# Django 3.2.11.dev 文档

# Django 1.11.21 版本发行说明

2019 年 6 月 3 日

Django 1.11.21 修复了 1.11.20 中的一个安全问题。

## CVE-2019-12308: AdminURLFieldWidget XSS

The clickable "Current URL" link generated by `AdminURLFieldWidget` displayed the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.

`AdminURLFieldWidget` now validates the provided value using `URLValidator` before displaying the clickable link. You may customize the validator by passing a `validator_class` kwarg to `AdminURLFieldWidget.__init__()`, e.g. when using `formfield_overrides`.