{"title":"Django 2.0.2 release notes","version":"dev","locale":"en","docname":"releases/2.0.2","url":"/en/dev/releases/2.0.2/","canonical":"https://djangodocs.dev/en/dev/releases/2.0.2/","summary":"Django 2.0.2 fixes a security issue and several bugs in 2.0.1. A regression in Django 1.11.8 made AuthenticationForm run its confirm_login_allowed() method…","html":"<h1>Django 2.0.2 release notes<a class=\"heading-anchor\" href=\"#django-2-0-2-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>February 1, 2018</em></p>\n<p>Django 2.0.2 fixes a security issue and several bugs in 2.0.1.</p>\n<section id=\"cve-2018-6188-information-leakage-in-authenticationform\">\n<h2>CVE-2018-6188: Information leakage in <code class=\"docutils literal notranslate\">AuthenticationForm</code><a class=\"heading-anchor\" href=\"#cve-2018-6188-information-leakage-in-authenticationform\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>A regression in Django 1.11.8 made\n<a class=\"reference internal\" href=\"/en/dev/topics/auth/default/#django.contrib.auth.forms.AuthenticationForm\" title=\"django.contrib.auth.forms.AuthenticationForm\"><code class=\"xref py py-class docutils literal notranslate\">AuthenticationForm</code></a> run its\n<code class=\"docutils literal notranslate\">confirm_login_allowed()</code> method even if an incorrect password is entered.\nThis can leak information about a user, depending on what messages\n<code class=\"docutils literal notranslate\">confirm_login_allowed()</code> raises. If <code class=\"docutils literal notranslate\">confirm_login_allowed()</code> isn’t\noverridden, an attacker enter an arbitrary username and see if that user has\nbeen set to <code class=\"docutils literal notranslate\">is_active=False</code>. If <code class=\"docutils literal notranslate\">confirm_login_allowed()</code> is overridden,\nmore sensitive details could be leaked.</p>\n<p>This issue is fixed with the caveat that <code class=\"docutils literal notranslate\">AuthenticationForm</code> can no longer\nraise the “This account is inactive.” error if the authentication backend\nrejects inactive users (the default authentication backend, <code class=\"docutils literal notranslate\">ModelBackend</code>,\nhas done that since Django 1.10). This issue will be revisited for Django 2.1\nas a fix to address the caveat will likely be too invasive for inclusion in\nolder versions.</p>\n</section>\n<section id=\"bugfixes\">\n<h2>Bugfixes<a class=\"heading-anchor\" href=\"#bugfixes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<ul class=\"simple\">\n<li><p>Fixed hidden content at the bottom of the “The install worked successfully!”\npage for some languages (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/28885\">#28885</a>).</p></li>\n<li><p>Fixed incorrect foreign key nullification if a model has two foreign keys to\nthe same model and a target model is deleted (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/29016\">#29016</a>).</p></li>\n<li><p>Fixed regression in the use of <code class=\"docutils literal notranslate\">QuerySet.values_list(..., flat=True)</code>\nfollowed by <code class=\"docutils literal notranslate\">annotate()</code> (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/29067\">#29067</a>).</p></li>\n<li><p>Fixed a regression where a queryset that annotates with geometry objects\ncrashes (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/29054\">#29054</a>).</p></li>\n<li><p>Fixed a regression where <code class=\"docutils literal notranslate\">contrib.auth.authenticate()</code> crashes if an\nauthentication backend doesn’t accept <code class=\"docutils literal notranslate\">request</code> and a later one does\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/29071\">#29071</a>).</p></li>\n<li><p>Fixed a regression where <code class=\"docutils literal notranslate\">makemigrations</code> crashes if a migrations directory\ndoesn’t have an <code class=\"docutils literal notranslate\">__init__.py</code> file (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/29091\">#29091</a>).</p></li>\n<li><p>Fixed crash when entering an invalid uuid in <code class=\"docutils literal notranslate\">ModelAdmin.raw_id_fields</code>\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/29094\">#29094</a>).</p></li>\n</ul>\n</section>","rootId":"django-2-0-2-release-notes","toc":[{"title":"CVE-2018-6188: Information leakage in AuthenticationForm","anchor":"cve-2018-6188-information-leakage-in-authenticationform","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/2.0.3","title":"Django 2.0.3 release notes","url":"/en/dev/releases/2.0.3/"},"next":{"docname":"releases/2.0.1","title":"Django 2.0.1 release notes","url":"/en/dev/releases/2.0.1/"},"formats":{"html":"/en/dev/releases/2.0.2/","markdown":"/en/dev/releases/2.0.2.md","json":"/en/dev/releases/2.0.2.json"},"source":"https://github.com/django/django/blob/main/docs/releases/2.0.2.txt","official":"https://docs.djangoproject.com/en/dev/releases/2.0.2/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0"],"inLocales":["en"]}