Nótaí scaoilte Django 4.0.4Link to this heading
Aibreán 11, 2022
Socraíonn Django 4.0.4 dhá shaincheist slándála le déine “ard” agus dhá fhabhta i 4.0.3.
CVE-2022-28346: Instealladh SQL féideartha i QuerySet.annotate () ``, `comhiomlán (), agus extra () `Link to this heading
QuerySet.annotate(), aggregate(), and
extra() methods were subject to SQL injection in column
aliases, using a suitably crafted dictionary, with dictionary expansion, as the
**kwargs passed to these methods.
CVE-2022-28347: Instealladh SQL féideartha trí ``QuerySet.Explain (** roghanna) ``ar PostgreSQLLink to this heading
QuerySet.explain() method was subject to SQL injection in option names,
using a suitably crafted dictionary, with dictionary expansion, as the
**options argument.
BuigdheisiúcháinLink to this heading
Socraigh aischéimniú i Django 4.0 a d'fhág neamhaird a dhéanamh ar chaidrimh iolracha ``FilteredRelation () leis an réimse céanna (:ticket: `33598).
Socraigh aischéimniú i Django 3.2.4 a d'fhág nach bhrath an t-athluchtaireoir athruithe a thuilleadh nuair a bhí teaghrán folamh sa rogha DIRS den socrú
TEMPLATES(:ticket: 33628).