Catatan terbitan Django 1.7.6Link to this heading#

Mitigated an XSS attack via properties in ModelAdmin.readonly_fieldsLink to this heading#

The ModelAdmin.readonly_fields attribute in the Django admin allows displaying model fields and model attributes. While the former were correctly escaped, the latter were not. Thus untrusted content could be injected into the admin, presenting an exploitation vector for XSS attacks.

In this vulnerability, every model attribute used in readonly_fields that is not an actual model field (e.g. a property) will fail to be escaped even if that attribute is not marked as safe. In this release, autoescaping is now correctly applied.

Perbaikan kesalahanLink to this heading#

• Fixed crash when coercing ManyRelatedManager to a string (#24352).

• Fixed a bug that prevented migrations from adding a foreign key constraint when converting an existing field to a foreign key (#24447).