{"title":"Django 4.0.2 release notes","version":"dev","locale":"en","docname":"releases/4.0.2","url":"/en/dev/releases/4.0.2/","canonical":"https://djangodocs.dev/en/dev/releases/4.0.2/","summary":"Django 4.0.2 fixes two security issues with severity “medium” and several bugs in 4.0.1.","html":"<h1>Django 4.0.2 release notes<a class=\"heading-anchor\" href=\"#django-4-0-2-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>February 1, 2022</em></p>\n<p>Django 4.0.2 fixes two security issues with severity “medium” and several bugs\nin 4.0.1. Also, the latest string translations from Transifex are incorporated,\nwith a special mention for Bulgarian (fully translated).</p>\n<section id=\"cve-2022-22818-possible-xss-via-debug-template-tag\">\n<h2>CVE-2022-22818: Possible XSS via <code class=\"docutils literal notranslate\">{% debug %}</code> template tag<a class=\"heading-anchor\" href=\"#cve-2022-22818-possible-xss-via-debug-template-tag\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>The <code class=\"docutils literal notranslate\">{% debug %}</code> template tag didn’t properly encode the current context,\nposing an XSS attack vector.</p>\n<p>In order to avoid this vulnerability, <code class=\"docutils literal notranslate\">{% debug %}</code> no longer outputs\ninformation when the <code class=\"docutils literal notranslate\">DEBUG</code> setting is <code class=\"docutils literal notranslate\">False</code>, and it ensures all context\nvariables are correctly escaped when the <code class=\"docutils literal notranslate\">DEBUG</code> setting is <code class=\"docutils literal notranslate\">True</code>.</p>\n</section>\n<section id=\"cve-2022-23833-denial-of-service-possibility-in-file-uploads\">\n<h2>CVE-2022-23833: Denial-of-service possibility in file uploads<a class=\"heading-anchor\" href=\"#cve-2022-23833-denial-of-service-possibility-in-file-uploads\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>Passing certain inputs to multipart forms could result in an infinite loop when\nparsing files.</p>\n</section>\n<section id=\"bugfixes\">\n<h2>Bugfixes<a class=\"heading-anchor\" href=\"#bugfixes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<ul class=\"simple\">\n<li><p>Fixed a bug in Django 4.0 where <code class=\"docutils literal notranslate\">TestCase.captureOnCommitCallbacks()</code> could\nexecute callbacks multiple times (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/33410\">#33410</a>).</p></li>\n<li><p>Fixed a regression in Django 4.0 where <code class=\"docutils literal notranslate\">help_text</code> was HTML-escaped in\nautomatically-generated forms (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/33419\">#33419</a>).</p></li>\n<li><p>Fixed a regression in Django 4.0 that caused displaying an incorrect name for\nclass-based views on the technical 404 debug page (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/33425\">#33425</a>).</p></li>\n<li><p>Fixed a regression in Django 4.0 that caused an incorrect <code class=\"docutils literal notranslate\">repr</code> of\n<code class=\"docutils literal notranslate\">ResolverMatch</code> for class-based views (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/33426\">#33426</a>).</p></li>\n<li><p>Fixed a regression in Django 4.0 that caused a crash of <code class=\"docutils literal notranslate\">makemigrations</code> on\nmodels without <code class=\"docutils literal notranslate\">Meta.order_with_respect_to</code> but with a field named\n<code class=\"docutils literal notranslate\">_order</code> (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/33449\">#33449</a>).</p></li>\n<li><p>Fixed a regression in Django 4.0 that caused incorrect\n<a class=\"reference internal\" href=\"/en/dev/ref/contrib/admin/#django.contrib.admin.ModelAdmin.radio_fields\" title=\"django.contrib.admin.ModelAdmin.radio_fields\"><code class=\"xref py py-attr docutils literal notranslate\">ModelAdmin.radio_fields</code></a> layout in the admin (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/33407\">#33407</a>).</p></li>\n<li><p>Fixed a duplicate operation regression in Django 4.0 that caused a migration\ncrash when altering a primary key type for a concrete parent model referenced\nby a foreign key (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/33462\">#33462</a>).</p></li>\n<li><p>Fixed a bug in Django 4.0 that caused a crash of <code class=\"docutils literal notranslate\">QuerySet.aggregate()</code>\nafter <code class=\"docutils literal notranslate\">annotate()</code> on an aggregate function with a\n<a class=\"reference internal\" href=\"/en/dev/ref/models/querysets/#aggregate-default\"><span class=\"std std-ref\">default</span></a> (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/33468\">#33468</a>).</p></li>\n<li><p>Fixed a regression in Django 4.0 that caused a crash of <code class=\"docutils literal notranslate\">makemigrations</code>\nwhen renaming a field of a renamed model (<a class=\"extlink-ticket reference external\" href=\"https://code.djangoproject.com/ticket/33480\">#33480</a>).</p></li>\n</ul>\n</section>","rootId":"django-4-0-2-release-notes","toc":[{"title":"CVE-2022-22818: Possible XSS via {% debug %} template tag","anchor":"cve-2022-22818-possible-xss-via-debug-template-tag","children":[]},{"title":"CVE-2022-23833: Denial-of-service possibility in file uploads","anchor":"cve-2022-23833-denial-of-service-possibility-in-file-uploads","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/4.0.3","title":"Django 4.0.3 release notes","url":"/en/dev/releases/4.0.3/"},"next":{"docname":"releases/4.0.1","title":"Django 4.0.1 release notes","url":"/en/dev/releases/4.0.1/"},"formats":{"html":"/en/dev/releases/4.0.2/","markdown":"/en/dev/releases/4.0.2.md","json":"/en/dev/releases/4.0.2.json"},"source":"https://github.com/django/django/blob/main/docs/releases/4.0.2.txt","official":"https://docs.djangoproject.com/en/dev/releases/4.0.2/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0"],"inLocales":["en"]}