summaryrefslogtreecommitdiff
path: root/django/core
AgeCommit message (Collapse)Author
2025-06-06[5.1.x] Refs CVE-2025-48432 -- Made SuspiciousOperation logging use ↵Natalia
log_response() for consistency. Backport of ff835f439cb1ecd8d74a24de12e3c03e5477dc9d from main.
2025-04-07[5.1.x] Fixed #36298 -- Truncated the overwritten file content in ↵Sarah Boyce
file_move_safe(). Regression in 58cd4902a71a3695dd6c21dc957f59c333db364c. Thanks Baptiste Mispelon for the report. Backport of 8ad3e80e88201f4c557f6fa79fcfc0f8a0961830 from main.
2025-04-02[5.1.x] Fixed CVE-2025-27556 -- Mitigated potential DoS in ↵Sarah Boyce
url_has_allowed_host_and_scheme() on Windows. Thank you sw0rd1ight for the report. Backport of 39e2297210d9d2938c75fc911d45f0e863dc4821 from main.
2025-02-17[5.1.x] Fixed #36191 -- Truncated the overwritten file content in ↵Gaël Utard
FileSystemStorage. Backport of 0d1dd6bba0c18b7feb6caa5cbd8df80fbac54afd from main.
2024-10-28[5.1.x] Refs #34900 -- Removed usage of deprecated glob.glob1().earthyoung
Backport of 555f2412cba4c5844408042e92f3bf9fa5c2392c from main.
2024-10-17[5.1.x] Fixed #35845 -- Updated DomainNameValidator to require entire string ↵Justin Thurman
to be a valid domain name. Bug in 4971a9afe5642569f3dcfcd3972ebb39e88dd457. Thank you to kazet for the report and Claude Paroz for the review. Backport of 99dcc59237f384d7ade98acfd1cae8d90e6d60ab from main.
2024-08-28[5.1.x] Refs #35326 -- Adjusted deprecation warning stacklevel in ↵Simon Charette
FileSystemStorage.OS_OPEN_FLAGS. Backport of 47f18a722624527cc72eef44cfc9d1e07ea4b4e0 from main.
2024-07-24[5.1.x] Fixed #35604, Refs #35326 -- Made FileSystemStorage.exists() ↵Sarah Boyce
behaviour independent from allow_overwrite. Partially reverts 0b33a3abc2ca7d68a24f6d0772bc2b9fa603744e. Storage.exists(name) was documented to "return False if the name is available for a new file." but return True if the file exists. This is ambiguous in the overwrite file case. It will now always return whether the file exists. Thank you to Natalia Bidart and Josh Schneier for the review. Backport of 8d6a20b656ff3fa18e36954668a44a831c2f6ddd from main.
2024-07-09[5.1.x] Fixed CVE-2024-39330 -- Added extra file name validation in ↵Natalia
Storage's save method. Thanks to Josh Schneier for the report, and to Carlton Gibson and Sarah Boyce for the reviews.
2024-05-21Fixed #18119 -- Added a DomainNameValidator validator.Berker Peksag
Thanks Claude Paroz for the review. Co-authored-by: Nina Menezes <77671865+nmenezes0@users.noreply.github.com>
2024-05-21Fixed #35326 -- Added allow_overwrite parameter to FileSystemStorage.Ben Cail
2024-05-10Fixed #35429 -- Added argparse choices to --database options.SaJH
2024-04-26Made confirmation prompt in squashmigrations consistent with other prompts.Cole D
Prior to this change, squashmigrations would use a [yN] prompt to ask for user confirmation. A slash was added between the yes/no options to make it consistent with other commands that print similar prompts.
2024-04-05Fixed #35354 -- Simplified ASGIRequest path handling.Carlton Gibson
Following the ASGI HTTP Connection Scope docs[0], the provided `path` is already the correct value that Django requires. In combination with `root_path`, from which `script_name` is derived, the `path_info` variable is set. It's then redundant to re-calculate `path` from `script_name` and `path_info`. See also, a clarifying discussion on the ASGIref repo[1]. [0]: https://asgi.readthedocs.io/en/latest/specs/www.html#http-connection-scope [1]: https://github.com/django/asgiref/issues/424
2024-03-27Fixed #35233 -- Moved template engine system checks to backend methods.Giannis Terzopoulos
Thanks Adam Johnson for reviews.
2024-03-24Fixed #35323 -- Prevented file_move_safe() from trying to overwrite existing ↵Ben Cail
file when allow_overwrite is False.
2024-03-21Fixed #35320 -- Removed unnecessary django.core.files.move._samefile() hook.Ben Cail
os.path.samefile() uses the same implementation on Windows as all other platforms since Python 3.4.
2024-03-15Refs #34900 -- Fixed SafeMIMEText.set_payload() crash on Python 3.13.Mariusz Felisiak
Payloads with surrogates are passed to the set_payload() since https://github.com/python/cpython/commit/f97f25ef5dfcdfec0d9a359fd970abd139cf3428
2024-03-09Moved --failfast to DiscoverRunner.Adam Johnson
2024-03-01Made runserver close database connections from migration checks.Florian Apolloner
2024-02-20Fixed #23759 -- Preserved all file extensions in Storage.get_available_name().Adam Zapletal
2024-02-20Fixed #35236 -- Used Field.attname/column attributes instead of ↵Adam Johnson
get_attname()/get_attname_column().
2024-02-19Fixed #35229 -- Made URL custom error handler check run once.Adam Johnson
2024-02-13Fixed #35122 -- Made migrate --prune option respect --app_label.Moein Bbp
2024-01-31Fixed #35059 -- Ensured that ASGIHandler always sends the request_finished ↵James Thorniley
signal. Prior to this work, when async tasks that process the request are cancelled due to receiving an early "http.disconnect" ASGI message, the request_finished signal was not being sent, potentially leading to resource leaks (such as database connections). This branch ensures that the request_finished signal is sent even in the case of early termination of the response. Regression in 64cea1e48f285ea2162c669208d95188b32bbc82. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Co-authored-by: Carlton Gibson <carlton.gibson@noumenal.es>
2024-01-31Fixed #35159 -- Fixed dumpdata crash when base querysets use prefetch_related().Mariusz Felisiak
Regression in 139135627650ed6aaaf4c755b82c3bd43f2b8f51 following deprecation in edbf930287cb72e9afab1f7208c24b1146b0c4ec. Thanks Andrea F for the report.
2024-01-26Applied Black's 2024 stable style.Mariusz Felisiak
https://github.com/psf/black/releases/tag/24.1.0
2024-01-17Fixed #31700 -- Made makemigrations command display meaningful symbols for ↵Amir Karimi
each operation.
2024-01-16Improved --list-tags help text for check management command.David Sanders
Co-authored-by: David Sanders <shang.xiao.sanders@gmail.com>
2023-12-31Fixed #35051 -- Prevented runserver from removing non-zero Content-Length ↵Paul Bailey
for HEAD requests.
2023-11-24Fixed #34983 -- Deprecated django.utils.itercompat.is_iterable().Nick Pope
2023-11-24Fixed #34818 -- Prevented GenericIPAddressField from mutating error messages.Parth Verma
Co-authored-by: Parth Verma <parth.verma@gmail.com>
2023-11-13Fixed #34952 -- Copied dir list when processing locale folders to avoid ↵Andrew Cordery
missing entries during os.walk traversal. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2023-11-09Fixed #34457 -- Restored output for makemigrations --check.Adam Johnson
Co-authored-by: David Sanders <shang.xiao.sanders@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2023-10-28Fixed #34943 -- Made EmailValidator.__eq__() ignore domain_allowlist ordering.ksg
Signed-off-by: ksg97031 <ksg97031@gmail.com>
2023-10-25Fixed #34904 -- Prevented mutating sent emails from outbox in locmem email ↵sindre
backend.
2023-10-24Fixed #34920 -- Made FileExtensionValidator.__eq__() ignore ↵ksg97031
allowed_extensions ordering.
2023-09-22Fixed #34848 -- Ignored i18n_catalog.js file when building Django's ↵Natalia
translations catalog.
2023-09-18Refs #26029 -- Removed DEFAULT_FILE_STORAGE and STATICFILES_STORAGE settings.Mariusz Felisiak
This also removes django.core.files.storage.get_storage_class(). Per deprecation timeline.
2023-09-18Refs #33199 -- Removed support for passing positional arguments to ↵Mariusz Felisiak
Signer/TimestampSigner. Per deprecation timeline.
2023-09-11Fixed #34752 -- Fixed handling ASGI http.disconnect for streaming responses.Sam Toyer
2023-09-11Fixed #34642 -- Added File.open() support for *args and **kwargs.Yves Weissig
2023-09-03Refs #34768 -- Ignored lack of just_fix_windows_console() for colorama < 0.4.6.Mariusz Felisiak
2023-09-01Fixed #34778 -- Avoided importing modules in startapp/startproject.Jacob Walls
2023-09-01Fixed #34768 -- Avoided initializing colorama on non-Windows platforms.Sulabh Katila
2023-08-19Fixed #34779 -- Avoided unnecessary selection of non-nullable m2m fields ↵Juan Alvarez
without natural keys during serialization. By using `select_related(None)` instead of `select_related()`, the unnecessary joins are completely avoided. Note that the current tests already covers the change, when the field is not `null=True`. Regression in f9936deed1ff13b20e18bd9ca2b0750b52706b6c.
2023-07-27Simplified call_command() calls.Nick Pope
2023-07-17Refs #34118 -- Improved sanitize_address() error message for tuple with ↵Mariusz Felisiak
empty strings.
2023-07-03Fixed CVE-2023-36053 -- Prevented potential ReDoS in EmailValidator and ↵Mariusz Felisiak
URLValidator. Thanks Seokchan Yoon for reports.
2023-06-28Fixed #34681 -- Optimized memcache_key_warnings().Adam Johnson
generated by cgit v1.3 (git 2.53.0) at 2026-11-13 16:55:53 +0000