django CMS 5.0.11 and 5.1.2 released

Security improvements

Both releases address an authorization issue in frontend editing endpoints.

The object rendering endpoint did not perform the same object-level permission check as other rendering paths. As a result, a staff user could access rendered plugin content from frontend-editable objects, including placeholders for which they did not have the appropriate permission.

The endpoint now checks placeholder permissions before rendering the requested object.

django CMS 5.1.2 contains additional security hardening, including:

• Requiring permission on the existing home page when promoting another page to become the new home page.
• Hardening toolbar refresh handling so editable content cannot inject markup into the live toolbar.
• Creating POST toolbar forms through DOM APIs rather than assembling HTML strings containing URLs and CSRF tokens.
• Hardening the PyPI release pipeline by separating package building from publishing, hash-pinning build dependencies, and limiting access to the OIDC publishing permission.

django CMS 5.1.2

django CMS 5.1.2 is a patch release for the 5.1 series and contains no new migrations or backward-incompatible changes.

One particularly important fix concerns projects using SQLite and djangocms-versioning. Migration cms.0044, introduced with 5.1.1, could fail for these projects and prevent the upgrade from completing. 5.1.2 repairs that migration without changing the resulting schema or data.

If your project could not migrate to 5.1.1 because of this issue, you can upgrade directly to 5.1.2.

The release also includes:

• Support for Content Security Policy nonces with Django 6.1.
• Preservation of manually entered page slugs when changing a page title.
• Correct handling of read-only grouper admin contexts for content without a language field.
• Support for copying plugins from write-protected/published content.
• Preservation of the login_required property when copying pages.
• Correct handling of multi-hyphen language codes in the page tree.
• A fix for the welcome.js path.
• Several toolbar and permission-related hardening improvements.

django CMS 5.1 supports Django 5.2, 6.0 and 6.1, and Python 3.10 through 3.14.

To upgrade:

python -m pip install --upgrade "django-cms==5.1.2"
python manage.py collectstatic --noinput
python manage.py cms check

Projects coming from 5.1.0 should also run migrations introduced in 5.1.1:

python manage.py migrate

django CMS 5.0.11

django CMS 5.0.11 brings the important frontend-editing authorization fix to the 5.0 series, together with a selection of bug fixes.

These include:

• Correct read-only handling in GrouperModelAdmin for content without a language field.
• Preserving manually entered page slugs when page titles change.
• Preserving the login_required property when copying pages.
• Correct handling of multi-hyphen language codes in the page tree.
• Fixes for N+1 query regressions in the page tree and plugin management commands.
• Correct handling of content versions in GrouperAdmin.

There are no migrations or backward-incompatible changes in 5.0.11. Static files have changed, however, so remember to run collectstatic after upgrading.

django CMS 5.0 supports Django 4.2 through 5.2 and Python 3.9 through 3.13.

Thank you

Thank you to everyone who contributed code and reviews to these releases.

Keeping django CMS secure and dependable is a community effort. If you’re running django CMS 5.0 or 5.1, please plan to update to 5.0.11 or 5.1.2 respectively.