| Age | Commit message (Collapse) | Author |
|
Thanks to Andi Albrecht for his work on this patch, and to everyone else that contributed during design and development.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11709 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
removed, and turned on by default.
This is a large change to CSRF protection for Django. It includes:
* removing the dependency on the session framework.
* deprecating CsrfResponseMiddleware, and replacing with a core template tag.
* turning on CSRF protection by default by adding CsrfViewMiddleware to
the default value of MIDDLEWARE_CLASSES.
* protecting all contrib apps (whatever is in settings.py)
using a decorator.
For existing users of the CSRF functionality, it should be a seamless update,
but please note that it includes DEPRECATION of features in Django 1.1,
and there are upgrade steps which are detailed in the docs.
Many thanks to 'Glenn' and 'bthomas', who did a lot of the thinking and work
on the patch, and to lots of other people including Simon Willison and
Russell Keith-Magee who refined the ideas.
Details of the rationale for these changes is found here:
http://code.djangoproject.com/wiki/CsrfProtection
As of this commit, the CSRF code is mainly in 'contrib'. The code will be
moved to core in a separate commit, to make the changeset as readable as
possible.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11660 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
(i.e. JSON, etc.). Thanks, phyfus.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11656 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
comments. Thanks kaikuehne.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10801 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
calling commit via transaction.managed(False). Thanks seanl for report and patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10621 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
test client. Thanks to Rick Wagner for his help identifying and fixing this problem.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10513 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
assertNotContains. Thanks to trbs for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10414 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
args/kwargs it might be called with. Thanks seanl.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10248 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
the logout method on the test client on an unauthenticated user, based on patch from ericholscher.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10228 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
The tests and testing framework should use failUnless() instead.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10100 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
this because Brett Cannon borrowed the time machine and brought Python 2.7's '`importlib` back for inclusion in Django. Thanks for the patch-from-the-future, Brett!
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10088 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
from the test client. Thanks to James Bennett for the design, and Julien Phalip for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10084 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
This permits running Django's core tests under an alternative test runner. Most
likely useful to non-CPython implementations, rather than much else (since
Django's core tests might assume things about the test runner).
Patch from Leo Soto.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@9918 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
This implements browser-like behavior for the test client, following redirect chains when a 30X response is received. Thanks to Marc Fargas and Keith Bussell for their work on this.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@9911 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
specific test case method doesn't name a valid test case class. Thanks to Thomas Guettler for the suggestion and patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@9879 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks to schmichael for the report and patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@9847 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
added code that iterates over them, thus broke running tests on Python 2.3, sigh.)
git-svn-id: http://code.djangoproject.com/svn/django/trunk@9769 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
database supports it) instead of flushing and reloading the database. This can substantially reduce the time it takes to run large test suites.
This change may be slightly backwards incompatible, if existing tests need to test transactional behavior, or if they rely on invalid assumptions or a specific test case ordering. For the first case, django.test.TransactionTestCase should be used. TransactionTestCase is also a quick fix to get around test case errors revealed by the new rollback approach, but a better long-term fix is to correct the test case. See the testing doc for full details.
Many thanks to:
* Marc Remolt for the initial proposal and implementation.
* Luke Plant for initial testing and improving the implementation.
* Ramiro Morales for feedback and help with tracking down a mysterious PostgreSQL issue.
* Eric Holscher for feedback regarding the effect of the change on the Ellington testsuite.
* Russell Keith-Magee for guidance and feedback from beginning to end.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@9756 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
documentation for details on usage.
Many thanks to:
* Nicolas Lara, who worked on this feature during the 2008 Google Summer of Code.
* Alex Gaynor for his help debugging and fixing a number of issues.
* Justin Bronn for his help integrating with contrib.gis.
* Karen Tracey for her help with cross-platform testing.
* Ian Kelly for his help testing and fixing Oracle support.
* Malcolm Tredinnick for his invaluable review notes.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@9742 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
with Python 2.3/2.4. Thanks to Karen Tracey for the report and fix.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@9465 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
the underlying views. Thanks to sime for the suggestion.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@9398 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
test client. Thanks to david for the report.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@9397 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
environment. Thanks to Adam Lofts for the report.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@9396 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
and OPTIONS support. Thanks Scott Barr and Leah Culver.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@9188 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
for the report.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@9066 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
META, rather than the integer 80. Thanks to Adam Lofts for the report and fix.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@8655 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks to lakin.wecker@gmail.com for the report and Eric Holscher for the patch and test case.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@8372 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
creation and introspection modules. Introduces a new validation module for DB-specific validation. This is a backwards incompatible change; see the wiki for details.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@8296 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
result is that signals are up to 90% faster.
Though some attempts and backwards-compatibility were made, speed trumped compatibility. Thus, as usual, check BackwardsIncompatibleChanges for the complete list of backwards-incompatible changes.
Thanks to Jeremy Dunck and Keith Busell for the bulk of the work; some ideas from Brian Herring's previous work (refs #4561) were incorporated.
Documentation is, sigh, still forthcoming.
Fixes #6814 and #3951 (with the new dispatch_uid argument to connect).
git-svn-id: http://code.djangoproject.com/svn/django/trunk@8223 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
equivalents). Basically, URL resolving will only use the PATH_INFO and the
SCRIPT_NAME will be prepended by reverse() automatically. Allows for more
portable development and installation. Also exposes SCRIPT_NAME in the
HttpRequest instance.
There are a number of cases where things don't work completely transparently,
so mod_python and fastcgi users should read the relevant docs.
Fixed #285, #1516, #3414.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@8015 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
comparators, and added a wrapper to allow comparison of xml fragments. Thanks to Leo Soto for the report and fix.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@8003 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
that, folks. :-(
git-svn-id: http://code.djangoproject.com/svn/django/trunk@7995 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Still needs:
- testing
- docs changes
- some way of fixing reverse().
git-svn-id: http://code.djangoproject.com/svn/django/trunk@7991 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
JSON an XML outputs. This is required so that output ordering that doesn't matter at a semantic level (such as the order of keys in a JSON dictionary, or attributes in an XML element) isn't caught as a test failure. Thanks to Leo Soto for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@7981 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@7949 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
property, rather than a function on certain database backends. Thanks to Leo Soto for the fix.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@7940 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
order to test the problem the test client now handles uploading multiple files at once. Patch from Mike Axiak.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@7858 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@7821 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@7820 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
A description of the new features can be found in the new [http://www.djangoproject.com/documentation/upload_handing/ upload handling documentation]; the executive summary is that Django will now happily handle uploads of large files without issues.
This changes the representation of uploaded files from dictionaries to bona fide objects; see BackwardsIncompatibleChanges for details.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@7814 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
of a TestCase. Thanks to Mark Fargas (telenieko) for his work on this patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@7805 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
raised by a view is caught and re-raised. Thanks for the report, test case, and fix, Chris Wagner.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@7583 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks for the suggestion and implementation, J. Pablo Fernandez <pupeno@pupeno.com>.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@7578 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
behavior when uploading files. Now, only the file name is sent, rather than the full path. Thanks for the report, cpinto.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@7577 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
gets run through urllib.unquote()). Patch from Leo Shklovskii and Russell
Keith-Magee.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@7330 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Found by Bastian Kleineidam with help from pyflakes. Thanks.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@7131 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
"sessionid" in the test client. Thanks, Bastian Kleineidam.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@7058 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Bastian Kleineidam.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@7056 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@7032 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
exceptions during pre-test setup are now reported as test failures, rather than crashing the entire test framework. Thanks, Thomas Guttler <hv@tbz-pariv.de>.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@7023 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|