{"title":"Django 1.8.7 release notes","version":"dev","locale":"en","docname":"releases/1.8.7","url":"/en/dev/releases/1.8.7/","canonical":"https://djangodocs.dev/en/dev/releases/1.8.7/","summary":"Django 1.8.7 fixes a security issue and several bugs in 1.8.6. Additionally, Django’s vendored version of six, django.utils.six, has been upgraded to the…","html":"<h1>Django 1.8.7 release notes<a class=\"heading-anchor\" href=\"#django-1-8-7-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>November 24, 2015</em></p>\n<p>Django 1.8.7 fixes a security issue and several bugs in 1.8.6.</p>\n<p>Additionally, Django’s vendored version of six, <code class=\"docutils literal notranslate\">django.utils.six</code>, has\nbeen upgraded to the latest release (1.10.0).</p>\n<section id=\"fixed-settings-leak-possibility-in-date-template-filter\">\n<h2>Fixed settings leak possibility in <code class=\"docutils literal notranslate\">date</code> template filter<a class=\"heading-anchor\" href=\"#fixed-settings-leak-possibility-in-date-template-filter\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>If an application allows users to specify an unvalidated format for dates and\npasses this format to the <a class=\"reference internal\" href=\"/en/dev/ref/templates/builtins/#std-templatefilter-date\"><code class=\"xref std std-tfilter docutils literal notranslate\">date</code></a> filter, e.g.\n<code class=\"docutils literal notranslate\">{{ last_updated|date:user_date_format }}</code>, then a malicious user could\nobtain any secret in the application’s settings by specifying a settings key\ninstead of a date format. e.g. <code class=\"docutils literal notranslate\">&quot;SECRET_KEY&quot;</code> instead of <code class=\"docutils literal notranslate\">&quot;j/m/Y&quot;</code>.</p>\n<p>To remedy this, the underlying function used by the <code class=\"docutils literal notranslate\">date</code> template filter,\n<code class=\"docutils literal notranslate\">django.utils.formats.get_format()</code>, now only allows accessing the date/time\nformatting settings.</p>\n</section>\n<section id=\"bugfixes\">\n<h2>Bugfixes<a class=\"heading-anchor\" href=\"#bugfixes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<ul class=\"simple\">\n<li><p>Fixed a crash of the debug view during the autumn DST change when\n<a class=\"reference internal\" href=\"/en/dev/ref/settings/#std-setting-USE_TZ\"><code class=\"xref std std-setting docutils literal notranslate\">USE_TZ</code></a> is <code class=\"docutils literal notranslate\">False</code> and <code class=\"docutils literal notranslate\">pytz</code> is installed.</p></li>\n<li><p>Fixed a regression in 1.8.6 that caused database routers without an\n<code class=\"docutils literal notranslate\">allow_migrate()</code> method to crash (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/25686\">#25686</a>).</p></li>\n<li><p>Fixed a regression in 1.8.6 by restoring the ability to use <code class=\"docutils literal notranslate\">Manager</code>\nobjects for the <code class=\"docutils literal notranslate\">queryset</code> argument of <code class=\"docutils literal notranslate\">ModelChoiceField</code>\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/25683\">#25683</a>).</p></li>\n<li><p>Fixed a regression in 1.8.6 that caused an application with South migrations\nin the <code class=\"docutils literal notranslate\">migrations</code> directory to fail (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/25618\">#25618</a>).</p></li>\n<li><p>Fixed a data loss possibility with <a class=\"reference internal\" href=\"/en/dev/ref/models/querysets/#django.db.models.Prefetch\" title=\"django.db.models.Prefetch\"><code class=\"xref py py-class docutils literal notranslate\">Prefetch</code></a> if\n<code class=\"docutils literal notranslate\">to_attr</code> is set to a <code class=\"docutils literal notranslate\">ManyToManyField</code> (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/25693\">#25693</a>).</p></li>\n<li><p>Fixed a regression in 1.8 by making <code class=\"docutils literal notranslate\">gettext()</code> once again return UTF-8\nbytestrings on Python 2 if the input is a bytestring (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/25720\">#25720</a>).</p></li>\n<li><p>Fixed serialization of\n<a class=\"reference internal\" href=\"/en/dev/ref/contrib/postgres/fields/#django.contrib.postgres.fields.DateRangeField\" title=\"django.contrib.postgres.fields.DateRangeField\"><code class=\"xref py py-class docutils literal notranslate\">DateRangeField</code></a> and\n<a class=\"reference internal\" href=\"/en/dev/ref/contrib/postgres/fields/#django.contrib.postgres.fields.DateTimeRangeField\" title=\"django.contrib.postgres.fields.DateTimeRangeField\"><code class=\"xref py py-class docutils literal notranslate\">DateTimeRangeField</code></a> (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/24937\">#24937</a>).</p></li>\n<li><p>Fixed the exact lookup of <code class=\"docutils literal notranslate\">ArrayField</code> (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/25666\">#25666</a>).</p></li>\n<li><p>Fixed <code class=\"docutils literal notranslate\">Model.refresh_from_db()</code> updating of <code class=\"docutils literal notranslate\">ForeignKey</code> fields with\n<code class=\"docutils literal notranslate\">on_delete=models.SET_NULL</code> (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/25715\">#25715</a>).</p></li>\n<li><p>Fixed a duplicate query regression in 1.8 on proxied model deletion\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/25685\">#25685</a>).</p></li>\n<li><p>Fixed <code class=\"docutils literal notranslate\">set_FOO_order()</code> crash when the <code class=\"docutils literal notranslate\">ForeignKey</code> of a model with\n<code class=\"docutils literal notranslate\">order_with_respect_to</code> references a model with a <code class=\"docutils literal notranslate\">OneToOneField</code>\nprimary key (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/25786\">#25786</a>).</p></li>\n<li><p>Fixed incorrect validation for <code class=\"docutils literal notranslate\">PositiveIntegerField</code> and\n<code class=\"docutils literal notranslate\">PositiveSmallIntegerField</code> on MySQL resulting in values greater than\n4294967295 or 65535, respectively, passing validation and being silently\ntruncated by the database (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/25767\">#25767</a>).</p></li>\n</ul>\n</section>","rootId":"django-1-8-7-release-notes","toc":[{"title":"Fixed settings leak possibility in date template filter","anchor":"fixed-settings-leak-possibility-in-date-template-filter","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/1.8.8","title":"Django 1.8.8 release notes","url":"/en/dev/releases/1.8.8/"},"next":{"docname":"releases/1.8.6","title":"Django 1.8.6 release notes","url":"/en/dev/releases/1.8.6/"},"formats":{"html":"/en/dev/releases/1.8.7/","markdown":"/en/dev/releases/1.8.7.md","json":"/en/dev/releases/1.8.7.json"},"source":"https://github.com/django/django/blob/main/docs/releases/1.8.7.txt","official":"https://docs.djangoproject.com/en/dev/releases/1.8.7/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11","1.10","1.9","1.8"],"inLocales":["en"]}