---
title: "Catatan terbitan Django 1.7.10"
version: 4.2
locale: id
source: https://docs.djangoproject.com/id/4.2/releases/1.7.10/
canonical: https://djangodocs.dev/id/4.2/releases/1.7.10/
---
# Catatan terbitan Django 1.7.10

*Agustus 18, 2015*

Django 1.7.10 memperbaiki masalah keamanan di 1.7.9.

## Kemungkinan denial-of-service dalam tampilan `logout()` dengan mengisi sesi toko

Previously, a session could be created when anonymously accessing the
`django.contrib.auth.views.logout()` view (provided it wasn't decorated
with [`login_required()`](/id/4.2/topics/auth/default/#django.contrib.auth.decorators.login_required) as done in the
admin). This could allow an attacker to easily create many new session records
by sending repeated requests, potentially filling up the session store or
causing other users' session records to be evicted.

[`SessionMiddleware`](/id/4.2/ref/middleware/#django.contrib.sessions.middleware.SessionMiddleware) telah dirubah menjadi tidak lagi membuat rekaman sesi kosong, termasuk ketika [`SESSION_SAVE_EVERY_REQUEST`](/id/4.2/ref/settings/#std-setting-SESSION_SAVE_EVERY_REQUEST) aktif.

Selain itu, metode `contrib.sessions.backends.base.SessionBase.flush()` dan `cache_db.SessionStore.flush()` telah dirubah untuk menghindari membuat sesi kosong baru. Perawat dari backend sesi pihak-ketiga harus memeriksa jika kerentanan sama hadir di backend mereka dan memperbaiki itu kalai demikian.