code class=\"xref py py-class docutils literal notranslate\">UUIDField</code></a> (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/25019\">#25019</a>).</p></li>\n<li><p>Added a system check warning if the old <code class=\"docutils literal notranslate\">TEMPLATE_*</code> settings are defined\nin addition to the new <code class=\"docutils literal notranslate\">TEMPLATES</code> setting.</p></li>\n<li><p>Fixed <code class=\"docutils literal notranslate\">QuerySet.raw()</code> so <code class=\"docutils literal notranslate\">InvalidQuery</code> is not raised when using the\n<code class=\"docutils literal notranslate\">db_column</code> name of a <code class=\"docutils literal notranslate\">ForeignKey</code> field with <code class=\"docutils literal notranslate\">primary_key=True</code>\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/12768\">#12768</a>).</p></li>\n<li><p>Prevented an exception in <code class=\"docutils literal notranslate\">TestCase.setUpTestData()</code> from leaking the\ntransaction (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/25176\">#25176</a>).</p></li>\n<li><p>Fixed <code class=\"docutils literal notranslate\">has_changed()</code> method in <code class=\"docutils literal notranslate\">contrib.postgres.forms.HStoreField</code>\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/25215\">#25215</a>, <a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/25233\">#25233</a>).</p></li>\n<li><p>Fixed the recording of squashed migrations when running the <code class=\"docutils literal notranslate\">migrate</code>\ncommand (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/25231\">#25231</a>).</p></li>\n<li><p>Moved the <a class=\"reference internal\" href=\"/en/dev/releases/1.8/#unsaved-model-instance-check-18\"><span class=\"std std-ref\">unsaved model instance assignment data loss check</span></a> to <code class=\"docutils literal notranslate\">Model.save()</code> to allow easier usage\nof in-memory models (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/25160\">#25160</a>).</p></li>\n<li><p>Prevented <code class=\"docutils literal notranslate\">varchar_patterns_ops</code> and <code class=\"docutils literal notranslate\">text_patterns_ops</code> indexes for\n<code class=\"docutils literal notranslate\">ArrayField</code> (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/25180\">#25180</a>).</p></li>\n</ul>\n</section>","rootId":"django-1-8-4-release-notes","toc":[{"title":"Denial-of-service possibility in logout() view by filling session store","anchor":"denial-of-service-possibility-in-logout-view-by-filling-session-store","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/1.8.5","title":"Django 1.8.5 release notes","url":"/en/dev/releases/1.8.5/"},"next":{"docname":"releases/1.8.3","title":"Django 1.8.3 release notes","url":"/en/dev/releases/1.8.3/"},"formats":{"html":"/en/dev/releases/1.8.4/","markdown":"/en/dev/releases/1.8.4.md","json":"/en/dev/releases/1.8.4.json"},"source":"https://github.com/django/django/blob/main/docs/releases/1.8.4.txt","official":"https://docs.djangoproject.com/en/dev/releases/1.8.4/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11","1.10","1.9","1.8"],"inLocales":["en"]}