{"title":"Django 2.1.2 release notes","version":"dev","locale":"en","docname":"releases/2.1.2","url":"/en/dev/releases/2.1.2/","canonical":"https://djangodocs.dev/en/dev/releases/2.1.2/","summary":"Django 2.1.2 fixes a security issue and several bugs in 2.1.1. Also, the latest string translations from Transifex are incorporated.","html":"<h1>Django 2.1.2 release notes<a class=\"heading-anchor\" href=\"#django-2-1-2-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>October 1, 2018</em></p>\n<p>Django 2.1.2 fixes a security issue and several bugs in 2.1.1. Also, the latest\nstring translations from Transifex are incorporated.</p>\n<section id=\"cve-2018-16984-password-hash-disclosure-to-view-only-admin-users\">\n<h2>CVE-2018-16984: Password hash disclosure to “view only” admin users<a class=\"heading-anchor\" href=\"#cve-2018-16984-password-hash-disclosure-to-view-only-admin-users\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>If an admin user has the change permission to the user model, only part of the\npassword hash is displayed in the change form. Admin users with the view (but\nnot change) permission to the user model were displayed the entire hash. While\nit’s typically infeasible to reverse a strong password hash, if your site uses\nweaker password hashing algorithms such as MD5 or SHA1, it could be a problem.</p>\n</section>\n<section id=\"bugfixes\">\n<h2>Bugfixes<a class=\"heading-anchor\" href=\"#bugfixes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<ul class=\"simple\">\n<li><p>Fixed a regression where nonexistent joins in <code class=\"docutils literal notranslate\">F()</code> no longer raised\n<code class=\"docutils literal notranslate\">FieldError</code> (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/29727\">#29727</a>).</p></li>\n<li><p>Fixed a regression where files starting with a tilde or underscore weren’t\nignored by the migrations loader (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/29749\">#29749</a>).</p></li>\n<li><p>Made migrations detect changes to <code class=\"docutils literal notranslate\">Meta.default_related_name</code>\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/29755\">#29755</a>).</p></li>\n<li><p>Added compatibility for <code class=\"docutils literal notranslate\">cx_Oracle</code> 7 (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/29759\">#29759</a>).</p></li>\n<li><p>Fixed a regression in Django 2.0 where unique index names weren’t quoted\n(<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/29778\">#29778</a>).</p></li>\n<li><p>Fixed a regression where sliced queries with multiple columns with the same\nname crashed on Oracle 12.1 (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/29630\">#29630</a>).</p></li>\n<li><p>Fixed a crash when a user with the view (but not change) permission made a\nPOST request to an admin user change form (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/29809\">#29809</a>).</p></li>\n</ul>\n</section>","rootId":"django-2-1-2-release-notes","toc":[{"title":"CVE-2018-16984: Password hash disclosure to “view only” admin users","anchor":"cve-2018-16984-password-hash-disclosure-to-view-only-admin-users","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/2.1.3","title":"Django 2.1.3 release notes","url":"/en/dev/releases/2.1.3/"},"next":{"docname":"releases/2.1.1","title":"Django 2.1.1 release notes","url":"/en/dev/releases/2.1.1/"},"formats":{"html":"/en/dev/releases/2.1.2/","markdown":"/en/dev/releases/2.1.2.md","json":"/en/dev/releases/2.1.2.json"},"source":"https://github.com/django/django/blob/main/docs/releases/2.1.2.txt","official":"https://docs.djangoproject.com/en/dev/releases/2.1.2/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1"],"inLocales":["en"]}