CVE-2020-11037 - avoid potential timing attack on password-protected private pages (Thibaud Colas)
CVE-2020-11001 - prevent XSS attack via page revision comparison view (Vlad Gerasimenko, Matt Westcott)
ManifestStaticFilesStorage no longer fail if collectstatic has not been run first (Alex Tomkins)construct_page_listing_buttons hook (Michael van Tellingen)update_all_types workaround, upgrade minimum release to 6.4.0 or above (Jonathan Liuti)WAGTAIL_EMAIL_MANAGEMENT_ENABLED setting to determine whether users can change their email address (Janne Alatalo)WAGTAILDOCS_SERVE_METHOD setting to determine how document downloads will be linked to and served (Tobias McNulty, Matt Westcott)WAGTAIL_MODERATION_ENABLED setting to enable / disable the 'Submit for Moderation' option (Jacob Topp-Mugglestone)register_page_action_menu_item and construct_page_action_menu hooks to override the default menu action (Rahmi Pruitt, Matt Westcott)WAGTAILIMAGES_MAX_IMAGE_PIXELS limit now takes the number of animation frames into account (Karl Hobley)pageurl and slugurl tags no longer fail when request.site is None (Samir Shah)StreamBlock.get_prep_value (Colin Klein)DraftailRichTextArea is no longer treated as a hidden field by Django's form logic (Sergey Fedoseev)DEFAULT_AUTHENTICATION_CLASSES setting no longer breaks the page explorer menu and admin API (Matt Westcott)π Changes from 2.7rc1:
manage.py collectstatic no longer breaks with ManifestStaticFilesStorage (Matt Westcott)DEFAULT_AUTHENTICATION_CLASSES setting no longer breaks the page explorer menu and admin API (Matt Westcott)construct_page_listing_buttons hook (Michael van Tellingen)update_all_types workaround, upgrade minimum release to 6.4.0 or above (Jonathan Liuti)WAGTAIL_EMAIL_MANAGEMENT_ENABLED setting to determine whether users can change their email address (Janne Alatalo)WAGTAILDOCS_SERVE_METHOD setting to determine how document downloads will be linked to and served (Tobias McNulty, Matt Westcott)WAGTAIL_MODERATION_ENABLED setting to enable / disable the 'Submit for Moderation' option (Jacob Topp-Mugglestone)register_page_action_menu_item and construct_page_action_menu hooks to override the default menu action (Rahmi Pruitt, Matt Westcott)WAGTAILIMAGES_MAX_IMAGE_PIXELS limit now takes the number of animation frames into account (Karl Hobley)pageurl and slugurl tags no longer fail when request.site is None (Samir Shah)StreamBlock.get_prep_value (Colin Klein)DraftailRichTextArea is no longer treated as a hidden field by Django's form logic (Sergey Fedoseev)DEFAULT_AUTHENTICATION_CLASSES setting no longer breaks the page explorer menu and admin API (Matt Westcott)short_description for field labels in modeladmin's InspectView (Wesley van Lee)image template tag (Deniz Dogan)branding_title template block for the admin title prefix (Dillen Meijboom)process_child_object and exclude_fields arguments to Page.copy() to make it easier for third-party apps to customise copy behavior (Karl Hobley)Page.with_content_json(), allowing revision content loading behaviour to be customised on a per-model basis (Karl Hobley)construct_settings_menu hook (Jordan Bauer, Quadric)dir attribute for the active language (Andreas Bernacca)--chunk_size argument on ./manage.py update_index (Seb Brown)repr method (Alex Tomkins)exclude_fields_in_copy (Karl Hobley)is_stored_locally method to AbstractDocument (jonny5532)