remote/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2026-08-20 00:04:08 +02:00
Code Issues Projects Releases Packages Wiki Activity

Release 1.0a38

Browse source 
Refs #2868
This commit is contained in:
Simon Willison 2026-08-06 11:20:25 -07:00
commit 12b25affb5
2 changed files with 12 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
datasette/version.py
View file

@ -1,2 +1,2 @@
__version__ = "1.0a37"
__version__ = "1.0a38"
__version_info__ = tuple(__version__.split("."))

11
docs/changelog.rst
View file

@ -4,6 +4,17 @@
Changelog
=========
.. _v1_0_a38:
1.0a38 (2026-08-06)
-------------------
This release fixes a **SQL injection** security issue that affects Datasette instances that serve a **mixture of public and private tables** in the same database, with access configured using the :ref:`Datasette permissions system <authentication>`.
Site administrators who serve private tables in this way are advised to disable the :ref:`execute-sql permission <actions_execute_sql>` on that database to prevent users from accessing private tables using raw SQL queries. The bug that has been fixed would have allowed users with access to any public table to execute SQL injection attacks despite that restriction, giving them read-only access to data in private tables in the same database.
This fix is also available in Datasette 0.65.3.
.. _v1_0_a37:
1.0a37 (2026-07-14)