chango.git/django/http/request.py, branch devmain

Fixed CVE-2026-6873 -- Prevented signed cookie salt namespace collisions.

2026-06-03T11:37:26Z

Made signed cookies derive their signer namespace from an injective encoding of `(name, salt)` while preserving compatibility with legacy `name + salt` cookies behind SIGNED_COOKIE_LEGACY_SALT_FALLBACK. Thanks Peng Zhou for the report, and Shai Berger, Markus Holterman, Jake Howard, and Paul McMillan for reviews. Co-authored-by: Jacob Walls Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>

Fixed #37103 -- Made HttpRequest.body handle malformed CONTENT_LENGTH.

2026-06-02T09:06:28Z

Fixed #36991 -- Raised BadRequest for invalid encodings in Content-Type headers.

2026-04-22T18:25:08Z

Fixed CVE-2026-33034 -- Enforced DATA_UPLOAD_MAX_MEMORY_SIZE on body size in ASGI requests.

2026-04-07T11:12:27Z

The `body` property in `HttpRequest` checks DATA_UPLOAD_MAX_MEMORY_SIZE against the declared `Content-Length` header before reading. On the ASGI path, chunked requests carry no `Content-Length`, so the check evaluated to 0 and always passed regardless of the actual body size. This work adds a new check on the actual number of bytes consumed. Thanks to Superior for the report, and to Jake Howard and Jacob Walls for reviews.

Fixed #36841 -- Made multipart parser class pluggable on HttpRequest.

2026-02-10T22:59:02Z

Refs #36500 -- Rewrapped long docstrings and block comments via a script.

2025-07-23T23:17:55Z

Rewrapped long docstrings and block comments to 79 characters + newline using script from https://github.com/medmunds/autofix-w505.

Removed double spaces after periods and within phrases.

2025-07-23T13:09:43Z

Fixed #36447 -- Selected preferred media type based on quality.

2025-06-16T07:25:25Z

When matching which entry in the `Accept` header should be used for a given media type, the specificity matters. However once those are resolved, only the quality matters when selecting preference. Regression in c075508b4de8edf9db553b409f8a8ed2f26ecead. Thank you to Anders Kaseorg for the report.

Fixed #36446 -- Restored "q" in internal MediaType.params property.

2025-06-09T20:37:40Z

The "q" key was removed while addressing ticket #36411. Despite `MediaType.params` is undocumented and considered internal, it was used in third-party projects (Zulip reported breakage), so this work restored the `q` key in `params`. Thanks Anders Kaseorg for the report. Regression in c075508b4de8edf9db553b409f8a8ed2f26ecead.

Fixed #36411 -- Made HttpRequest.get_preferred_type() consider media type parameters.

2025-06-03T19:10:41Z

HttpRequest.get_preferred_type() did not account for parameters in Accept header media types (e.g., "text/vcard; version=3.0"). This caused incorrect content negotiation when multiple types differed only by parameters, reducing specificity as per RFC 7231 section 5.3.2 (https://datatracker.ietf.org/doc/html/rfc7231.html#section-5.3.2). This fix updates get_preferred_type() to treat media types with parameters as distinct, allowing more precise and standards-compliant matching. Thanks to magicfelix for the report, and to David Sanders and Sarah Boyce for the reviews.