summaryrefslogtreecommitdiff
path: root/django/http/request.py
AgeCommit message (Collapse)Author
2019-07-01[2.2.x] Fixed CVE-2019-12781 -- Made HttpRequest always trust ↵Carlton Gibson
SECURE_PROXY_SSL_HEADER if set. An HTTP request would not be redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings were used if the proxy connected to Django via HTTPS. HttpRequest.scheme will now always trust the SECURE_PROXY_SSL_HEADER if set, rather than falling back to the request scheme when the SECURE_PROXY_SSL_HEADER did not have the secure value. Thanks to Gavin Wahl for the report and initial patch suggestion, and Shai Berger for review. Backport of 54d0f5e62f54c29a12dd96f44bacd810cbe03ac8 from master
2019-01-16Fixed #20147 -- Added HttpRequest.headers.Santiago Basulto
2018-09-25Normalized spelling of "lowercase" and "lowercased".Jon Dufresne
2018-08-02Fixed #29627 -- Fixed QueryDict.urlencode() crash with non-string values.Tim Graham
Regression in 7d96f0c49ab750799860e42716d7105e11de44de.
2018-07-16Fixed django/http/request.py docstring typo.François Freitag
2018-07-10Simplified HttpRequest.__iter__().Sergey Fedoseev
2018-06-07Removed unused HttpRequest._post_parse_error attribute.Josh Schneier
Unused since 8f8c54f70bfa3aa8e311514297f1eeded2c32593.
2018-02-07Refs #27795 -- Replaced force_bytes() usage in django.http.Tim Graham
2018-01-10Fixed #28828 -- Improved performance of HttpRequest.build_absolute_uri().George-Cristian Bîrzan
2018-01-03Fixed #28982 -- Simplified code with and/or.Дилян Палаузов
2017-12-26Fixed #28930 -- Simplified code with any() and all().Дилян Палаузов
2017-11-07Fixed #28720 -- Added HttpRequest.get_full_path_info().Jonas Haag
2017-08-23Removed unneeded iter() calls.Sergey Fedoseev
A few of these were unnecessarily added in 2b281cc35ed9d997614ca3c416928d7fabfef1ad.
2017-04-26Fixed #28137 -- Deprecated HttpRequest.xreadlines().Josh Schneier
2017-02-20Refs #27656 -- Updated django.forms/http docstring verbs according to PEP 257.Anton Samarchyan
2017-01-26Refs #23919, #27778 -- Removed obsolete mentions of unicode.Vytis Banaitis
2017-01-25Refs #23919 -- Replaced super(ClassName, self) with super().chillaranand
2017-01-22Refs #23919 -- Replaced six.reraise by raiseClaude Paroz
2017-01-20Refs #23919 -- Removed unneeded str() callsClaude Paroz
2017-01-20Refs #23919 -- Removed unneeded force_str callsClaude Paroz
2017-01-19Refs #23919 -- Stopped inheriting from object to define new style classes.Simon Charette
2017-01-18Refs #23919 -- Removed most of remaining six usageClaude Paroz
Thanks Tim Graham for the review.
2017-01-18Refs #23919 -- Removed six.<various>_types usageClaude Paroz
Thanks Tim Graham and Simon Charette for the reviews.
2017-01-18Refs #23919 -- Removed six.PY2/PY3 usageClaude Paroz
Thanks Tim Graham for the review.
2017-01-18Refs #23919 -- Removed encoding preambles and future importsClaude Paroz
2016-11-29Fixed #27181 -- Allowed contrib.sites to match domains with trailing ".".Anton Samarchyan
2016-11-17Fixed #27156 -- Made changing HttpRequest.encoding clear GET.PREMANAND
2016-11-01Fixed CVE-2016-9014 -- Validated Host header when DEBUG=True.Tim Graham
This is a security fix.
2016-09-03Replaced smart_* by force_* calls whenever possibleClaude Paroz
The smart_* version should only be used when a lazy string should keep its lazy status.
2016-08-11Fixed #27046 -- Supported IPv6-formatted IPv4 addresses in host validation.Tim Graham
Thanks LaMont Jones for the report and patch.
2016-08-03Fixed #27005 -- Fixed crash if request.META[''CONTENT_LENGTH']=''.Tim Graham
2016-06-06Fixed #26707 -- Added QueryDict.fromkeys()wim glenn
2016-05-12Fixed #21231 -- Enforced a max size for GET/POST values read into memory.Andre Cruz
Thanks Tom Christie for review.
2016-05-03Refs #22897 -- Removed unneeded empty string QueryDict argument.Tim Graham
2016-02-10Fixed #26014 -- Added WSGIRequest content_type and content_params attributes.Curtis Maloney
Parsed the CONTENT_TYPE header once and recorded it on the request.
2016-01-25Fixed #26125 -- Fixed E731 flake warnings.userimack
2015-09-16Fixed #24496 -- Added CSRF Referer checking against CSRF_COOKIE_DOMAIN.Matt Robenolt
Thanks Seth Gottlieb for help with the documentation and Carl Meyer and Joshua Kehn for reviews.
2015-09-04Fixed #25099 -- Fixed crash in AdminEmailHandler on DisallowedHost.Vlastimil Zíma
2015-08-31Fixed #25331 -- Removed trailing blank lines in docstrings.Maxime Lorant
2015-08-04Fixed #25211 -- Added HttpRequest.get_port() and USE_X_FORWARDED_PORT setting.Matt Robenolt
2015-07-13Fixed #25099 -- Cleaned up HttpRequest representations in error reporting.Vlastimil Zíma
2015-05-13Removed unnecessary arguments in .get method callsPiotr Jakimiak
2015-03-26Fixed #19910 -- Added slash to i18n redirect if APPEND_SLASH is set.Bas Peschier
This introduces a force_append_slash argument for request.get_full_path() which is used by RedirectFallbackMiddleware and CommonMiddleware when handling redirects for settings.APPEND_SLASH.
2015-03-11Fixed #24463 -- Removed mod_python functionality from HttpRequest._get_scheme()Rik
2015-02-06Sorted imports with isort; refs #23860.Tim Graham
2014-12-08Fixed #23968 -- Replaced list comprehension with generators and dict ↵Jon Dufresne
comprehension
2014-11-24Removed unused variable django.http.request.absolute_http_url_reMatt Robenolt
2014-11-20Fixed #12098 -- Simplified HttpRequest.__repr__().Berker Peksag
2014-11-03Fixed #18456 -- Added path escaping to HttpRequest.get_full_path().Unai Zalakain
2014-09-05Limited lines to 119 characters in django/Tim Graham
refs #23395.
generated by cgit v1.3 (git 2.53.0) at 2026-07-06 10:17:09 +0000