March 6, 2018
Django 2.0.3 fixes two security issues and several bugs in 2.0.2. Also, the latest string translations from Transifex are incorporated.
urlize
and urlizetrunc
template filters¶The django.utils.html.urlize()
function was extremely slow to evaluate
certain inputs due to catastrophic backtracking vulnerabilities in two regular
expressions. The urlize()
function is used to implement the urlize
and
urlizetrunc
template filters, which were thus vulnerable.
The problematic regular expressions are replaced with parsing logic that behaves similarly.
truncatechars_html
and truncatewords_html
template filters¶If django.utils.text.Truncator
’s chars()
and words()
methods were
passed the html=True
argument, they were extremely slow to evaluate certain
inputs due to a catastrophic backtracking vulnerability in a regular
expression. The chars()
and words()
methods are used to implement the
truncatechars_html
and truncatewords_html
template filters, which were
thus vulnerable.
The backtracking problem in the regular expression is fixed.
QuerySet.distinct().order_by()
followed by count()
to crash (#29108).%f
for the Thai
locale to fix the admin time picker widget displaying “undefined”
(#29109).QuerySet.order_by(Exists(...))
(#29118).Q.deconstruct()
deterministic with multiple keyword arguments
(#29125). You may need to modify Q
’s in existing migrations, or
accept an autogenerated migration.When()
expression with a list argument crashes
(#29166).Window()
expression in a subquery
(#29172).AbstractBaseUser.normalize_username()
crash if the username
argument isn’t a string (#29176).Nov 02, 2020