django.git/django/core/files/storage/filesystem.py, branch main

Fixed CVE-2026-25674 -- Prevented potentially incorrect permissions on file system object creation.

2026-03-03T12:09:32Z

This fix introduces `safe_makedirs()` in the `os` utils as a safer alternative to `os.makedirs()` that avoids umask-related race conditions in multi-threaded environments. This is a workaround for https://github.com/python/cpython/issues/86533 and the solution is based on the fix being proposed for CPython. Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com> Co-authored-by: Zackery Spytz Refs CVE-2020-24583 and #31921. Thanks Tarek Nakkouch for the report, and Jake Howard, Jacob Walls, and Shai Berger for reviews.

Refs #36500 -- Rewrapped long docstrings and block comments via a script.

2025-07-23T23:17:55Z

Rewrapped long docstrings and block comments to 79 characters + newline using script from https://github.com/medmunds/autofix-w505.

Refs #36005 -- Used datetime.UTC alias instead of datetime.timezone.utc.

2025-02-18T07:35:36Z

datetime.UTC was added in Python 3.11.

Fixed #36191 -- Truncated the overwritten file content in FileSystemStorage.

2025-02-17T13:01:00Z

Refs #35326 -- Removed FileSystemStorage.OS_OPEN_FLAGS per deprecation timeline.

2025-01-15T21:28:37Z

Refs #35326 -- Adjusted deprecation warning stacklevel in FileSystemStorage.OS_OPEN_FLAGS.

2024-08-28T14:44:05Z

Fixed #35604, Refs #35326 -- Made FileSystemStorage.exists() behaviour independent from allow_overwrite.

2024-07-24T12:55:10Z

Partially reverts 0b33a3abc2ca7d68a24f6d0772bc2b9fa603744e. Storage.exists(name) was documented to "return False if the name is available for a new file." but return True if the file exists. This is ambiguous in the overwrite file case. It will now always return whether the file exists. Thank you to Natalia Bidart and Josh Schneier for the review.

Fixed #35326 -- Added allow_overwrite parameter to FileSystemStorage.

2024-05-21T05:28:12Z

Refs #34110 -- Added StorageSettingsMixin.

2022-11-11T06:05:00Z

Refs #34110 -- Reorganized django.core.files.storage into a separate module.

2022-11-11T05:59:33Z