{"title":"Django 4.2.1 release notes","version":"dev","locale":"en","docname":"releases/4.2.1","url":"/en/dev/releases/4.2.1/","canonical":"https://djangodocs.dev/en/dev/releases/4.2.1/","summary":"Django 4.2.1 fixes a security issue with severity “low” and several bugs in 4.2.","html":"

Django 4.2.1 release notesLink to this heading#

\n

May 3, 2023

\n

Django 4.2.1 fixes a security issue with severity “low” and several bugs in\n4.2.

\n

\n

CVE-2023-31047: Potential bypass of validation when uploading multiple files using one form fieldLink to this heading#

\n

Uploading multiple files using one form field has never been supported by\nforms.FileField or forms.ImageField as only the last\nuploaded file was validated. Unfortunately, Uploading multiple files\ntopic suggested otherwise.

\n

In order to avoid the vulnerability, ClearableFileInput\nand FileInput form widgets now raise ValueError when\nthe multiple HTML attribute is set on them. To prevent the exception and\nkeep the old behavior, set allow_multiple_selected to True.

\n

For more details on using the new attribute and handling of multiple files\nthrough a single field, see Uploading multiple files.

\n

\n

\n

BugfixesLink to this heading#

\n

Fixed a regression in Django 4.2 that caused a crash of QuerySet.defer()\nwhen deferring fields by attribute names (#34458).
Fixed a regression in Django 4.2 that caused a crash of\nSearchVector function with %\ncharacters (#34459).
Fixed a regression in Django 4.2 that caused aggregation over query that\nuses explicit grouping to group against the wrong columns (#34464).
Reallowed, following a regression in Django 4.2, setting the\n"cursor_factory" option in OPTIONS on PostgreSQL\n(#34466).
Enforced UTF-8 client encoding on PostgreSQL, following a regression in\nDjango 4.2 (#34470).
Fixed a regression in Django 4.2 where i18n_patterns() didn’t respect the\nprefix_default_language argument when a fallback language of the default\nlanguage was used (#34455).
Fixed a regression in Django 4.2 where translated URLs of the default\nlanguage from i18n_patterns() with prefix_default_language set to\nFalse raised 404 errors for a request with a different language\n(#34515).
Fixed a regression in Django 4.2 where creating copies and deep copies of\nHttpRequest, HttpResponse, and their subclasses didn’t always work\ncorrectly (#34482, #34484).
Fixed a regression in Django 4.2 where timesince and timeuntil\ntemplate filters returned incorrect results for a datetime with a non-UTC\ntimezone when a time difference is less than 1 day (#34483).
Fixed a regression in Django 4.2 that caused a crash of\nSearchHeadline function with\npsycopg 3 (#34486).
Fixed a regression in Django 4.2 that caused incorrect ClearableFileInput\nmargins in the admin (#34506).
Fixed a regression in Django 4.2 where breadcrumbs didn’t appear on admin\nsite app index views (#34512).
Made squashing migrations reduce AddIndex, RemoveIndex,\nRenameIndex, and CreateModel operations which allows removing a\ndeprecated Meta.index_together option from historical migrations and use\nMeta.indexes instead (#34525).

\n

","rootId":"django-4-2-1-release-notes","toc":[{"title":"CVE-2023-31047: Potential bypass of validation when uploading multiple files using one form field","anchor":"cve-2023-31047-potential-bypass-of-validation-when-uploading-multiple-files-using-one-form-field","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/4.2.2","title":"Django 4.2.2 release notes","url":"/en/dev/releases/4.2.2/"},"next":{"docname":"releases/4.2","title":"Django 4.2 release notes","url":"/en/dev/releases/4.2/"},"formats":{"html":"/en/dev/releases/4.2.1/","markdown":"/en/dev/releases/4.2.1.md","json":"/en/dev/releases/4.2.1.json"},"source":"https://github.com/django/django/blob/main/docs/releases/4.2.1.txt","official":"https://docs.djangoproject.com/en/dev/releases/4.2.1/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2"],"inLocales":["en"]}