summaryrefslogtreecommitdiff
path: root/django/core
AgeCommit message (Collapse)Author
2021-06-02[3.2.x] Fixed CVE-2021-33571 -- Prevented leading zeros in IPv4 addresses.Mariusz Felisiak
validate_ipv4_address() was affected only on Python < 3.9.5, see [1]. URLValidator() uses a regular expressions and it was affected on all Python versions. [1] https://bugs.python.org/issue36384
2021-05-19[3.2.x] Fixed #32740 -- Caught possible exception when initializing colorama.Carlton Gibson
Backport of c2e6047c725e26987c87e2be59f2ab4bf9828fa5 from main
2021-05-18[3.2.x] Fixed #32747 -- Prevented initialization of unused caches.Mariusz Felisiak
Thanks Alexander Ebral for the report. Regression in 98e05ccde440cc9b768952cc10bc8285f4924e1f. Backport of 958cdf65ae90d26236d1815bbba804729595ec7a from main
2021-05-13[3.2.x] Fixed #32718 -- Relaxed file name validation in FileField.Mariusz Felisiak
- Validate filename returned by FileField.upload_to() not a filename passed to the FileField.generate_filename() (upload_to() may completely ignored passed filename). - Allow relative paths (without dot segments) in the generated filename. Thanks to Jakub Kleň for the report and review. Thanks to all folks for checking this patch on existing projects. Thanks Florian Apolloner and Markus Holtermann for the discussion and implementation idea. Regression in 0b79eb36915d178aef5c6a7bbce71b1e76d376d3. Backport of b55699968fc9ee985384c64e37f6cc74a0a23683 from main
2021-05-06[3.2.x] Fixed #32713, Fixed CVE-2021-32052 -- Prevented newlines and tabs ↵Mariusz Felisiak
from being accepted in URLValidator on Python 3.9.5+. In Python 3.9.5+ urllib.parse() automatically removes ASCII newlines and tabs from URLs [1, 2]. Unfortunately it created an issue in the URLValidator. URLValidator uses urllib.urlsplit() and urllib.urlunsplit() for creating a URL variant with Punycode which no longer contains newlines and tabs in Python 3.9.5+. As a consequence, the regular expression matched the URL (without unsafe characters) and the source value (with unsafe characters) was considered valid. [1] https://bugs.python.org/issue43882 and [2] https://github.com/python/cpython/commit/76cd81d60310d65d01f9d7b48a8985d8ab89c8b4 Backport of e1e81aa1c4427411e3c68facdd761229ffea6f6f from main.
2021-05-04[3.2.x] Fixed CVE-2021-31542 -- Tightened path & file name sanitation in ↵Florian Apolloner
file uploads.
2021-04-21[3.2.x] Fixed #32665 -- Fixed caches system check crash when ↵Mariusz Felisiak
STATICFILES_DIRS is a list of 2-tuples. Thanks Jared Lockhart for the report. Regression in c36075ac1dddfa986340b1a5e15fe48833322372. Backport of 34d1905712d33e72c76b3a55a4fc24abbd11be6c from main
2021-02-05[3.2.x] Fixed #32420 -- Fixed detecting primary key values in ↵Mikolaj Rybinski
deserialization when PK is also a FK. Backport of 8e90560aa8868a42bb8eda6273595bf0932a6090 from master
2021-01-12Fixed #32291 -- Added fixtures compression support to dumpdata.Paolo Melchiorre
2021-01-12Refs #32311 -- Fixed CSRF_FAILURE_VIEW system check errors code.Hasan Ramezani
2021-01-12Fixed #32311 -- Added system check for CSRF_FAILURE_VIEW setting.Hasan Ramezani
2021-01-06Refs #32191 -- Added Signer.sign_object()/unsign_object().Florian Apolloner
Co-authored-by: Craig Smith <hello@craigiansmith.com.au>
2021-01-04Fixed #32298 -- Fixed URLValidator hostname length validation.Akshat1Nar
URLValidator now validates the maximum length of a hostname without the userinfo and port.
2020-12-29Fixed #32299 -- Prevented mutating handlers when processing middlewares ↵Mariusz Felisiak
marking as unused in an async context. Thanks Hubert Bielenia for the report.
2020-12-29Used model's Options.label where applicable.Mariusz Felisiak
Follow up to b7a3a6c9ef0a89625881b47594120bca55fa2e49.
2020-12-17Fixed #29867 -- Added support for storing None value in caches.Nick Pope
Many of the cache operations make use of the default argument to the .get() operation to determine whether the key was found in the cache. The default value of the default argument is None, so this results in these operations assuming that None is not stored in the cache when it actually is. Adding a sentinel object solves this issue. Unfortunately the unmaintained python-memcached library does not support a default argument to .get(), so the previous behavior is preserved for the deprecated MemcachedCache backend.
2020-12-15Fixed typo in django/core/cache/backends/base.py docstring.Abhishek Ghaskata
2020-12-14Fixed #32240 -- Made runserver suppress ↵Petter Strandmark
ConnectionAbortedError/ConnectionResetError errors. See https://bugs.python.org/issue27682 and https://github.com/python/cpython/pull/9713
2020-12-14Ensured that registered checks accept keyword arguments.Adam Johnson
2020-12-09Fixed #32193 -- Deprecated MemcachedCache.Mariusz Felisiak
2020-12-08Fixed #32233 -- Cleaned-up duplicate connection functionality.Florian Apolloner
2020-12-07Refs #21012 -- Removed unnecessary _create_cache() hook.Florian Apolloner
This removes unused (since d038c547b5ce585cbf9ef5bb7e5298f52e4a243b) workaround to load a cache backend with its dotted import path and moves remaining logic to the CacheHandler. Thanks Tim Graham for the review.
2020-11-13Fixed #29712 -- Made makemessages warn if locales have hyphens and skip them.manav014
2020-11-11Fixed #31216 -- Added support for colorama terminal colors on Windows.MinchinWeb
Modern setups on Windows support terminal colors. The colorama library may also be used, as an alternative to the ANSICON library.
2020-11-11Fixed #31757 -- Adjusted system check for SECRET_KEY to warn about ↵Artem Kosenko
autogenerated default keys. Thanks Nick Pope, René Fleschenberg, and Carlton Gibson for reviews.
2020-11-11Fixed #32180 -- Added system check for file system caches absolute location.Carles Pina i Estany
2020-11-11Fixed #32183 -- Fixed shell crash when passing code with nested scopes.William Schwartz
2020-11-10Fixed #32177 -- Made execute_from_command_line() use program name from the ↵William Schwartz
argv argument. This caused crash in environments where sys.argv[0] is incorrectly set to None.
2020-11-04Fixed #31983 -- Added system check for file system caches location.christa
Thanks Johannes Maron and Nick Pope for reviews.
2020-10-30Fixed #32153 -- Fixed management commands when using required list options.Hasan Ramezani
Thanks Mark Gajdosik for the report and initial patch.
2020-10-28Made small readability improvements.Martin Thoma
2020-10-27Fixed #32128 -- Added asgiref 3.3 compatibility.Carlton Gibson
Thread sensitive parameter is True by default from asgiref v3.3.0. Added an explicit thread_sensitive=False to previously implicit uses.
2020-10-09Fixed #32094 -- Fixed flush() calls on management command self.stdout/err ↵Thomas Riccardi
proxies.
2020-10-05Refs #29838, Refs #28507 -- Made make_hashable() ignore key order.Simon Charette
2020-09-30Fixed #32047 -- Fixed call_command() crash if a constant option from ↵Hasan Ramezani
required mutually exclusive group is passed in options.
2020-09-30Fixed #30422 -- Made TemporaryFileUploadHandler handle interrupted uploads.aryan
This patch allows upload handlers to handle interrupted uploads. Co-Authored-By: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2020-09-21Fixed #31777 -- Added support for database collations to Char/TextFields.Tom Carrick
Thanks Simon Charette and Mariusz Felisiak for reviews.
2020-09-17Tweaked loaddata command to re-use a calculated value.Владимир Лысенко
Removed a dublicated call to get_public_serializer_formats which had already populated self.serialization_formats. Thanks to Nick Pope for review.
2020-09-16Fixed #29887 -- Added a cache backend for pymemcache.Nick Pope
2020-09-15Fixed #31989 -- Fixed return value of ↵Hasan Ramezani
django.core.files.locks.lock()/unlock() on POSIX systems.
2020-09-09Fixed #31962 -- Made SessionMiddleware raise SessionInterrupted when session ↵Hasan Ramezani
destroyed while request is processing.
2020-09-02Refs #29887, Refs #24212 -- Added servers configuration hook for memcached ↵Nick Pope
backends. The servers property can be overridden to allow memcached backends to alter the server configuration prior to it being passed to instantiate the client. This allows avoidance of documentation for per-backend differences, e.g. stripping the 'unix:' prefix for pylibmc.
2020-09-01Refs #29887 -- Simplified memcached client instantiation.Nick Pope
2020-09-01Fixed CVE-2020-24584 -- Fixed permission escalation in intermediate-level ↵Mariusz Felisiak
directories of the file system cache on Python 3.7+.
2020-09-01Fixed CVE-2020-24583, #31921 -- Fixed permissions on intermediate-level ↵Mariusz Felisiak
static and storage directories on Python 3.7+. Thanks WhiteSage for the report.
2020-08-24Fixed #31907 -- Fixed missing validate_key() calls in cache backends.Nick Pope
2020-08-20Refs #29887, #27480 -- Moved touch() to BaseMemcachedCache.Nick Pope
2020-08-20Fixed comments related to nonexistent keys for incr()/decr() in memcached ↵Nick Pope
backends.
2020-08-13Refs #31811 -- Added optional timing outputs to the test runner.Ahmad A. Hussein
2020-08-06Fixed #25513 -- Extracted admin pagination to Paginator.get_elided_page_range().Nick Pope
generated by cgit v1.3 (git 2.53.0) at 2026-07-13 21:57:13 +0000