---
title: "Django 1.11.27 版本发行说明"
version: 3.2
locale: zh-hans
source: https://docs.djangoproject.com/zh-hans/3.2/releases/1.11.27/
canonical: https://djangodocs.dev/zh-hans/3.2/releases/1.11.27/
---
# Django 1.11.27 版本发行说明

*2019 年 12 月 18 日*

Django 1.11.27 修复了 1.11.26 中的一个安全问题和一个数据丢失漏洞。

## CVE-2019-19844: Potential account hijack via password reset form

By submitting a suitably crafted email address making use of Unicode
characters, that compared equal to an existing user email when lower-cased for
comparison, an attacker could be sent a password reset token for the matched
account.

In order to avoid this vulnerability, password reset requests now compare the
submitted email using the stricter, recommended algorithm for case-insensitive
comparison of two identifiers from [Unicode Technical Report 36, section
2.11.2(B)(2)](https://www.unicode.org/reports/tr36/#Recommendations_General). Upon a match, the email containing the reset token will be
sent to the email address on record rather than the submitted address.

## 漏洞修复

- Fixed a data loss possibility in
  [`SplitArrayField`](/zh-hans/3.2/ref/contrib/postgres/forms/#django.contrib.postgres.forms.SplitArrayField). When using with
  `ArrayField(BooleanField())`, all values after the first `True` value
  were marked as checked instead of preserving passed values ([#31073](https://code.djangoproject.com/ticket/31073)).