---
title: "Django 1.5.2 release notes"
version: 2.0
locale: es
source: https://docs.djangoproject.com/es/2.0/releases/1.5.2/
canonical: https://djangodocs.dev/es/2.0/releases/1.5.2/
---
# Django 1.5.2 release notes

*August 13, 2013*

This is Django 1.5.2, a bugfix and security release for Django 1.5.

## Mitigated possible XSS attack via user-supplied redirect URLs

Django relies on user input in some cases (e.g.
[`django.contrib.auth.views.login()`](/es/2.0/topics/auth/default/#django.contrib.auth.views.login), `django.contrib.comments`, and
[i18n](/es/2.0/topics/i18n/)) to redirect the user to an «on success» URL.
The security checks for these redirects (namely
`django.utils.http.is_safe_url()`) didn’t check if the scheme is `http(s)`
and as such allowed `javascript:...` URLs to be entered. If a developer
relied on `is_safe_url()` to provide safe redirect targets and put such a
URL into a link, they could suffer from a XSS attack. This bug doesn’t affect
Django currently, since we only put this URL into the `Location` response
header and browsers seem to ignore JavaScript there.

## XSS vulnerability in [`django.contrib.admin`](/es/2.0/ref/contrib/admin/#module-django.contrib.admin)

If a [`URLField`](/es/2.0/ref/models/fields/#django.db.models.URLField) is used in Django 1.5, it displays the
current value of the field and a link to the target on the admin change page.
The display routine of this widget was flawed and allowed for XSS.

## Bugfixes

- Fixed a crash with [`prefetch_related()`](/es/2.0/ref/models/querysets/#django.db.models.query.QuerySet.prefetch_related)
  (#19607) as well as some `pickle` regressions with `prefetch_related`
  (#20157 and #20257).
- Fixed a regression in [`django.contrib.gis`](/es/2.0/ref/contrib/gis/#module-django.contrib.gis) in the Google Map output on
  Python 3 (#20773).
- Made `DjangoTestSuiteRunner.setup_databases` properly handle aliases for
  the default database (#19940) and prevented `teardown_databases` from
  attempting to tear down aliases (#20681).
- Fixed the `django.core.cache.backends.memcached.MemcachedCache` backend’s
  `get_many()` method on Python 3 (#20722).
- Fixed [`django.contrib.humanize`](/es/2.0/ref/contrib/humanize/#module-django.contrib.humanize) translation syntax errors. Affected
  languages: Mexican Spanish, Mongolian, Romanian, Turkish (#20695).
- Added support for wheel packages (#19252).
- The CSRF token now rotates when a user logs in.
- Some Python 3 compatibility fixes including #20212 and #20025.
- Fixed some rare cases where [`get()`](/es/2.0/ref/models/querysets/#django.db.models.query.QuerySet.get)
  exceptions recursed infinitely (#20278).
- [`makemessages`](/es/2.0/ref/django-admin/#django-admin-makemessages) no longer crashes with `UnicodeDecodeError`
  (#20354).
- Fixed `geojson` detection with SpatiaLite.
- [`assertContains()`](/es/2.0/topics/testing/tools/#django.test.SimpleTestCase.assertContains) once again works with
  binary content (#20237).
- Fixed [`ManyToManyField`](/es/2.0/ref/models/fields/#django.db.models.ManyToManyField) if it has a unicode `name`
  parameter (#20207).
- Ensured that the WSGI request’s path is correctly based on the
  `SCRIPT_NAME` environment variable or the [`FORCE_SCRIPT_NAME`](/es/2.0/ref/settings/#std-setting-FORCE_SCRIPT_NAME)
  setting, regardless of whether or not either has a trailing slash (#20169).
- Fixed an obscure bug with the [`override_settings()`](/es/2.0/topics/testing/tools/#django.test.override_settings)
  decorator. If you hit an `AttributeError: 'Settings' object has no attribute
  '_original_allowed_hosts'` exception, it’s probably fixed (#20636).