Django-cms

Latest version: v4.1.4

Safety actively analyzes 723144 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 4 of 13

3.4.2

Not secure
==================

* Escaped strings in ``close_frame`` JS template.
* Fixed a bug with `text-transform` styles on inputs affecting CMS login
* Fixed a typo in the confirmation message for copying plugins from a different
language
* Fixed a bug which prevented certain migrations from running in a multi-db setup.
* Fixed a regression which prevented the ``Page`` model from rendering correctly
when used in a ``raw_id_field``.
* Fixed a regression which caused the CMS to cache the toolbar when ``CMS_PAGE_CACHE``
was set to ``True`` and an anonymous user had ``cms_edit`` set to ``True`` on their session.
* Fixed a regression which prevented users from overriding content in an inherited
placeholder.
* Added official support for Django 1.10.
* Fixed a bug affecting Firefox for Macintosh users, in which use of the Command key later followed by Return would
trigger a plugin save.
* Fixed a bug where template inheritance setting creates spurious migration (see 3479)
* Fixed a bug which prevented the page from being marked as dirty (pending changes)
when changing the value of the overwrite url field.
* Adjusted Ajax calls triggered when performing a placeholder operation (add plugin, etc..) to include
a GET query called cms_path. This query points to the path where the operation originates from.
* Added a deprecation warning to method ``render_plugin()`` in class ``CMSPlugin``.
* Since ``get_parent_classes()`` became a classmethod, do not instantiate plugin before invocation.
* Fixed a bug where the page tree would not update correctly when a sibling page was moved
from left to right or right to left.
* Improved the ``fix-tree`` command so that it also fixes non-root nodes (pages).
* Removed the deprecated ``add_url()``, ``edit_url()``, ``move_url()``, ``delete_url()``, ``copy_url()`` properties of
CMSPlugin model.
* Deprecated ``frontend_edit_template`` attribute of ``CMSPluginBase``.
* Introduced placeholder operation signals.
* The ``post_`` methods in PlaceholderAdminMixin`` have been deprecated in favor of
placeholder operation signals.
* Re-introduced the "Revert to live" menu option.
* Added support for django-reversion >= 2 (see 5830)
* Rewrote manual installation how-to documentation

3.4.1

Not secure
==================

* Fixed a regression when static placeholder was uneditable if it was present
on the page multiple times
* Removed globally unique constraint for Apphook configs.
* Fixed a bug when keyboard shortcuts were triggered when form fields were
focused
* Fixed a bug when ``shift + space`` shortcut wouldn't correctly highlight a
plugin in the structure board
* Fixed a bug when plugins that have top-level svg element would break
structure board
* Fixed a bug where output from the ``show_admin_menu_for_pages`` template tag
was escaped in Django 1.9
* Fixed a bug where plugins would be rendered as editable if toolbar was shown
but user was not in edit mode.
* Fixed css reset issue with shortcuts modal

3.4.0

Not secure
==================

* Changed the way CMS plugins are rendered. The div with `cms-plugin` class is
no longer rendered around every CMS plugin, instead a combination of `template`
tags and JavaScript is used to add event handlers and plugin data directly to
the plugin markup. This fixes most of the rendering issues that were present
because of the extra markup.
* Changed cache-busting implementation, it is now handled by a path change,
not by GET parameter.
* Added a possibility to copy pages in the Page Tree by drag'n'drop.
* Make it possible to use multi-table inheritance for Page/Title extensions.
* Refactored plugin rendering functionality to speed up loading time in both
structure and content mode.
* Added ``Shift + Space`` shortcut that behaves similar to ``Space`` shortcut
but takes into account currently hovered plugin.
* Improved keyboard navigation
* Added help modal about available shortcuts
* Added fuzzy matching to plugin picker
* Changed the ``downcast_plugins`` utility to return a generator instead of a list
* Fixed a bug that caused an aliased placeholder to show in structure mode.
* Fixed a bug which prevented aliased content from showing correctly without
publishing the page first.
* Added help text to an ``Alias`` plugin change form when attached to a page
to show the content editor where the content is aliased from.
* Removed revision support from djangoCMS core.
As a result both ``CMS_MAX_PAGE_HISTORY_REVERSIONS`` and ``CMS_MAX_PAGE_PUBLISH_REVERSIONS``
settings are no longer supported, as well as the ``with_revision`` parameter
in ``cms.api.create_page`` and ``cms.api.create_title``.

3.3.3

Not secure
==================

* Fixed a bug where where the plugin picker would display the plugin names
translated in the request language instead of the user's language.
* Fixed a bug which raised an exception when the ``AdvancedSettingsForm``
failed validation on certain fields.
* Fixed a bug with widgets not initialising correctly sometimes
* Fixed a tree corruption when moving a published page under a published one.
* Fixed a tree corruption caused by ``fix-tree`` when an unpublished page is parent
to a published page.
* Fixed an error when publishing a page that has an unpublished child page who is
parent to a published page.
* Fixed a bug where moving a published page under a page marked as pending publishing
is left as published instead of being marked as pending publishing.
* Fixed AttributeError when using ``create_page`` in management command
* Fixed a bug in getting the language from current request which can cause error 500
* API functions are now atomic by design (use the atomic decorator)
* Fixed a bug where a ``Page`` was created with it's languages field set to ``None``.

3.3.2

Not secure
==================

* Fixed a bug where it wasn't possible to scroll the toolbar menu if scroll
started on the disabled menu item on small screens.
* Fixed a migration error (0014) that occurred under certain environments.
* Fixed a regression when standalone CMS Widgets wouldn't work due to
non-existing JavaScript dependencies.
* Fixed a possible recursion error when using the ``Alias`` plugin.
* Fixed a regression where submit handlers for modal form wouldn't be executed
under certain circumstances

3.3.1

Not secure
==================

* Added a warning for users who are leaving the page or closing the plugin
modal by pressing ESC to prevent accidental loss of content.
* Fixed a bug when clicking inside sideframe didn't close toolbar dropdowns
* Fixed a bug where saving errors wouldn't be shown in the modal window.
* Fixed a misleading message when modal iframe contents couldn't be accessed.
* Added a workaround for a bug when plugins couldn't be deleted in Firefox
with 1Password extension installed
* Changed CMS JavaScript bundling from simple concatenation to webpack-based.
Using CMS JavaScript modules directly is no longer possible.
* Fixed an issue where plugins that have no immediate DOM representation
wouldn't be editable or movable.
* Fixed a regression in which plugins that defined ``parent_classes``
would not show up in the structure mode.
* Introduced new logic to leverage Django's dynamic related name
functionality on ``CMSPlugin`` subclasses for the parent link field.
* Backported a performance fix from Django to avoid extra queries when
plugins access their parent via the parent link field ``cmsplugin_ptr``.
* Fixed typo in ``AdvancedSettingsForm`` error messages.
* Fixed long standing bug that prevented apphook endspoints from being
CSRF exempt.
* Changed default value for ``CMS_INTERNAL_IPS``.
* Fixed an issue that prevented non superusers from copying all plugins
in a placeholder.
* Fixed an issue where plugin permissions where not checked when clearing
a placeholder.
* Fixed an issue where plugin permissions where not checked when deleting
a page or page translation.
* Added support for tiered ``CMS_PLACEHOLDER_CONF``.
* Fixed a useless placeholders edit permissions checking when not in edit
mode.
* Fixed a bug where users with limited permissions could not interact with
page tree dropdowns.
* Fixed a bug where Django Compressor could not be used on the sekizai ``js``
block.
* Fixed an encoding error when running the ``publisher-publish`` command.
* Fixed regression introduced in 3.3.0 when using the
``render_plugin_toolbar_config`` template tag directly.
* Fixed ``render_model`` template tags to work with models containing deferred
fields.
* Fixed error in retrieving placeholder label from configuration.

Page 4 of 13

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.