chango.git, branch 5.1.1

[5.1.x] Bumped version for 5.1.1 release.

2024-09-03T12:26:51Z

[5.1.x] Fixed CVE-2024-45231 -- Avoided server error on password reset when email sending fails.

2024-09-03T12:24:21Z

On successful submission of a password reset request, an email is sent to the accounts known to the system. If sending this email fails (due to email backend misconfiguration, service provider outage, network issues, etc.), an attacker might exploit this by detecting which password reset requests succeed and which ones generate a 500 error response. Thanks to Thibaut Spriet for the report, and to Mariusz Felisiak, Adam Johnson, and Sarah Boyce for the reviews.

[5.1.x] Fixed CVE-2024-45230 -- Mitigated potential DoS in urlize and urlizetrunc template filters.

2024-09-03T12:24:13Z

Thanks MProgrammer (https://hackerone.com/mprogrammer) for the report.

[5.1.x] Fixed #35716 -- Fixed VariableDoesNotExist when rendering admin fieldsets.

2024-08-30T18:52:41Z

Regression in 01ed59f753139afb514170ee7f7384c155ecbc2d. Thank you to Fábio Domingues and Marijke Luttekes for the report, and thank you to Natalia Bidart for the review. Backport of fd1dd767783b5a7ec1a594fcc5885e7e4178dd26 from main.

[5.1.x] Fixed #35688 -- Restored timezone and role setters to be PostgreSQL DatabaseWrapper methods.

2024-08-28T22:25:55Z

Following the addition of PostgreSQL connection pool support in Refs #33497, the methods for configuring the database role and timezone were moved to module-level functions. This change prevented subclasses of DatabaseWrapper from overriding these methods as needed, for example, when creating wrappers for other PostgreSQL-based backends. Thank you Christian Hardenberg for the report and to Florian Apolloner and Natalia Bidart for the review. Regression in fad334e1a9b54ea1acb8cce02a25934c5acfe99f. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 7380ac57340653854bc2cfe0ed80298cdac6061d from main.

[5.1.x] Removed outdated note about lack of subquery support in MySQL.

2024-08-28T18:56:35Z

Backport of 26a67943ac5c2f196621220b24f4314d84471d07 from main.

[5.1.x] Fixed typos in docs/howto/initial-data.txt.

2024-08-28T18:26:55Z

Backport of 920efe503f8a1b16a497a792075c987080f3280a from main.

[5.1.x] Fixed #35666 -- Documented stacklevel usage and testing, and adjusted test suite accordingly.

2024-08-28T14:47:15Z

Over the years we've had multiple instances of hit and misses when emitting warnings: either setting the wrong stacklevel or not setting it at all. This work adds assertions for the existing warnings that were declaring the correct stacklevel, but were lacking tests for it. Backport of 57307bbc7d88927989cf5b314f16d6e13ade04e6 from main.

[5.1.x] Refs #35405 -- Adjusted deprecation warning stacklevel in FieldCacheMixin.get_cache_name().

2024-08-28T14:46:49Z

Backport of 39abd56a7fb1e2f735040df0fdfc08f57d91a49b from main.

[5.1.x] Refs #35326 -- Adjusted deprecation warning stacklevel in FileSystemStorage.OS_OPEN_FLAGS.

2024-08-28T14:46:23Z

Backport of 47f18a722624527cc72eef44cfc9d1e07ea4b4e0 from main.