---
title: "Catatan terbitan Django 1.7.6"
version: 1.9
locale: id
source: https://docs.djangoproject.com/id/1.9/releases/1.7.6/
canonical: https://djangodocs.dev/id/1.9/releases/1.7.6/
---
# Catatan terbitan Django 1.7.6

*Maret 9, 2015*

Django 1.7.6 memperbaiki beberapa kesalahan dan masalah keamanan di 1.7.5.

## Mitigated an XSS attack via properties in `ModelAdmin.readonly_fields`

The [`ModelAdmin.readonly_fields`](/id/1.9/ref/contrib/admin/#django.contrib.admin.ModelAdmin.readonly_fields) attribute in the Django
admin allows displaying model fields and model attributes. While the former
were correctly escaped, the latter were not. Thus untrusted content could be
injected into the admin, presenting an exploitation vector for XSS attacks.

In this vulnerability, every model attribute used in `readonly_fields` that
is not an actual model field (e.g. a [`property`](https://docs.python.org/3/library/functions.html#property)) will **fail to be
escaped** even if that attribute is not marked as safe. In this release,
autoescaping is now correctly applied.

## Perbaikan kesalahan

- Fixed crash when coercing `ManyRelatedManager` to a string
  ([#24352](https://code.djangoproject.com/ticket/24352)).
- Fixed a bug that prevented migrations from adding a foreign key constraint
  when converting an existing field to a foreign key ([#24447](https://code.djangoproject.com/ticket/24447)).