{"title":"Django 1.9.2 release notes","version":"dev","locale":"en","docname":"releases/1.9.2","url":"/en/dev/releases/1.9.2/","canonical":"https://djangodocs.dev/en/dev/releases/1.9.2/","summary":"Django 1.9.2 fixes a security regression in 1.9 and several bugs in 1.9.1. It also makes a small backwards incompatible change that hopefully doesn’t affect…","html":"<h1>Django 1.9.2 release notes<a class=\"heading-anchor\" href=\"#django-1-9-2-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>February 1, 2016</em></p>\n<p>Django 1.9.2 fixes a security regression in 1.9 and several bugs in 1.9.1. It\nalso makes a small backwards incompatible change that hopefully doesn’t affect\nany users.</p>\n<section id=\"security-issue-user-with-change-but-not-add-permission-can-create-objects-for-modeladmins-with-save-as-true\">\n<h2>Security issue: User with “change” but not “add” permission can create objects for <code class=\"docutils literal notranslate\">ModelAdmin</code>’s with <code class=\"docutils literal notranslate\">save_as=True</code><a class=\"heading-anchor\" href=\"#security-issue-user-with-change-but-not-add-permission-can-create-objects-for-modeladmins-with-save-as-true\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>If a <code class=\"docutils literal notranslate\">ModelAdmin</code> uses <code class=\"docutils literal notranslate\">save_as=True</code> (not the default), the admin\nprovides an option when editing objects to “Save as new”. A regression in\nDjango 1.9 prevented that form submission from raising a “Permission Denied”\nerror for users without the “add” permission.</p>\n</section>\n<section id=\"backwards-incompatible-change-py-tpl-files-rewritten-in-project-app-templates\">\n<h2>Backwards incompatible change: <code class=\"docutils literal notranslate\">.py-tpl</code> files rewritten in project/app templates<a class=\"heading-anchor\" href=\"#backwards-incompatible-change-py-tpl-files-rewritten-in-project-app-templates\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>The addition of some Django template language syntax to the default app\ntemplate in Django 1.9 means those files now have some invalid Python syntax.\nThis causes difficulties for packaging systems that unconditionally\nbyte-compile <code class=\"docutils literal notranslate\">*.py</code> files.</p>\n<p>To remedy this, a <code class=\"docutils literal notranslate\">.py-tpl</code> suffix is now used for the project and app\ntemplate files included in Django. The <code class=\"docutils literal notranslate\">.py-tpl</code> suffix is replaced with\n<code class=\"docutils literal notranslate\">.py</code> by the <code class=\"docutils literal notranslate\">startproject</code> and <code class=\"docutils literal notranslate\">startapp</code> commands. For example, a\ntemplate with the filename <code class=\"docutils literal notranslate\">manage.py-tpl</code> will be created as <code class=\"docutils literal notranslate\">manage.py</code>.</p>\n<p>Please file a ticket if you have a custom project template containing\n<code class=\"docutils literal notranslate\">.py-tpl</code> files and find this behavior problematic.</p>\n</section>\n<section id=\"bugfixes\">\n<h2>Bugfixes<a class=\"heading-anchor\" href=\"#bugfixes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<ul class=\"simple\">\n<li><p>Fixed a regression in <code class=\"docutils literal notranslate\">ConditionalGetMiddleware</code> causing <code class=\"docutils literal notranslate\">If-None-Match</code>\nchecks to always return HTTP 200 (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/26024\">#26024</a>).</p></li>\n<li><p>Fixed a regression that caused the “user-tools” items to display on the\nadmin’s logout page (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/26035\">#26035</a>).</p></li>\n<li><p>Fixed a crash in the translations system when the current language has no\ntranslations (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/26046\">#26046</a>).</p></li>\n<li><p>Fixed a regression that caused the incorrect day to be selected when opening\nthe admin calendar widget for timezones from GMT+0100 to GMT+1200\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/24980\">#24980</a>).</p></li>\n<li><p>Fixed a regression in the admin’s edit related model popup that caused an\nescaped value to be displayed in the select dropdown of the parent window\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/25997\">#25997</a>).</p></li>\n<li><p>Fixed a regression in 1.8.8 causing incorrect index handling in migrations on\nPostgreSQL when adding <code class=\"docutils literal notranslate\">db_index=True</code> or <code class=\"docutils literal notranslate\">unique=True</code> to a\n<code class=\"docutils literal notranslate\">CharField</code> or <code class=\"docutils literal notranslate\">TextField</code> that already had the other specified, or when\nremoving one of them from a field that had both, or when adding\n<code class=\"docutils literal notranslate\">unique=True</code> to a field already listed in <code class=\"docutils literal notranslate\">unique_together</code>\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/26034\">#26034</a>).</p></li>\n<li><p>Fixed a regression where defining a relation on an abstract model’s field\nusing a string model name without an app_label no longer resolved that\nreference to the abstract model’s app if using that model in another\napplication (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/25858\">#25858</a>).</p></li>\n<li><p>Fixed a crash when destroying an existing test database on MySQL or\nPostgreSQL (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/26096\">#26096</a>).</p></li>\n<li><p>Fixed CSRF cookie check on POST requests when <code class=\"docutils literal notranslate\">USE_X_FORWARDED_PORT=True</code>\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/26094\">#26094</a>).</p></li>\n<li><p>Fixed a <code class=\"docutils literal notranslate\">QuerySet.order_by()</code> crash when ordering by a relational field of\na <code class=\"docutils literal notranslate\">ManyToManyField</code> <code class=\"docutils literal notranslate\">through</code> model (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/26092\">#26092</a>).</p></li>\n<li><p>Fixed a regression that caused an exception when making database queries on\nSQLite with more than 2000 parameters when <a class=\"reference internal\" href=\"/en/dev/ref/settings/#std-setting-DEBUG\"><code class=\"xref std std-setting docutils literal notranslate\">DEBUG</code></a> is <code class=\"docutils literal notranslate\">True</code> on\ndistributions that increase the <code class=\"docutils literal notranslate\">SQLITE_MAX_VARIABLE_NUMBER</code> compile-time\nlimit to over 2000, such as Debian (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/26063\">#26063</a>).</p></li>\n<li><p>Fixed a crash when using a reverse <code class=\"docutils literal notranslate\">OneToOneField</code> in\n<code class=\"docutils literal notranslate\">ModelAdmin.readonly_fields</code> (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/26060\">#26060</a>).</p></li>\n<li><p>Fixed a crash when calling the <code class=\"docutils literal notranslate\">migrate</code> command in a test case with the\n<code class=\"docutils literal notranslate\">available_apps</code> attribute pointing to an application with migrations\ndisabled using the <code class=\"docutils literal notranslate\">MIGRATION_MODULES</code> setting (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/26135\">#26135</a>).</p></li>\n<li><p>Restored the ability for testing and debugging tools to determine the\ntemplate from which a node came from, even during template inheritance or\ninclusion. Prior to Django 1.9, debugging tools could access the template\norigin from the node via <code class=\"docutils literal notranslate\">Node.token.source[0]</code>. This was an undocumented,\nprivate API. The origin is now available directly on each node using the\n<code class=\"docutils literal notranslate\">Node.origin</code> attribute (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/25848\">#25848</a>).</p></li>\n<li><p>Fixed a regression in Django 1.8.5 that broke copying a <code class=\"docutils literal notranslate\">SimpleLazyObject</code>\nwith <code class=\"docutils literal notranslate\">copy.copy()</code> (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/26122\">#26122</a>).</p></li>\n<li><p>Always included <code class=\"docutils literal notranslate\">geometry_field</code> in the GeoJSON serializer output\nregardless of the <code class=\"docutils literal notranslate\">fields</code> parameter (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/26138\">#26138</a>).</p></li>\n<li><p>Fixed the <code class=\"docutils literal notranslate\">contrib.gis</code> map widgets when using\n<code class=\"docutils literal notranslate\">USE_THOUSAND_SEPARATOR=True</code> (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/20415\">#20415</a>).</p></li>\n<li><p>Made invalid forms display the initial of values of their disabled fields\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/26129\">#26129</a>).</p></li>\n</ul>\n</section>","rootId":"django-1-9-2-release-notes","toc":[{"title":"Security issue: User with “change” but not “add” permission can create objects for ModelAdmin’s with save_as=True","anchor":"security-issue-user-with-change-but-not-add-permission-can-create-objects-for-modeladmins-with-save-as-true","children":[]},{"title":"Backwards incompatible change: .py-tpl files rewritten in project/app templates","anchor":"backwards-incompatible-change-py-tpl-files-rewritten-in-project-app-templates","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/1.9.3","title":"Django 1.9.3 release notes","url":"/en/dev/releases/1.9.3/"},"next":{"docname":"releases/1.9.1","title":"Django 1.9.1 release notes","url":"/en/dev/releases/1.9.1/"},"formats":{"html":"/en/dev/releases/1.9.2/","markdown":"/en/dev/releases/1.9.2.md","json":"/en/dev/releases/1.9.2.json"},"source":"https://github.com/django/django/blob/main/docs/releases/1.9.2.txt","official":"https://docs.djangoproject.com/en/dev/releases/1.9.2/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11","1.10","1.9"],"inLocales":["en"]}