... _fields attribute in the Django admin allows displaying model fields and model attributes. While the former were correctly escaped, the latter were not. Thus untrusted content could be injected into the admin, presenting an exploitation vector for XSS a ... bility, every model attribute used in readonly_fields that is not an actual model field (e.g. a property ) will fail to be escaped even if that attribute is not marked as safe. In this release, autoescaping is now correctly applied. バグ修正 ¶ Fixed cra ... 次のトピックへ Django 1.7.5 リリースノート 関連キーワード fields model readonly attribute ModelAdmin admin were correctly escaped Fixed foreign リリースノート March fixes security issue several bugs Mitigated attack properties allows displaying attribu ... ... _fields attribute in the Django admin allows displaying model fields and model attributes. While the former were correctly escaped, the latter were not. Thus untrusted content could be injected into the admin, presenting an exploitation vector for XSS a ... bility, every model attribute used in readonly_fields that is not an actual model field (e.g. a property ) will fail to be escaped even if that attribute is not marked as safe. In this release, autoescaping is now correctly applied. バグ修正 ¶ Fixed cra ... トピックへ Django 1.7.5 リリースノート 関連キーワード fields model Django readonly attribute ModelAdmin admin were correctly escaped field Fixed foreign key リリースノート March fixes security issue several 関連するページ Django 1.10.6 リリースノート Djan ... ... ebug %} no longer outputs information when the DEBUG setting is False , and it ensures all context variables are correctly escaped when the DEBUG setting is True . CVE-2022-23833: Denial-of-service possibility in file uploads ¶ Passing certain inputs to ... itCallbacks() could execute callbacks multiple times ( #33410 ). Fixed a regression in Django 4.0 where help_text was HTML-escaped in automatically-generated forms ( #33419 ). Fixed a regression in Django 4.0 that caused displaying an incorrect name for ... ngo 4.0.1 リリースノート 関連キーワード Fixed regression caused debug crash order incorrect バグ 修正 翻訳 context setting escaped forms based views makemigrations model aggregate リリースノート 1日 medium セキュリティ 問題 Transifex クイック検索 Last u ... ... ebug %} no longer outputs information when the DEBUG setting is False , and it ensures all context variables are correctly escaped when the DEBUG setting is True . CVE-2022-23833: Denial-of-service possibility in file uploads ¶ Passing certain inputs to ... itCallbacks() could execute callbacks multiple times ( #33410 ). Fixed a regression in Django 4.0 where help_text was HTML-escaped in automatically-generated forms ( #33419 ). Fixed a regression in Django 4.0 that caused displaying an incorrect name for ... .1 リリースノート 関連キーワード Django Fixed regression caused debug crash order incorrect バグ 修正 翻訳 context setting escaped forms bug class based views makemigrations 関連するページ Django 3.2.5 リリースノート Django 3.2.8 リリースノート Django 2 ... ... e Content-Disposition header of a FileResponse when the filename was derived from user-supplied input. The filename is now escaped to avoid this possibility. 目次 Django 3.2.15 リリースノート CVE-2022-36359: Potential reflected file download vulnerabili ... 問題 修正 Potential vulnerability application vulnerable attack sets Content Disposition header derived user supplied input escaped avoid possibility クイック検索 Last update: 2026年10月09日 « previous | up | next » ... ... e Content-Disposition header of a FileResponse when the filename was derived from user-supplied input. The filename is now escaped to avoid this possibility. 目次 Django 4.0.7 リリースノート CVE-2022-36359: Potential reflected file download vulnerabilit ... 問題 修正 Potential vulnerability application vulnerable attack sets Content Disposition header derived user supplied input escaped avoid possibility クイック検索 Last update: 2026年10月09日 « previous | up | next » ... ... ping for literal strings passed to the join template filter. Previously, literal strings passed to join were automatically escaped, contrary to the documented behavior for autoescaping and literal strings . Literal strings passed to join are no longer a ... utomatically escaped, meaning you must now manually escape them; this is an incompatibility if you were relying on this bug, but not if you wer ... ... ping for literal strings passed to the join template filter. Previously, literal strings passed to join were automatically escaped, contrary to the documented behavior for autoescaping and literal strings . Literal strings passed to join are no longer a ... utomatically escaped, meaning you must now manually escape them; this is an incompatibility if you were relying on this bug, but not if you wer ... ... い場合もあるでしょう。 変数単位での制御 ¶ 個々の変数の自動エスケープを無効にするには safe フィルタを使用します: This will be escaped: {{ data }} This will not be escaped: {{ data | safe }} safe という言葉は、これ以上エスケープしないよう保護 (safe) するとか ... であるという意味だと考えてください。 たとえば、 data に '<b>' が入っていた場合、出力は以下のようになります。 This will be escaped: < b > This will not be escaped: < b > テンプレートブロック単位での制御 ¶ テンプレート単位で自動エスケープを制御する ... い場合には、次のようにできます: Auto-escaping is on by default. Hello {{ name }} {% autoescape off %} This will not be auto-escaped: {{ data }} . Nor this: {{ other_data }} {% autoescape on %} Auto-escaping applies again: {{ name }} {% endautoescape %} { ... ... い場合もあるでしょう。 変数単位での制御 ¶ 個々の変数の自動エスケープを無効にするには safe フィルタを使用します: This will be escaped: {{ data }} This will not be escaped: {{ data | safe }} safe という言葉は、これ以上エスケープしないよう保護 (safe) するとか ... であるという意味だと考えてください。 たとえば、 data に '<b>' が入っていた場合、出力は以下のようになります。 This will be escaped: < b > This will not be escaped: < b > テンプレートブロック単位での制御 ¶ テンプレート単位で自動エスケープを制御する ... い場合には、次のようにできます: Auto-escaping is on by default. Hello {{ name }} {% autoescape off %} This will not be auto-escaped: {{ data }} . Nor this: {{ other_data }} {% autoescape on %} Auto-escaping applies again: {{ name }} {% endautoescape %} { ... 2026年10月08日