django/django

==========================
Django 3.2.1 release notes
==========================

*May 4, 2021*

Django 3.2.1 fixes a security issue and several bugs in 3.2.

CVE-2021-31542: Potential directory-traversal via uploaded files
================================================================

``MultiPartParser``, ``UploadedFile``, and ``FieldFile`` allowed
directory-traversal via uploaded files with suitably crafted file names.

In order to mitigate this risk, stricter basename and path sanitation is now
applied.

Bugfixes
========

* Corrected detection of GDAL 3.2 on Windows (:ticket:`32544`).

* Fixed a bug in Django 3.2 where subclasses of ``BigAutoField`` and
  ``SmallAutoField`` were not allowed for the :setting:`DEFAULT_AUTO_FIELD`
  setting (:ticket:`32620`).

* Fixed a regression in Django 3.2 that caused a crash of
  ``QuerySet.values()/values_list()`` after ``QuerySet.union()``,
  ``intersection()``, and ``difference()`` when it was ordered by an
  unannotated field (:ticket:`32627`).

* Restored, following a regression in Django 3.2, displaying an exception
  message on the technical 404 debug page (:ticket:`32637`).

* Fixed a bug in Django 3.2 where a system check would crash on a reverse
  one-to-one relationships in ``CheckConstraint.check`` or
  ``UniqueConstraint.condition`` (:ticket:`32635`).

* Fixed a regression in Django 3.2 that caused a crash of
  :attr:`.ModelAdmin.search_fields` when searching against phrases with
  unbalanced quotes (:ticket:`32649`).

* Fixed a bug in Django 3.2 where variable lookup errors were logged rendering
  the sitemap template if alternates were not defined (:ticket:`32648`).

* Fixed a regression in Django 3.2 that caused a crash when combining ``Q()``
  objects which contains boolean expressions (:ticket:`32548`).

* Fixed a regression in Django 3.2 that caused a crash of ``QuerySet.update()``
  on a queryset ordered by inherited or joined fields on MySQL and MariaDB
  (:ticket:`32645`).

* Fixed a regression in Django 3.2 that caused a crash when decoding a cookie
  value, used by ``django.contrib.messages.storage.cookie.CookieStorage``, in
  the pre-Django 3.2 format (:ticket:`32643`).

* Fixed a regression in Django 3.2 that stopped the shift-key modifier
  selecting multiple rows in the admin changelist (:ticket:`32647`).

* Fixed a bug in Django 3.2 where a system check would crash on the
  :setting:`STATICFILES_DIRS` setting with a list of 2-tuples of
  ``(prefix, path)`` (:ticket:`32665`).

* Fixed a long standing bug involving queryset bitwise combination when used
  with subqueries that began manifesting in Django 3.2, due to a separate fix
  using ``Exists`` to ``exclude()`` multi-valued relationships
  (:ticket:`32650`).

* Fixed a bug in Django 3.2 where variable lookup errors were logged when
  rendering some admin templates (:ticket:`32681`).

* Fixed a bug in Django 3.2 where an admin changelist would crash when deleting
  objects filtered against multi-valued relationships (:ticket:`32682`). The
  admin changelist now uses ``Exists()`` instead of ``QuerySet.distinct()``
  because calling ``delete()`` after ``distinct()`` is not allowed in Django
  3.2 to address a data loss possibility.

* Fixed a regression in Django 3.2 where the calling process environment would
  not be passed to the ``dbshell`` command on PostgreSQL (:ticket:`32687`).

* Fixed a performance regression in Django 3.2 when building complex filters
  with subqueries (:ticket:`32632`). As a side-effect the private API to check
  ``django.db.sql.query.Query`` equality is removed.