Django 2.1.6 release notes — Django documentation
From Get docs
Django/docs/3.2.x/releases/2.1.6
Django 2.1.6 release notes
February 11, 2019
Django 2.1.6 fixes a security issue and a bug in 2.1.5.
CVE-2019-6975: Memory exhaustion in django.utils.numberformat.format()
If django.utils.numberformat.format()
– used by contrib.admin
as well as the floatformat
, filesizeformat
, and intcomma
templates filters – received a Decimal
with a large number of digits or a large exponent, it could lead to significant memory usage due to a call to '{:f}'.format()
.
To avoid this, decimals with more than 200 digits are now formatted using scientific notation.
Bugfixes
- Made the
obj
argument ofInlineModelAdmin.has_add_permission()
optional to restore backwards compatibility with third-party code that doesn’t provide it (:ticket:`30097`).