... uest. Browsers have strict same-origin policies regarding XMLHttpRequest. In the context of a browser, the only way that a custom header of this nature can be added is with XMLHttpRequest. Therefore, for ease of use, we did not apply CSRF checks to req ... y on Rails development team aware of a combination of browser plugins and redirects which can allow an attacker to provide custom HTTP headers on a request to any website. This can allow a forged request to appear to be an AJAX request, thereby defeati ... een judged to outweigh the compatibility concerns in this case. Additionally, Django will now accept the CSRF token in the custom HTTP header X-CSRFTOKEN, as well as in the form submission itself, for ease of use with popular JavaScript toolkits which ... ... uest. Browsers have strict same-origin policies regarding XMLHttpRequest. In the context of a browser, the only way that a custom header of this nature can be added is with XMLHttpRequest. Therefore, for ease of use, we did not apply CSRF checks to req ... y on Rails development team aware of a combination of browser plugins and redirects which can allow an attacker to provide custom HTTP headers on a request to any website. This can allow a forged request to appear to be an AJAX request, thereby defeati ... een judged to outweigh the compatibility concerns in this case. Additionally, Django will now accept the CSRF token in the custom HTTP header X-CSRFTOKEN, as well as in the form submission itself, for ease of use with popular JavaScript toolkits which ... ... ed with the label attribute of application configurations, to work around label conflicts. The name of applications can be customized in the admin with the verbose_name of application configurations. The admin automatically calls autodiscover() when Dj ... field to be copied safely, both essential parts of these new features. This change should not affect you unless you write custom Field subclasses; if you do, you may need to reimplement the deconstruct() method if your subclass changes the method sign ... zable, and to find out how to make your own classes serializable, read the migration serialization documentation . Calling custom QuerySet methods from the Manager ¶ Historically, the recommended way to make reusable model queries was to create methods ... ... ed with the label attribute of application configurations, to work around label conflicts. The name of applications can be customized in the admin with the verbose_name of application configurations. The admin automatically calls autodiscover() when Dj ... field to be copied safely, both essential parts of these new features. This change should not affect you unless you write custom Field subclasses; if you do, you may need to reimplement the deconstruct() method if your subclass changes the method sign ... zable, and to find out how to make your own classes serializable, read the migration serialization documentation . Calling custom QuerySet methods from the Manager ¶ Historically, the recommended way to make reusable model queries was to create methods ... ... es that use these specific features: Replacing get_connection() and connection arguments Replacing fail_silently Migrating custom email backends Replacing auth_user and auth_password Updating AdminEmailHandler email_backend Ignoring transient failures ... PTIONS" . EMAIL_USE_SSL becomes "use_ssl" in "OPTIONS" . EMAIL_USE_TLS becomes "use_tls" in "OPTIONS" . For third-party or custom email backends, the available "OPTIONS" depend on the backend. Refer to the third-party documentation, or for custom backe ... nds see Migrating custom email backends below. The Configuring email topic has more information on the MAILERS setting and additional configuration ... ... es that use these specific features: Replacing get_connection() and connection arguments Replacing fail_silently Migrating custom email backends Replacing auth_user and auth_password Updating AdminEmailHandler email_backend Ignoring transient failures ... PTIONS" . EMAIL_USE_SSL becomes "use_ssl" in "OPTIONS" . EMAIL_USE_TLS becomes "use_tls" in "OPTIONS" . For third-party or custom email backends, the available "OPTIONS" depend on the backend. Refer to the third-party documentation, or for custom backe ... nds see Migrating custom email backends below. The Configuring email topic has more information on the MAILERS setting and additional configuration ... ... ing prevention is now on and the database defaults to SQLite. If the default templates don't suit your tastes, you can use custom project and app templates . Improved transaction management ¶ Django's transaction management was overhauled. Database-lev ... now provides form fields and widgets for its geo-specialized fields. They are OpenLayers-based by default, but they can be customized to use any other JS framework. check management command added for verifying compatibility ¶ A check management command ... . The number argument for lazy plural translations can be provided at translation time rather than at definition time. For custom management commands: Verification of the presence of valid settings in commands that ask for it by using the BaseCommand.c ... ... ing prevention is now on and the database defaults to SQLite. If the default templates don't suit your tastes, you can use custom project and app templates . Improved transaction management ¶ Django's transaction management was overhauled. Database-lev ... now provides form fields and widgets for its geo-specialized fields. They are OpenLayers-based by default, but they can be customized to use any other JS framework. check management command added for verifying compatibility ¶ A check management command ... . The number argument for lazy plural translations can be provided at translation time rather than at definition time. For custom management commands: Verification of the presence of valid settings in commands that ask for it by using the BaseCommand.c ... ... lack of strict request/response layering of the old-style of middleware described in DEP 0005 . You'll need to adapt old, custom middleware and switch from the MIDDLEWARE_CLASSES setting to the new MIDDLEWARE setting to take advantage of the improveme ... the object-tools block on a model's changelist will now be rendered (without the add button). This makes it easier to add custom tools in this case. The LogEntry model now stores change messages in a JSON structure so that the message can be dynamical ... load static from staticfiles %} ) and not worry about whether or not the staticfiles app is installed. You can more easily customize the collectstatic --ignore option with a custom AppConfig . キャッシュ ¶ ファイルベースのキャッシュバックエンドが highe ... ... lack of strict request/response layering of the old-style of middleware described in DEP 0005 . You'll need to adapt old, custom middleware and switch from the MIDDLEWARE_CLASSES setting to the new MIDDLEWARE setting to take advantage of the improveme ... the object-tools block on a model's changelist will now be rendered (without the add button). This makes it easier to add custom tools in this case. The LogEntry model now stores change messages in a JSON structure so that the message can be dynamical ... load static from staticfiles %} ) and not worry about whether or not the staticfiles app is installed. You can more easily customize the collectstatic --ignore option with a custom AppConfig . キャッシュ ¶ ファイルベースのキャッシュバックエンドが highe ... 2026年10月08日