May 20, 2015
Django 1.8.2 fixes a security issue and several bugs in 1.8.1.
cached_db
backend¶A change to session.flush()
in the cached_db
session backend in Django
1.8 mistakenly sets the session key to an empty string rather than None
. An
empty string is treated as a valid session key and the session cookie is set
accordingly. Any users with an empty string in their session cookie will use
the same session store. session.flush()
is called by
django.contrib.auth.logout()
and, more seriously, by
django.contrib.auth.login()
when a user switches accounts. If a user is
logged in and logs in again to a different account (without logging out) the
session is flushed to avoid reuse. After the session is flushed (and its
session key becomes ''
) the account details are set on the session and the
session is saved. Any users with an empty string in their session cookie will
now be logged into that account.
Case
instance in a query
(#24752).Case
expressions. For example, annotating a
query with a Case
expression could unexpectedly filter out results
(#24766).Q
objects in expressions. Cases like
Case(When(~Q(friends__age__lte=30)))
tried to generate a subquery which
resulted in a crash (#24705).ForeignKey.get_db_prep_value()
so that ForeignKey
s
pointing to UUIDField
and inheritance on models
with UUIDField
primary keys work correctly (#24698,
#24712).isnull
lookup for HStoreField
(#24751).SESSION_COOKIE_DOMAIN
(#24799).postgres
database,
Django now falls back to the default database when it normally requires a
“no database” connection (#24791).contrib.admin
’s ForeignKey
widget when it’s used
in a row with other fields (#24784).Jun 09, 2017