---
title: "Django 1.7.11 release notes"
version: 2.2
locale: ko
source: https://docs.djangoproject.com/ko/2.2/releases/1.7.11/
canonical: https://djangodocs.dev/ko/2.2/releases/1.7.11/
---
# Django 1.7.11 release notes

*November 24, 2015*

Django 1.7.11 fixes a security issue and a data loss bug in 1.7.10.

## Fixed settings leak possibility in `date` template filter

If an application allows users to specify an unvalidated format for dates and
passes this format to the [`date`](/ko/2.2/ref/templates/builtins/#std-templatefilter-date) filter, e.g.
`{{ last_updated|date:user_date_format }}`, then a malicious user could
obtain any secret in the application’s settings by specifying a settings key
instead of a date format. e.g. `"SECRET_KEY"` instead of `"j/m/Y"`.

To remedy this, the underlying function used by the `date` template filter,
`django.utils.formats.get_format()`, now only allows accessing the date/time
formatting settings.

## Bugfixes

- Fixed a data loss possibility with [`Prefetch`](/ko/2.2/ref/models/querysets/#django.db.models.Prefetch) if
  `to_attr` is set to a `ManyToManyField` ([#25693](https://code.djangoproject.com/ticket/25693)).