3.0.17 release notes - Unreleased - Draft

What’s new in 3.0.17

Bug Fixes

• Fix ExtensionToolbar when language is removed but titles still exists…
• Fix PageSelectWidget JS syntax
• Fix cache settings
• Addresses security vulnerabilities in the render_model template tag that could lead to escalation of privileges or other security issues.
• Fixes security vulnerabilities in custom form fields that could lead to escalation of privileges or other security issues.

Important

This version of django CMS introduces a new setting: CMS_UNESCAPED_RENDER_MODEL_TAGS with a default value of True. This default value allows upgrades to occur without forcing django CMS users to do anything, but, please be aware that this setting continues to allow known security vulnerabilities to be present. Due to this, the new setting is immediately deprecated and will be removed in a near-future release.

To immediately improve the security of your project and to prepare for future releases of django CMS and related addons, the project administrator should carefully review each use of the render_model template tags provided by django CMS. He or she is encouraged to ensure that all content which is rendered to a page using this template tag is cleansed of any potentially harmful HTML markup, CSS styles or Javascript. Once the administrator or developer is satisfied that the content is clean, he or she can add the “safe” filter parameter to the render_model template tag if the content should be rendered without escaping. If there is no need to render the content un-escaped, no further action is required.

Once all template tags have been reviewed and adjusted where necessary, the administrator should set CMS_UNESCAPED_RENDER_MODEL_TAGS = False in the project settings. At that point, the project is more secure and will be ready for any future upgrades.