Merge branch 'master' of github.com:django/django

8 files changed, 81 insertions, 25 deletions

diff --git a/docs/faq/admin.txt b/docs/faq/admin.txt
index 1d9a7c7427..ec40754094 100644
--- a/docs/faq/admin.txt
+++ b/docs/faq/admin.txt
@@ -27,12 +27,6 @@ account has :attr:`~django.contrib.auth.models.User.is_active` and
 :attr:`~django.contrib.auth.models.User.is_staff` set to True. The admin site
 only allows access to users with those two fields both set to True.
 
-How can I prevent the cache middleware from caching the admin site?
--------------------------------------------------------------------
-
-Set the :setting:`CACHE_MIDDLEWARE_ANONYMOUS_ONLY` setting to ``True``. See the
-:doc:`cache documentation </topics/cache>` for more information.
-
 How do I automatically set a field's value to the user who last edited the object in the admin?
 -----------------------------------------------------------------------------------------------
 
diff --git a/docs/internals/deprecation.txt b/docs/internals/deprecation.txt
index 774de2a2fd..095b6d0a33 100644
--- a/docs/internals/deprecation.txt
+++ b/docs/internals/deprecation.txt
@@ -390,6 +390,8 @@ these changes.
   ``django.test.testcases.OutputChecker`` will be removed. Instead use the
   doctest module from the Python standard library.
 
+* The ``CACHE_MIDDLEWARE_ANONYMOUS_ONLY`` setting will be removed.
+
 2.0
 ---
 
diff --git a/docs/ref/models/fields.txt b/docs/ref/models/fields.txt
index 99ba78cb09..6cf235c637 100644
--- a/docs/ref/models/fields.txt
+++ b/docs/ref/models/fields.txt
@@ -80,9 +80,10 @@ If a field has ``blank=False``, the field will be required.
 
 .. attribute:: Field.choices
 
-An iterable (e.g., a list or tuple) of 2-tuples to use as choices for this
-field. If this is given, the default form widget will be a select box with
-these choices instead of the standard text field.
+An iterable (e.g., a list or tuple) consisting itself of iterables of exactly
+two items (e.g. ``[(A, B), (A, B) ...]``) to use as choices for this field. If
+this is given, the default form widget will be a select box with these choices
+instead of the standard text field.
 
 The first element in each tuple is the actual value to be stored, and the
 second element is the human-readable name. For example::
@@ -889,7 +890,8 @@ The value ``0`` is accepted for backward compatibility reasons.
 .. class:: PositiveSmallIntegerField([**options])
 
 Like a :class:`PositiveIntegerField`, but only allows values under a certain
-(database-dependent) point.
+(database-dependent) point. Values up to 32767 are safe in all databases
+supported by Django.
 
 ``SlugField``
 -------------
@@ -917,7 +919,8 @@ of some other value.  You can do this automatically in the admin using
 .. class:: SmallIntegerField([**options])
 
 Like an :class:`IntegerField`, but only allows values under a certain
-(database-dependent) point.
+(database-dependent) point. Values from -32768 to 32767 are safe in all databases
+supported by Django.
 
 ``TextField``
 -------------
diff --git a/docs/ref/settings.txt b/docs/ref/settings.txt
index eb470cdd14..8ef59064f7 100644
--- a/docs/ref/settings.txt
+++ b/docs/ref/settings.txt
@@ -280,6 +280,12 @@ CACHE_MIDDLEWARE_ANONYMOUS_ONLY
 
 Default: ``False``
 
+.. deprecated:: 1.6
+
+    This setting was largely ineffective because of using cookies for sessions
+    and CSRF. See the :doc:`Django 1.6 release notes</releases/1.6>` for more
+    information.
+
 If the value of this setting is ``True``, only anonymous requests (i.e., not
 those made by a logged-in user) will be cached.  Otherwise, the middleware
 caches every page that doesn't have GET or POST parameters.
@@ -287,8 +293,6 @@ caches every page that doesn't have GET or POST parameters.
 If you set the value of this setting to ``True``, you should make sure you've
 activated ``AuthenticationMiddleware``.
 
-See :doc:`/topics/cache`.
-
 .. setting:: CACHE_MIDDLEWARE_KEY_PREFIX
 
 CACHE_MIDDLEWARE_KEY_PREFIX
diff --git a/docs/releases/1.6.txt b/docs/releases/1.6.txt
index 60b3381dd6..f8e1fd6339 100644
--- a/docs/releases/1.6.txt
+++ b/docs/releases/1.6.txt
@@ -238,6 +238,9 @@ Minor features
   Meta option: ``localized_fields``. Fields included in this list will be localized
   (by setting ``localize`` on the form field).
 
+* The ``choices`` argument to model fields now accepts an iterable of iterables
+  instead of requiring an iterable of lists or tuples.
+
 Backwards incompatible changes in 1.6
 =====================================
 
@@ -491,6 +494,11 @@ Miscellaneous
   memcache backend no longer uses the default timeout, and now will
   set-and-expire-immediately the value.
 
+* The ``django.contrib.flatpages`` app used to set custom HTTP headers for
+  debugging purposes. This functionality was not documented and made caching
+  ineffective so it has been removed, along with its generic implementation,
+  previously available in ``django.core.xheaders``.
+
 Features deprecated in 1.6
 ==========================
 
@@ -561,6 +569,23 @@ If necessary, you can temporarily disable auto-escaping with
 :func:`~django.utils.safestring.mark_safe` or :ttag:`{% autoescape off %}
 <autoescape>`.
 
+``CACHE_MIDDLEWARE_ANONYMOUS_ONLY`` setting
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+``CacheMiddleware`` used to provide a way to cache requests only if they
+weren't made by a logged-in user. This mechanism was largely ineffective
+because the middleware correctly takes into account the ``Vary: Cookie`` HTTP
+header, and this header is being set on a variety of occasions, such as:
+
+* accessing the session, or
+* using CSRF protection, which is turned on by default, or
+* using a client-side library which sets cookies, like `Google Analytics`__.
+
+This makes the cache effectively work on a per-session basis regardless of the
+``CACHE_MIDDLEWARE_ANONYMOUS_ONLY`` setting.
+
+__ http://www.google.com/analytics/
+
 ``SEND_BROKEN_LINK_EMAILS`` setting
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
diff --git a/docs/topics/cache.txt b/docs/topics/cache.txt
index a7d54fbeb0..46911a593f 100644
--- a/docs/topics/cache.txt
+++ b/docs/topics/cache.txt
@@ -443,15 +443,9 @@ Then, add the following required settings to your Django settings file:
 The cache middleware caches GET and HEAD responses with status 200, where the request
 and response headers allow. Responses to requests for the same URL with different
 query parameters are considered to be unique pages and are cached separately.
-Optionally, if the :setting:`CACHE_MIDDLEWARE_ANONYMOUS_ONLY`
-setting is ``True``, only anonymous requests (i.e., not those made by a
-logged-in user) will be cached. This is a simple and effective way of disabling
-caching for any user-specific pages (including Django's admin interface). Note
-that if you use :setting:`CACHE_MIDDLEWARE_ANONYMOUS_ONLY`, you should make
-sure you've activated ``AuthenticationMiddleware``. The cache middleware
-expects that a HEAD request is answered with the same response headers as
-the corresponding GET request; in which case it can return a cached GET
-response for HEAD request.
+The cache middleware expects that a HEAD request is answered with the same
+response headers as the corresponding GET request; in which case it can return
+a cached GET response for HEAD request.
 
 Additionally, the cache middleware automatically sets a few headers in each
 :class:`~django.http.HttpResponse`:
diff --git a/docs/topics/http/sessions.txt b/docs/topics/http/sessions.txt
index acad61eb2a..0f2955fadd 100644
--- a/docs/topics/http/sessions.txt
+++ b/docs/topics/http/sessions.txt
@@ -125,6 +125,17 @@ and the :setting:`SECRET_KEY` setting.
 
 .. warning::
 
+    **If the :setting:`SECRET_KEY` is not kept secret, this can lead to
+    arbitrary remote code execution.**
+
+    An attacker in possession of the :setting:`SECRET_KEY` can not only
+    generate falsified session data, which your site will trust, but also
+    remotely execute arbitrary code, as the data is serialized using pickle.
+
+    If you use cookie-based sessions, pay extra care that your secret key is
+    always kept completely secret, for any system which might be remotely
+    accessible.
+
     **The session data is signed but not encrypted**
 
     When using the cookies backend the session data can be read by the client.
diff --git a/docs/topics/i18n/translation.txt b/docs/topics/i18n/translation.txt
index 5b4ffea528..72e000a86f 100644
--- a/docs/topics/i18n/translation.txt
+++ b/docs/topics/i18n/translation.txt
@@ -722,6 +722,31 @@ or with the ``{#`` ... ``#}`` :ref:`one-line comment constructs <template-commen
         msgid "Ambiguous translatable block of text"
         msgstr ""
 
+.. templatetag:: language
+
+Switching language in templates
+-------------------------------
+
+If you want to select a language within a template, you can use the
+``language`` template tag:
+
+.. code-block:: html+django
+
+    {% load i18n %}
+
+    {% get_current_language as LANGUAGE_CODE %}
+    <!-- Current language: {{ LANGUAGE_CODE }} -->
+    <p>{% trans "Welcome to our page" %}</p>
+
+    {% language 'en' %}
+        {% get_current_language as LANGUAGE_CODE %}
+        <!-- Current language: {{ LANGUAGE_CODE }} -->
+        <p>{% trans "Welcome to our page" %}</p>
+    {% endlanguage %}
+
+While the first occurrence of "Welcome to our page" uses the current language,
+the second will always be in English.
+
 .. _template-translation-vars:
 
 Other tags
@@ -1126,13 +1151,11 @@ active language. Example::
 
 .. _reversing_in_templates:
 
-.. templatetag:: language
-
 Reversing in templates
 ----------------------
 
 If localized URLs get reversed in templates they always use the current
-language. To link to a URL in another language use the ``language``
+language. To link to a URL in another language use the :ttag:`language`
 template tag. It enables the given language in the enclosed template section:
 
 .. code-block:: html+django