Django-cms

Latest version: v4.1.1

Safety actively analyzes 630094 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 3 of 12

3.4.4

Not secure
==================

* Fixed a bug in which cancelling the publishing dialog wasn't respected.
* Fixed a bug causing post-login redirection to an incorrect URL on single-language sites.
* Changed the signature for internal ``cms.plugin_base.CMSPluginBase`` methods ``get_child_classes``
and ``get_parent_classes`` to take an optional ``instance`` parameter.
* Fixed an error when retrieving placeholder label from configuration.
* Fixed a bug which caused certain translations to display double-escaped text in the page
list admin view.
* Adjusted the toolbar JavaScript template to escape values coming from the request.
* Added Dropdown class to toolbar items
* Replaced all custom markup on the ``admin/cms/page/includes/fieldset.html`` template
with an ``{% include %}`` call to Django's built-in ``fieldset.html`` template.
* Fixed a bug which prevented a page from being marked as dirty when a placeholder was cleared.
* Fixed an IntegrityError raised when publishing a page with no public version and whose publisher
state was pending.
* Fixed an issue with JavaScript not being able to determine correct path to the async bundle
* Fixed a ``DoesNotExist`` database error raised when moving a page marked as published, but whose public
translation did not exist.
* Fixed a bug in which the menu rendered nodes using the site session variable (set in the admin),
instead of the current request site.
* Fixed a race condition bug in which the database cache keys were deleted without syncing with the
cache server, and as a result old menu items would continue to be displayed.
* Fixed a 404 raised when using the ``Delete`` button for a Page or Title extension on Django >= 1.9
* Added "How to serve multiple languages" section to documentation
* Fixed a performance issue with nested pages when using the ``inherit`` flag on the ``{% placeholder %}`` tag.
* Removed the internal ``reset_to_public`` page method in favour of the ``revert_to_live`` method.
* Fixed a bug in which the placeholder cache was not consistently cleared when a page was published.
* Enhanced the plugin menu to not show plugins the user does not have permission to add.
* Fixed a regression which prevented users from setting a redirect to the homepage.

3.4.3

Not secure
==================

* Fixed a security vulnerability in the page redirect field which allowed users
to insert JavaScript code.
* Fixed a security vulnerability where the ``next`` parameter for the toolbar login
was not sanitised and could point to another domain.

3.4.2

Not secure
==================

* Escaped strings in ``close_frame`` JS template.
* Fixed a bug with `text-transform` styles on inputs affecting CMS login
* Fixed a typo in the confirmation message for copying plugins from a different
language
* Fixed a bug which prevented certain migrations from running in a multi-db setup.
* Fixed a regression which prevented the ``Page`` model from rendering correctly
when used in a ``raw_id_field``.
* Fixed a regression which caused the CMS to cache the toolbar when ``CMS_PAGE_CACHE``
was set to ``True`` and an anonymous user had ``cms_edit`` set to ``True`` on their session.
* Fixed a regression which prevented users from overriding content in an inherited
placeholder.
* Added official support for Django 1.10.
* Fixed a bug affecting Firefox for Macintosh users, in which use of the Command key later followed by Return would
trigger a plugin save.
* Fixed a bug where template inheritance setting creates spurious migration (see 3479)
* Fixed a bug which prevented the page from being marked as dirty (pending changes)
when changing the value of the overwrite url field.
* Adjusted Ajax calls triggered when performing a placeholder operation (add plugin, etc..) to include
a GET query called cms_path. This query points to the path where the operation originates from.
* Added a deprecation warning to method ``render_plugin()`` in class ``CMSPlugin``.
* Since ``get_parent_classes()`` became a classmethod, do not instantiate plugin before invocation.
* Fixed a bug where the page tree would not update correctly when a sibling page was moved
from left to right or right to left.
* Improved the ``fix-tree`` command so that it also fixes non-root nodes (pages).
* Removed the deprecated ``add_url()``, ``edit_url()``, ``move_url()``, ``delete_url()``, ``copy_url()`` properties of
CMSPlugin model.
* Deprecated ``frontend_edit_template`` attribute of ``CMSPluginBase``.
* Introduced placeholder operation signals.
* The ``post_`` methods in PlaceholderAdminMixin`` have been deprecated in favor of
placeholder operation signals.
* Re-introduced the "Revert to live" menu option.
* Added support for django-reversion >= 2 (see 5830)
* Rewrote manual installation how-to documentation

3.4.1

Not secure
==================

* Fixed a regression when static placeholder was uneditable if it was present
on the page multiple times
* Removed globally unique constraint for Apphook configs.
* Fixed a bug when keyboard shortcuts were triggered when form fields were
focused
* Fixed a bug when ``shift + space`` shortcut wouldn't correctly highlight a
plugin in the structure board
* Fixed a bug when plugins that have top-level svg element would break
structure board
* Fixed a bug where output from the ``show_admin_menu_for_pages`` template tag
was escaped in Django 1.9
* Fixed a bug where plugins would be rendered as editable if toolbar was shown
but user was not in edit mode.
* Fixed css reset issue with shortcuts modal

3.4.0

Not secure
==================

* Changed the way CMS plugins are rendered. The div with `cms-plugin` class is
no longer rendered around every CMS plugin, instead a combination of `template`
tags and JavaScript is used to add event handlers and plugin data directly to
the plugin markup. This fixes most of the rendering issues that were present
because of the extra markup.
* Changed cache-busting implementation, it is now handled by a path change,
not by GET parameter.
* Added a possibility to copy pages in the Page Tree by drag'n'drop.
* Make it possible to use multi-table inheritance for Page/Title extensions.
* Refactored plugin rendering functionality to speed up loading time in both
structure and content mode.
* Added ``Shift + Space`` shortcut that behaves similar to ``Space`` shortcut
but takes into account currently hovered plugin.
* Improved keyboard navigation
* Added help modal about available shortcuts
* Added fuzzy matching to plugin picker
* Changed the ``downcast_plugins`` utility to return a generator instead of a list
* Fixed a bug that caused an aliased placeholder to show in structure mode.
* Fixed a bug which prevented aliased content from showing correctly without
publishing the page first.
* Added help text to an ``Alias`` plugin change form when attached to a page
to show the content editor where the content is aliased from.
* Removed revision support from djangoCMS core.
As a result both ``CMS_MAX_PAGE_HISTORY_REVERSIONS`` and ``CMS_MAX_PAGE_PUBLISH_REVERSIONS``
settings are no longer supported, as well as the ``with_revision`` parameter
in ``cms.api.create_page`` and ``cms.api.create_title``.

3.3.3

Not secure
==================

* Fixed a bug where where the plugin picker would display the plugin names
translated in the request language instead of the user's language.
* Fixed a bug which raised an exception when the ``AdvancedSettingsForm``
failed validation on certain fields.
* Fixed a bug with widgets not initialising correctly sometimes
* Fixed a tree corruption when moving a published page under a published one.
* Fixed a tree corruption caused by ``fix-tree`` when an unpublished page is parent
to a published page.
* Fixed an error when publishing a page that has an unpublished child page who is
parent to a published page.
* Fixed a bug where moving a published page under a page marked as pending publishing
is left as published instead of being marked as pending publishing.
* Fixed AttributeError when using ``create_page`` in management command
* Fixed a bug in getting the language from current request which can cause error 500
* API functions are now atomic by design (use the atomic decorator)
* Fixed a bug where a ``Page`` was created with it's languages field set to ``None``.

Page 3 of 12

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.