{"title":"Django 1.9.8 release notes","version":"dev","locale":"en","docname":"releases/1.9.8","url":"/en/dev/releases/1.9.8/","canonical":"https://djangodocs.dev/en/dev/releases/1.9.8/","summary":"Django 1.9.8 fixes a security issue and several bugs in 1.9.7. Unsafe usage of JavaScript’s Element.innerHTML could result in XSS in the admin’s add/change…","html":"<h1>Django 1.9.8 release notes<a class=\"heading-anchor\" href=\"#django-1-9-8-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>July 18, 2016</em></p>\n<p>Django 1.9.8 fixes a security issue and several bugs in 1.9.7.</p>\n<section id=\"xss-in-admin-s-add-change-related-popup\">\n<h2>XSS in admin’s add/change related popup<a class=\"heading-anchor\" href=\"#xss-in-admin-s-add-change-related-popup\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>Unsafe usage of JavaScript’s <code class=\"docutils literal notranslate\">Element.innerHTML</code> could result in XSS in the\nadmin’s add/change related popup. <code class=\"docutils literal notranslate\">Element.textContent</code> is now used to\nprevent execution of the data.</p>\n<p>The debug view also used <code class=\"docutils literal notranslate\">innerHTML</code>. Although a security issue wasn’t\nidentified there, out of an abundance of caution it’s also updated to use\n<code class=\"docutils literal notranslate\">textContent</code>.</p>\n</section>\n<section id=\"bugfixes\">\n<h2>Bugfixes<a class=\"heading-anchor\" href=\"#bugfixes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<ul class=\"simple\">\n<li><p>Fixed missing <code class=\"docutils literal notranslate\">varchar/text_pattern_ops</code> index on <code class=\"docutils literal notranslate\">CharField</code> and\n<code class=\"docutils literal notranslate\">TextField</code> respectively when using <code class=\"docutils literal notranslate\">AddField</code> on PostgreSQL\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/26889\">#26889</a>).</p></li>\n<li><p>Fixed <code class=\"docutils literal notranslate\">makemessages</code> crash on Python 2 with non-ASCII file names\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/26897\">#26897</a>).</p></li>\n</ul>\n</section>","rootId":"django-1-9-8-release-notes","toc":[{"title":"XSS in admin’s add/change related popup","anchor":"xss-in-admin-s-add-change-related-popup","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/1.9.9","title":"Django 1.9.9 release notes","url":"/en/dev/releases/1.9.9/"},"next":{"docname":"releases/1.9.7","title":"Django 1.9.7 release notes","url":"/en/dev/releases/1.9.7/"},"formats":{"html":"/en/dev/releases/1.9.8/","markdown":"/en/dev/releases/1.9.8.md","json":"/en/dev/releases/1.9.8.json"},"source":"https://github.com/django/django/blob/main/docs/releases/1.9.8.txt","official":"https://docs.djangoproject.com/en/dev/releases/1.9.8/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11","1.10","1.9"],"inLocales":["en"]}