... om Transifex are incorporated. CVE-2018-16984: Password hash disclosure to "view only" admin users ¶ If an admin user has the change permission to the user model, only part of the password hash is displayed in the change ... form. Admin users with the view (but not change) permission to the user model were displayed the entire hash. While it's typically infeasibl ... ser change form ( #29809 ). 目次 Django 2.1.2 リリースノート CVE-2018-16984: Password hash disclosure to "view only" admin users バグ修正 前のトピックへ Django 2.1.3 リリースノート 次のトピックへ Django 2.1.1 リリースノート 関連キーワード user change ... ... th repeated use of regular-expression lookups supported by the Django database API -- expose sensitive information such as users' password hashes. To remedy this, django.contrib.admin will now validate that querystring lookup arguments either specify ... lowed by the application developer using the preexisting mechanism mentioned above. This is backwards-incompatible for any users relying on the prior ability to insert arbitrary lookups. One new feature ¶ Ordinarily, a point release would not include ... ing -- TEST_DEPENDENCIES -- that allows you to define any creation order dependencies in your database configuration. Most users -- even users with multiple-database configurations -- need not be concerned about the data loss bug, or the manual config ... ... th repeated use of regular-expression lookups supported by the Django database API -- expose sensitive information such as users' password hashes. To remedy this, django.contrib.admin will now validate that querystring lookup arguments either specify ... lowed by the application developer using the preexisting mechanism mentioned above. This is backwards-incompatible for any users relying on the prior ability to insert arbitrary lookups. One new feature ¶ Ordinarily, a point release would not include ... ing -- TEST_DEPENDENCIES -- that allows you to define any creation order dependencies in your database configuration. Most users -- even users with multiple-database configurations -- need not be concerned about the data loss bug, or the manual config ... ... om Transifex are incorporated. CVE-2018-16984: Password hash disclosure to "view only" admin users ¶ If an admin user has the change permission to the user model, only part of the password hash is displayed in the change ... form. Admin users with the view (but not change) permission to the user model were displayed the entire hash. While it's typically infeasibl ... ser change form ( #29809 ). 目次 Django 2.1.2 リリースノート CVE-2018-16984: Password hash disclosure to "view only" admin users バグ修正 前のトピックへ Django 2.1.3 リリースノート 次のトピックへ Django 2.1.1 リリースノート 関連キーワード user change ... ... , potentially at a later date. This keeps requests fast, reduces latency, and improves the user experience. For example, a user shouldn't have to wait for an email to send before their page finishes loading. Django's Tasks framework makes it easy to d ... decorator on a module-level function: from django.core.mail import send_mail from django.tasks import task @task def email_users ( emails , subject , message ): return send_mail ( subject = subject , message = message , from_email = None , recipient_l ... m django.core.mail import send_mail from django.tasks import task @task ( priority = 2 , queue_name = "emails" ) def email_users ( emails , subject , message ): return send_mail ( subject = subject , message = message , from_email = None , recipient_l ... ... エイリアスを持つデータベースを使用します。 以下に示すのは、2つのデータベース、すなわちデフォルトの PostgreSQL データベースと users という名前の MySQL データベースを定義した settings.py スニペットの例です。 DATABASES = { "default" : { "NAME" : "app_data" ... , "ENGINE" : "django.db.backends.postgresql" , "USER" : "postgres_user" , "PASSWORD" : "s3krit" , }, "users" : { "NAME" : "user_data" , "ENGINE" : "django.db.backends.mysql" , "USER" : "mysql_user" , "PASSWORD" : "priv4te" , }, } ... ままにして、2つの default ではないデータベースを定義している settings.py スニペットの例です。 DATABASES = { "default" : {}, "users" : { "NAME" : "user_data" , "ENGINE" : "django.db.backends.mysql" , "USER" : "mysql_user" , "PASSWORD" : "superS3cret" , } ... ... エイリアスを持つデータベースを使用します。 以下に示すのは、2つのデータベース、すなわちデフォルトの PostgreSQL データベースと users という名前の MySQL データベースを定義した settings.py スニペットの例です。 DATABASES = { "default" : { "NAME" : "app_data" ... , "ENGINE" : "django.db.backends.postgresql" , "USER" : "postgres_user" , "PASSWORD" : "s3krit" , }, "users" : { "NAME" : "user_data" , "ENGINE" : "django.db.backends.mysql" , "USER" : "mysql_user" , "PASSWORD" : "priv4te" , }, } ... ままにして、2つの default ではないデータベースを定義している settings.py スニペットの例です。 DATABASES = { "default" : {}, "users" : { "NAME" : "user_data" , "ENGINE" : "django.db.backends.mysql" , "USER" : "mysql_user" , "PASSWORD" : "superS3cret" , } ... ... ). A new user "messages" framework with support for cookie- and session-based message for both anonymous and authenticated users. Hooks for object-level permissions , permissions for anonymous users , and more flexible username requirements . Customiz ... -compatible manner per our API stability policy policy. However, a handful of features have changed in ways that, for some users, will be backwards-incompatible. The big changes are: Support for Python 2.3 has been dropped. See the full notes below. T ... he new CSRF protection framework is not backwards-compatible with the old system. Users of the old system will not be affected until the old system is removed in Django 1.4. However, upgrading to the new CSRF p ... ... ). A new user "messages" framework with support for cookie- and session-based message for both anonymous and authenticated users. Hooks for object-level permissions , permissions for anonymous users , and more flexible username requirements . Customiz ... -compatible manner per our API stability policy policy. However, a handful of features have changed in ways that, for some users, will be backwards-incompatible. The big changes are: Support for Python 2.3 has been dropped. See the full notes below. T ... he new CSRF protection framework is not backwards-compatible with the old system. Users of the old system will not be affected until the old system is removed in Django 1.4. However, upgrading to the new CSRF p ... ... which could unexpectedly redirect a user to a different host. An attacker could exploit this, for example, by redirecting users to a phishing site designed to ask for user's passwords. To remedy this, URL reversing now ensures that no URL starts with ... ser/?pop=1&t=password and viewing the page's HTML allowed viewing the password hash of each user. While the admin requires users to have permissions to view the change form pages in the first place, this could leak data if you rely on users having acc ... のトピックへ Django 1.4.15 リリースノート 次のトピックへ Django 1.4.13 リリースノート 関連キーワード user admin upload URLs users change generate certain reversing scheme relative slashes example site ensures huge number stat uploaded files requests is ... 2026年10月08日