summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2016-03-01Fixed CVE-2016-2512 -- Prevented spoofing is_safe_url() with basic auth.Mark Striemer
This is a security fix.
2016-03-01Added stub release notes for security issues.Tim Graham
2016-03-01Fixed #26217 -- Added a warning about format strings to WeekArchiveView docs.Michal Petrucha
2016-03-01Fixed #26165 -- Added some FAQs about CSRF protection.acemaster
Thanks Florian Apolloner and Shai Berger for review.
2016-03-01Fixed typos in docs/ref/models/meta.txt.Taranjeet
2016-03-01Fixed #26229 -- Improved check for model admin check admin.E124Alasdair Nicol
Refs #22792
2016-02-29Fixed #26186 -- Documented how app relative relationships of abstract models ↵Simon Charette
behave. This partially reverts commit bc7d201bdbaeac14a49f51a9ef292d6312b4c45e. Thanks Tim for the review. Refs #25858.
2016-02-29Removed obsolete test CreatesuperuserManagementCommandTestCase.test_nolocale.Jon Dufresne
Test was added in 4c934f3921a59c7b3e088f6472b6f6da40848567 to verify that the commend works when locale.getdefaultlocale() doesn't return a locale. getdefaultlocale() no longer runs at runtime, so the test isn't needed.
2016-02-29Removed unused 'Between' lookup.Adam Chainz
It was added in 20bab2cf9d02a5c6477d8aac066a635986e0d3f3 and stopped being used for `Range` in 00aa562884a418c4ee20e223ab82c3455997ee7d when `bilateral` was added to `Transform`.
2016-02-28Minor fixes for release-process doc fixShai Berger
As suggested by Tim Graham
2016-02-28Fixed docs: release-process, Supported Versions section, concrete exampleShai Berger
Security & data loss fixes are applied to the two last feature releases, not just one. Thanks Loic Bistuer for review
2016-02-27Fixed #26230 -- Made default_related_name affect related_query_name.chenesan
2016-02-27Fixed #26275 -- Noted difference between o and Y date format chars.inondle
2016-02-26Fixed #26264 -- Fixed prefetch_related() crashes with values_list(flat=True)Attila Tovt
2016-02-26Fixed #21608 -- Prevented logged out sessions being resurrected by ↵Tore Lundqvist
concurrent requests. Thanks Simon Charette for the review.
2016-02-26Fixed #26286 -- Prevented content type managers from sharing their cache.Simon Charette
This should prevent managers methods from returning content type instances registered to foreign apps now that these managers are also attached to models created during migration phases. Thanks Tim for the review. Refs #23822.
2016-02-26Added 'prefetches to docs/spelling_wordlist.Tim Graham
2016-02-26Fixed #25279 -- Made prefetch_related_objects() public.Adam Chainz
2016-02-26Fixed #24974 -- Fixed inheritance of formfield_callback for ↵Yoong Kang Lim
modelform_factory forms.
2016-02-26Fixed #24793 -- Unified temporal difference support.Simon Charette
2016-02-26Used setUpTestData for the timedelta expression tests.Simon Charette
2016-02-26Fixed #24653 -- Fixed MySQL database introspection when using read_default_file.zshimanchik
2016-02-26Cleaned up session backends tests.Simon Charette
Made SessionTestsMixin backend agnostic and removed code obsoleted by the test discovery refactor.
2016-02-26Fixed #26280 -- Fixed cached template loader crash when loading nonexistent ↵Ivan Tsouvarev
template.
2016-02-26Fixed #25811 -- Added a helpful error when making _in queries across ↵Edwar Baron
different databases.
2016-02-25Removed try/fail antipattern from model_options tests.Tim Graham
2016-02-25Fixed #26231 -- Used .get_username in admin login template.Sjoerd Job Postmus
2016-02-25Fixed #26269 -- Prohibited spaces in is_valid_ipv6_address().Nick Malakhov
2016-02-25Corrected a run on sentence in doc/topics/db/models.txt.Tim Graham
2016-02-25Fixed #26151 -- Refactored MigrationWriter.serialize()Yoong Kang Lim
Thanks Markus Holtermann for review.
2016-02-25Fixed #26117 -- Consulted database routers in initial migration detection.Scott Sexton
Thanks Simon Charette for help.
2016-02-25Fixed #26278 -- Clarified apps.ready docs.Tim Graham
2016-02-25Refs #26270 -- Reorganized TestCase docs.Tim Graham
2016-02-25Fixed #12233 -- Allowed redirecting authenticated users away from the login ↵Olivier Le Thanh Duong
view. contrib.auth.views.login() has a new parameter `redirect_authenticated_user` to automatically redirect authenticated users visiting the login page. Thanks to dmathieu and Alex Buchanan for the original code and to Carl Meyer for the help and review.
2016-02-25Fixed #14098 -- Prevented crash for introspection errors in inspectdbClaude Paroz
Thanks Tim Graham for the review.
2016-02-24Fixed a function signature in docs/topics/auth/default.txt.Tim Graham
2016-02-24Used addCleanup() to call recorder.flush() in migration loader tests.Tim Graham
2016-02-24Fixed #26266 -- Output the primary key in the GeoJSON serializer propertiesClaude Paroz
Thanks Tim Graham for the review.
2016-02-24Removed docs of deprecated SimpleTestCase warnings behavior.Tim Graham
Removed in Django 1.7 (4f6be9a0c43050500af598527e1453d27c5c5b85).
2016-02-24Fixed #26267 -- Fixed BoundField to reallow slices of subwidgets.Jon Dufresne
2016-02-23Fixed #23832 -- Added timezone aware Storage API.James Aylett
New Storage.get_{accessed,created,modified}_time() methods convert the naive time from now-deprecated {accessed,created_modified}_time() methods into aware objects in UTC if USE_TZ=True.
2016-02-23Fixed #26232 -- Fixed Popen mocking environment in i18n testsClaude Paroz
Refs #25925. Thanks Jeroen Pulles for the report.
2016-02-23Used setupTestData in prefetch_related tests.Simon Charette
2016-02-23Prevented static file corruption when URL fragment contains '..'.Aymeric Augustin
When running collectstatic with a hashing static file storage backend, URLs referencing other files were normalized with posixpath.normpath. This could corrupt URLs: for example 'a.css#b/../c' became just 'c'. Normalization seems to be an artifact of the historical implementation. It contained a home-grown implementation of posixpath.join which relied on counting occurrences of .. and /, so multiple / had to be collapsed. The new implementation introduced in the previous commit doesn't suffer from this issue. So it seems safe to remove the normalization. There was a test for this normalization behavior but I don't think it's a good test. Django shouldn't modify CSS that way. If a developer has rendundant /s, it's mostly an aesthetic issue and it isn't Django's job to fix it. Conversely, if the user wants a series of /s, perhaps in the URL fragment, Django shouldn't destroy it. Refs #26249.
2016-02-23Fixed #26249 -- Fixed collectstatic crash for files in STATIC_ROOT ↵Aymeric Augustin
referenced by absolute URL. collectstatic crashed when: * a hashing static file storage backend was used * a static file referenced another static file located directly in STATIC_ROOT (not a subdirectory) with an absolute URL (which must start with STATIC_URL, which cannot be empty) It seems to me that the current code reimplements relative path joining and doesn't handle edge cases correctly. I suspect it assumes that STATIC_URL is of the form r'/[^/]+/'. Throwing out that code in favor of the posixpath module makes the logic easier to follow. Handling absolute paths correctly also becomes easier.
2016-02-23Fixed a stray __unicode__() method in auth_tests.Tim Graham
2016-02-23Fixed #25670 -- Allowed dictsort to sort a list of lists.Andrew Kuchev
Thanks Tim Graham for the review.
2016-02-23Fixed #26263 -- Deprecated Context.has_key()Tim Graham
2016-02-23Used call_command return value in staticfiles testsClaude Paroz
Refs #26190.
2016-02-23Fixed #26190 -- Returned handle() result from call_commandClaude Paroz
Thanks Tim Graham for the review.
generated by cgit v1.3 (git 2.53.0) at 2026-08-14 21:49:57 +0000