... Script's Element.innerHTML could result in XSS in the admin's add/change related popup. Element.textContent is now used to prevent execution of the data. The debug view also used innerHTML . Although a security issue wasn't identified there, out of an a ... issue admin change related popup Element innerHTML textContent used also リリースノート July fixes Unsafe usage JavaScript prevent execution debug view Although wasn identified there クイック検索 Last update: 2026年10月09日 « previous | up | next » ... ... Script's Element.innerHTML could result in XSS in the admin's add/change related popup. Element.textContent is now used to prevent execution of the data. The debug view also used innerHTML . Although a security issue wasn't identified there, out of an a ... dmin change related popup Element innerHTML textContent used also リリースノート July セキュリティ Unsafe usage JavaScript prevent execution debug view Although security issue クイック検索 Last update: 2026年10月09日 « previous | up | next » ... ... -User , an attacker may be able to provide an X-Auth_User header (with underscore) and bypass this protection. In order to prevent such attacks, both Nginx and Apache 2.4+ strip all headers containing underscores from incoming requests by default. Djang ... launch a denial-of-service attack by simultaneously requesting many large files. This view now reads the file in chunks to prevent large memory usage. Note, however, that this view has always carried a warning that it is not hardened for production use ... ... -User , an attacker may be able to provide an X-Auth_User header (with underscore) and bypass this protection. In order to prevent such attacks, both Nginx and Apache 2.4+ strip all headers containing underscores from incoming requests by default. Djang ... launch a denial-of-service attack by simultaneously requesting many large files. This view now reads the file in chunks to prevent large memory usage. Note, however, that this view has always carried a warning that it is not hardened for production use ... ... -User , an attacker may be able to provide an X-Auth_User header (with underscore) and bypass this protection. In order to prevent such attacks, both Nginx and Apache 2.4+ strip all headers containing underscores from incoming requests by default. Djang ... launch a denial-of-service attack by simultaneously requesting many large files. This view now reads the file in chunks to prevent large memory usage. Note, however, that this view has always carried a warning that it is not hardened for production use ... ... -User , an attacker may be able to provide an X-Auth_User header (with underscore) and bypass this protection. In order to prevent such attacks, both Nginx and Apache 2.4+ strip all headers containing underscores from incoming requests by default. Djang ... launch a denial-of-service attack by simultaneously requesting many large files. This view now reads the file in chunks to prevent large memory usage. Note, however, that this view has always carried a warning that it is not hardened for production use ... ... -User , an attacker may be able to provide an X-Auth_User header (with underscore) and bypass this protection. In order to prevent such attacks, both Nginx and Apache 2.4+ strip all headers containing underscores from incoming requests by default. Djang ... launch a denial-of-service attack by simultaneously requesting many large files. This view now reads the file in chunks to prevent large memory usage. Note, however, that this view has always carried a warning that it is not hardened for production use ... ... n have been fixed (trailing dot removed, #23532 ). Added quoting of constraint names in the SQL generated by migrations to prevent crash with uppercase characters in the name ( #23065 ). Fixed renaming of models with a self-referential many-to-many fiel ... with cursor.execute() ( #23426 ). TEST 辞書の SERIALIZE 項目を使用可能にしました ( #23421 )。 Fixed bug in migrations that prevented foreign key constraints to unmanaged models with a custom primary key ( #23415 ). Added SchemaEditor for MySQL GIS backe ... one-aware values ( #23365 ). Added a prompt to the migrations questioner when removing the null constraint from a field to prevent an IntegrityError on existing NULL rows ( #23609 ). Fixed generic relations in ModelAdmin.list_filter ( #23616 ). Restored ... ... -User , an attacker may be able to provide an X-Auth_User header (with underscore) and bypass this protection. In order to prevent such attacks, both Nginx and Apache 2.4+ strip all headers containing underscores from incoming requests by default. Djang ... launch a denial-of-service attack by simultaneously requesting many large files. This view now reads the file in chunks to prevent large memory usage. Note, however, that this view has always carried a warning that it is not hardened for production use ... ... n have been fixed (trailing dot removed, #23532 ). Added quoting of constraint names in the SQL generated by migrations to prevent crash with uppercase characters in the name ( #23065 ). Fixed renaming of models with a self-referential many-to-many fiel ... with cursor.execute() ( #23426 ). TEST 辞書の SERIALIZE 項目を使用可能にしました ( #23421 )。 Fixed bug in migrations that prevented foreign key constraints to unmanaged models with a custom primary key ( #23415 ). Added SchemaEditor for MySQL GIS backe ... one-aware values ( #23365 ). Added a prompt to the migrations questioner when removing the null constraint from a field to prevent an IntegrityError on existing NULL rows ( #23609 ). Fixed generic relations in ModelAdmin.list_filter ( #23616 ). Restored ... 2026年10月08日