3.1.6.txt 688 B

123456789101112131415161718192021
  1. ==========================
  2. Django 3.1.6 release notes
  3. ==========================
  4. *February 1, 2021*
  5. Django 3.1.6 fixes a security issue with severity "low" and a bug in 3.1.5.
  6. CVE-2021-3281: Potential directory-traversal via ``archive.extract()``
  7. ======================================================================
  8. The ``django.utils.archive.extract()`` function, used by
  9. :option:`startapp --template` and :option:`startproject --template`, allowed
  10. directory-traversal via an archive with absolute paths or relative paths with
  11. dot segments.
  12. Bugfixes
  13. ========
  14. * Fixed an admin layout issue in Django 3.1 where changelist filter controls
  15. would become squashed (:ticket:`32391`).