---
title: "1.15.24 — System Setup describes release-bucket CORS accurately"
description: "System Setup now distinguishes an already-permissive wildcard CORS rule from the missing dedicated portal-origin rule, so its warning tells operators exactly what is absent without claiming uploads are blocked."
date: "2026-08-22"
tags: ["release"]
canonical: "https://django-mojo.sitesmojo.com/changelog/1-15-24/"
---

System Setup now distinguishes an already-permissive wildcard CORS rule from the missing dedicated portal-origin rule, so its warning tells operators exactly what is absent without claiming uploads are blocked.

## What changed

- The release-bucket readiness warning now says when the dedicated portal-origin browser-upload CORS rule is missing.
- Existing wildcard CORS remains a warning because it is broader than the recommended exact-origin rule, but the report no longer falsely claims browser uploads are blocked.
- Remediation remains additive and explicitly preserves existing CORS configuration.

## Verification

- Added a regression for a wildcard CORS configuration that already permits uploads.
- `test_aws`: 329 total, 315 passed, 14 skipped, 0 failed.
- Full release gate: 5,993 total, 5,952 passed, 41 skipped, 0 failed.