---
title: "Note di rilascio di Django 3.0.4"
version: 4.1
locale: it
source: https://docs.djangoproject.com/it/4.1/releases/3.0.4/
canonical: https://djangodocs.dev/it/4.1/releases/3.0.4/
---
# Note di rilascio di Django 3.0.4

*4 Marzo 2020*

Django 3.0.4 risolve un problema di sicurezza e alcuni bug in 3.0.3.

## CVE-2020-9402: Potential SQL injection via `tolerance` parameter in GIS functions and aggregates on Oracle

GIS functions and aggregates on Oracle were subject to SQL injection,
using a suitably crafted `tolerance`.

## Correzioni di bug

- Fixed a data loss possibility when using caching from async code
  ([#31253](https://code.djangoproject.com/ticket/31253)).
- Fixed a regression in Django 3.0 that caused a file response using a
  temporary file to be closed incorrectly ([#31240](https://code.djangoproject.com/ticket/31240)).
- Fixed a data loss possibility in the
  [`select_for_update()`](/it/4.1/ref/models/querysets/#django.db.models.query.QuerySet.select_for_update). When using
  related fields or parent link fields with [Multi-table inheritance](/it/4.1/topics/db/models/#multi-table-inheritance) in
  the `of` argument, the corresponding models were not locked
  ([#31246](https://code.djangoproject.com/ticket/31246)).
- Fixed a regression in Django 3.0 that caused misplacing parameters in logged
  SQL queries on Oracle ([#31271](https://code.djangoproject.com/ticket/31271)).
- Fixed a regression in Django 3.0.3 that caused misplacing parameters of SQL
  queries when subtracting `DateField` or `DateTimeField` expressions on
  MySQL ([#31312](https://code.djangoproject.com/ticket/31312)).
- Fixed a regression in Django 3.0 that didn’t include subqueries spanning
  multivalued relations in the `GROUP BY` clause ([#31150](https://code.djangoproject.com/ticket/31150)).