---
title: "Nótaí scaoilte Django 4.0.4"
version: 5.2
locale: ga
source: https://docs.djangoproject.com/ga/5.2/releases/4.0.4/
canonical: https://djangodocs.dev/ga/5.2/releases/4.0.4/
---
# Nótaí scaoilte Django 4.0.4

*Aibreán 11, 2022*

Socraíonn Django 4.0.4 dhá shaincheist slándála le déine “ard” agus dhá fhabhta i 4.0.3.

## CVE-2022-28346: Instealladh SQL féideartha i ```QuerySet.annotate () ``, `comhiomlán ()```, agus `` extra () ` ``

[`QuerySet.annotate()`](/ga/5.2/ref/models/querysets/#django.db.models.query.QuerySet.annotate), [`aggregate()`](/ga/5.2/ref/models/querysets/#django.db.models.query.QuerySet.aggregate), and
[`extra()`](/ga/5.2/ref/models/querysets/#django.db.models.query.QuerySet.extra) methods were subject to SQL injection in column
aliases, using a suitably crafted dictionary, with dictionary expansion, as the
`**kwargs` passed to these methods.

## CVE-2022-28347: Instealladh SQL féideartha trí QuerySet.Explain (\*\* roghanna) ar PostgreSQL

[`QuerySet.explain()`](/ga/5.2/ref/models/querysets/#django.db.models.query.QuerySet.explain) method was subject to SQL injection in option names,
using a suitably crafted dictionary, with dictionary expansion, as the
`**options` argument.

## Buigdheisiúcháin

- Socraigh aischéimniú i Django 4.0 a d'fhág neamhaird a dhéanamh ar chaidrimh iolracha FilteredRelation () leis an réimse céanna (:ticket: \`33598).
- Socraigh aischéimniú i Django 3.2.4 a d'fhág nach bhrath an t-athluchtaireoir athruithe a thuilleadh nuair a bhí teaghrán folamh sa rogha DIRS den socrú `TEMPLATES` (:ticket: 33628).