summaryrefslogtreecommitdiff
path: root/django/contrib
AgeCommit message (Collapse)Author
2026-04-29Fixed #35951 -- Mentioned server timezone in admin DateTime widgets.Vedran Karacic
The existing note that is shown to the users when entering a time value from a different timezone than the server's timezone was not descriptive enough and led to confusion. This commit updates the note to explicitly state that the user should enter times in the server's timezone.
2026-04-28Refs #15759 -- Fixed ModelAdmin.list_editable form submission for ↵Artyom Kotovskiy
non-editable instances. Added formset that excludes objects for which user has no permission for POST formset as well. Fixed regression test: the test was not simulating real behaviour properly. By providing full form data for the post request we skipped the part where the user was actually limited in permissions and only modified some of the rows. Improved tests by getting rid of obj.id % 2 approach for granting permissions per object for users, since it is not the safest. Instead granting permissions simply by 'alive' parameter, which is simpler and more stable. Bug in 84db026228413dda4cd195464554d51c0b208e32.
2026-04-28Fixed #36990 -- Bumped OpenLayers to 10.9.0.VIZZARD-X
2026-04-27Fixed #36901 -- Centralized auth timing attack mitigations.afenoum
Thank you Mar Bartolome and Tim Schilling for reviews.
2026-04-24Fixed #36542 -- Marked authenticate() with @sensitive_variables() decorator.KANIN KEARPIMY
Thanks Olivier Dalang, Tim McCurrach, Sarah Boyce, and Mar Bartolome for reviews.
2026-04-22Fixed #10919 -- Added delete_confirmation_max_display to ModelAdmin.Rodrigo Vieira
The new ModelAdmin.delete_confirmation_max_display attribute allows limiting the number of related objects shown on the delete confirmation page. When the limit is reached, a "…and N more objects." message is shown. The feature relies on a new truncated_unordered_list template filter added to django.contrib.admin.templatetags.admin_filters. Thanks Jacob Tyler Walls for the review and guidance, Tobias McNulty for the report, and terminator14 for the solution suggested.
2026-04-22Refs #10919 -- Refactored walk_items as module-level _walk_items and added ↵Rodrigo Vieira
truncated_unordered_list filter.
2026-04-22Fixed #35870 -- Made blank choice label in forms more accessible.Annabelle Wiegart
Added new constant django.db.models.fields.BLANK_CHOICE_LABEL for an accessible and translatable blank choice label in forms. Deprecated django.db.models.fields.BLANK_CHOICE_DASH constant. Added the immediately deprecated transitional setting USE_BLANK_CHOICE_DASH. Co-Authored-By: Marijke Luttekes <mail@marijkeluttekes.dev>
2026-04-22Fixed #35943 -- Replaced unload event listener with pagehide.Amar
Co-authored-by: Peter van der Does <peter@oneilinteractive.com> Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
2026-04-22Fixed #15759 -- Excluded fields by per-object permissions for ↵Artyom Kotovskiy
ModelAdmin.list_editable. Instead of going over all objects in a queryset and filtering by user permissions, added skipping while saving the formset so there is no need to refetch objects again.
2026-04-22Refs #15759 -- Factored out _save_formset() in ModelAdmin.Artyom Kotovskiy
2026-04-19Formatted JavaScript files.Tom Carrick
2026-04-19Fixed #37024 -- Made SITE_ID system check validation use Site._meta.pk.Tim Graham
2026-04-18Formatted CSS files.Tom Carrick
2026-04-18Fixed #37028 -- Added BitAnd(), BitOr(), and BitXor() aggregates.Mariusz Felisiak
2026-04-14Fixed #37029 -- Corrected placement of </div> in change_list.html's ↵Tim Graham
pagination block. Bug in 3f59711581bd22ebd0f13fb040b15b69c0eee21f.
2026-04-07Fixed #37021 -- Added Permission.user_perm_str property.mariatta
For use in checking user permissions via has_perm(). Co-authored-by: 사재혁 <jaehyuck.sa.dev@gmail.com>
2026-04-07Fixed CVE-2026-4292 -- Disallowed instance creation via ↵Jacob Walls
ModelAdmin.list_editable. Thanks Natalia Bidart, Jake Howard, and Markus Holtermann for reviews.
2026-04-07Fixed CVE-2026-4277 -- Checked add permissions in GenericInlineModelAdmin.Jacob Walls
Edit permissions were still checked as part of ordinary form validation, but because GenericInlineModelAdmin overrides get_formset(), it lacked InlineModelAdmin's dynamic DeleteProtectedModelForm.has_changed() logic for checking permissions server-side, leaving the add case unaddressed. This change reimplements the relevant part of InlineModelAdmin.get_formset(). Thanks N05ec@LZU-DSLab for the report, and Natalia Bidart, Markus Holtermann, and Simon Charette for reviews.
2026-04-06Fixed #37009 -- Fixed alignment of "Show/Hide counts" icons in admin changelist.kyb
2026-04-02Fixed #36949 -- Improved RelatedFieldWidgetWrapper <label>s.David Smith
Regression in 4187da258fe212d494cb578a0bc2b52c4979ab95.
2026-04-02Fixed #37017 -- Fixed setting or clearing of request.user after ↵Jacob Walls
alogin/alogout(). Regression in 31a43c571f4d036827d4fd7a5f615591637dc1be.
2026-03-24Fixed #36976 -- Made admin action counter a live region for screen readers.davitacols
2026-03-24Fixed #36985 -- Skipped CreateExtension backwards operation on ↵varunkasyap
non-PostgreSQL databases.
2026-03-18Fixed #36926 -- Made admin use boolean icons for related BooleanFields in ↵huwaiza tahir
list_display. When using related field lookups like 'parent__is_active' in list_display, the admin now correctly detects if the final field is a BooleanField and displays boolean icons instead of 'True'/'False' text. Modified lookup_field() in django/contrib/admin/utils.py to retrieve the final field from the path when traversing relations using LOOKUP_SEP (__), allowing display_for_field() to properly handle BooleanFields.
2026-03-13Fixed #36885 -- Fixed long verbose names in admin filter sidebar breaking ↵Muhammad Usman
layout.
2026-03-12Refs #36727 -- Factored out _must_transform_value() in BaseSpatialOperations.Simon Charette
2026-03-12Fixed #36727 -- Deprecated Field.get_placeholder in favor of ↵Simon Charette
get_placeholder_sql. The lack of ability of the get_placeholder call chain to return SQL and parameters separated so they can be mogrified by the backend at execution time forced implementations to dangerously interpolate potentially user controlled values. The get_placeholder_sql name was chosen due to its proximity to the previous method, but other options such as Field.as_sql were considered but ultimately rejected due to its different input signature compared to Expression.as_sql that might have lead to confusion. There is a lot of overlap between what Field.get_db_prep_value and get_placeholder_sql do but folding the latter in the former would require changing its return signature to return expression which is a way more invasive change than what is proposed here. Given we always call get_db_prep_value it might still be an avenue worth exploring in the future to offer a publicly documented interface to allow field to take an active part in the compilation chain. Thanks Jacob for the review.
2026-03-11Refs #28455 -- Avoided QuerySet cloning for Prefetch() when queryset is not ↵Keryn Knight
provided. Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2026-03-11Refs #28455 -- Avoided QuerySet cloning in simple prefetch_related() usages.Keryn Knight
manager.get_queryset() always returns freshly instantiated per-instance QuerySet which doesn't need subsequent cloning. Based on work originally done by Anssi Kääriäinen and Tim Graham.
2026-03-06Fixed #36968 -- Improved error message when collectstatic can't find a ↵James Bligh
referenced file.
2026-03-06Refs #28877 -- Added special ordinal context when humanizing value 1.Julien Palard
Some languages use a different ordinal suffix for the number 1 than for other values ending in 1 (e.g. 21, 31). Added a dedicated pgettext context "ordinal is 1" to allow translators to handle this distinction. For example, in French, 1 is written as "1er" while 21, 31, etc. use "21e", "31e", etc. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2026-03-04Fixed #21080 -- Ignored urls inside comments during collectstatic.James Bligh
Thanks Mariusz Felisiak for the review. Co-authored-by: Nathan Gaberel <nathan@gnab.fr>
2026-03-03Fixed #36887 -- Improved admin changelist layout for object-tools button.Jacob Walls
2026-02-28Refs #36513 -- Fixed font-color to also apply to select options in ↵Antoliny0919
TabularInline.
2026-02-28Fixed #36914 -- Fixed background-color to also apply to select options in ↵Antoliny0919
TabularInline.
2026-02-27Fixed #27489 -- Renamed permissions upon model renaming in migrations.Artyom Kotovskiy
Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
2026-02-27Fixed #34643 -- Moved inputs beneath labels and errors in admin forms.antoliny0919
Thanks Sarah Boyce and Jacob Walls for reviews. Co-authored-by: Hrushikesh Vaidya <hrushikeshrv@gmail.com>
2026-02-25Fixed #36948 -- Fixed breadcrumb text overlap at small widths in admin.Amar
Visual regression in bc03f1064e10fa247a46d4e8a98ba9b26aa4790d.
2026-02-25Fixed #36839 -- Warned when model renames encounter conflicts from stale ↵AbhimanyuGit2507
ContentTypes.
2026-02-25Refs #36873 -- Fixed changelink background image Y position.Antoliny0919
2026-02-25Fixed #36873 -- Aligned and normalized stroke width for non-multiple select ↵Antoliny0919
icons in related-widget-wrapper.
2026-02-21Fixed #36899 -- Implemented SessionBase.__bool__.Amar
2026-02-21Fixed #36935 -- Added fallback in ContentType.app_labeled_name when ↵Marco Aurélio da Rosa Haubrich
model_class() is None. Updated ContentType.app_labeled_name to include the app_label in its string representation. This removed ambiguity for content types whose models were not present in the current codebase (for example, when multiple applications share the same database). Adjusted related tests to reflect the new representation.
2026-02-20Fixed #36920 -- Fixed alignment of fieldset legends in wide admin forms.usman
Visual regression in 4187da258fe212d494cb578a0bc2b52c4979ab95.
2026-02-20Fixed #36127 -- Applied default empty display value to links otherwise ↵SiHyunLee
containing only whitespace in admin.
2026-02-13Fixed #36857 -- Added QuerySet.totally_ordered property.VIZZARD-X
Thanks Simon Charette for the idea.
2026-02-13Fixed #36513 -- Improved text contrast for admin M2M multi-select widget.Nilesh Kumar Pahari
Explicitly set the text color for the admin M2M widget to ensure selected rows remain readable in browsers like Microsoft Edge and Firefox when the widget was not focused.
2026-02-11Fixed #36921 -- Fixed KeyError in inline form for model not registered with ↵Sean Helvey
admin. Regression in b1ffa9a9d78b0c2c5ad6ed5a1d84e380d5cfd010.
2026-02-10Fixed #36903 -- Fixed further NameErrors when inspecting functions with ↵93578237
deferred annotations. Provide a wrapper for safe introspection of user functions on Python 3.14+. Follow-up to 601914722956cc41f1f2c53972d669ddee6ffc04.
generated by cgit v1.3 (git 2.53.0) at 2026-06-30 23:15:00 +0000