summaryrefslogtreecommitdiff
path: root/django/utils/http.py
AgeCommit message (Collapse)Author
2017-02-11Refs #27656 -- Updated django.utils docstring verbs according to PEP 257.Anton Samarchyan
2017-01-26Refs #23919 -- Replaced usage of django.utils.http utilities with Python ↵Claude Paroz
equivalents Thanks Tim Graham for the review.
2017-01-22Refs #23919 -- Replaced six.reraise by raiseClaude Paroz
2017-01-20Refs #23919 -- Removed unneeded str() callsClaude Paroz
2017-01-19Fixed django/utils/http.py comment typo.Tim Graham
2017-01-18Refs #23919 -- Removed most of remaining six usageClaude Paroz
Thanks Tim Graham for the review.
2017-01-18Refs #23919 -- Removed six.PY2/PY3 usageClaude Paroz
Thanks Tim Graham for the review.
2017-01-18Refs #23919 -- Removed encoding preambles and future importsClaude Paroz
2016-09-10Fixed #27083 -- Added support for weak ETags.Kevin Christopher Henry
2016-09-07Refs #26956 -- Allowed is_safe_url() to validate against multiple hostsJon Dufresne
2016-08-19Fixed #26902 -- Allowed is_safe_url() to require an https URL.Przemysław Suliga
Thanks Andrew Nester, Berker Peksag, and Tim Graham for reviews.
2016-05-12Fixed #21231 -- Enforced a max size for GET/POST values read into memory.Andre Cruz
Thanks Tom Christie for review.
2016-05-03Fixed #26567 -- Updated references to obsolete RFC2616.Vasiliy Faronov
Didn't touch comments where it wasn't obvious that the code adhered to the newer standard.
2016-04-06Removed unused django.utils.http.PROTOCOL_TO_PORT.Tim Graham
Unused since b0c56b895fd2694d7f5d4595bdbbc41916607f45.
2016-03-04Added safety to URL decoding in is_safe_url() on Python 2Claude Paroz
The errors='replace' parameter to force_text altered the URL before checking it, which wasn't considered sane. Refs 24fc935218 and ada7a4aef.
2016-03-04Fixed #26308 -- Prevented crash with binary URLs in is_safe_url()Claude Paroz
This fixes a regression introduced by c5544d28923. Thanks John Eskew for the reporti and Tim Graham for the review.
2016-03-01Fixed CVE-2016-2512 -- Prevented spoofing is_safe_url() with basic auth.Mark Striemer
This is a security fix.
2016-01-05Fixed #26024 -- Fixed regression in ConditionalGetMiddleware ETag support.Denis Cornehl
Thanks Denis Cornehl for help with the patch.
2015-12-12Fixed #20223 -- Added keep_lazy() as a replacement for allow_lazy().Iacopo Spalletti
Thanks to bmispelon and uruz for the initial patch.
2015-09-16Fixed #24496 -- Added CSRF Referer checking against CSRF_COOKIE_DOMAIN.Matt Robenolt
Thanks Seth Gottlieb for help with the documentation and Carl Meyer and Joshua Kehn for reviews.
2015-03-18Made is_safe_url() reject URLs that start with control characters.Tim Graham
This is a security fix; disclosure to follow shortly.
2015-02-12Fixed #24321 -- Improved `utils.http.same_origin` compliance with RFC6454Lukas Klein
2015-02-06Sorted imports with isort; refs #23860.Tim Graham
2015-01-13Fixed is_safe_url() to handle leading whitespace.Tim Graham
This is a security fix. Disclosure following shortly.
2014-09-08Fixed #23399 -- Optimized django.utils.http.int_to_bas36()Tim Graham
Thanks liminspace for the patch and Keryn Knight for benchmarking.
2014-08-22Fixed #23333 -- Made urlsafe_base64_decode() return proper type on Python 3.Ian Foote
2014-07-09Fixed #22223 -- Prevented over-escaping URLs in reverse()Claude Paroz
And follow more closely the class of characters defined in the RFC 3986. Thanks Erik van Zijst for the report and the initial patch, and Tim Graham for the review.
2014-05-14typo: urlaprse -> urlparseCollin Anderson
2014-05-14Added additional checks in is_safe_url to account for flexible parsing.Erik Romijn
This is a security fix. Disclosure following shortly.
2013-11-02Correct flake8 E302 violationsRay Ashman Jr
2013-11-02Correct flake8 violation E261Ray Ashman Jr
2013-10-26Fixed up some more flake8 violations (this particular violation still has ↵Alex Gaynor
many occurrences in the tests/ dir so it can't be removed from setup.cfg yet)
2013-10-21Fixed #21288 -- Fixed E126 pep8 warningsAlasdair Nicol
2013-09-22Removed a few trailing backslashes.Aymeric Augustin
We have always been at war with trailing backslashes.
2013-09-05Took advantage of django.utils.six.moves.urllib.*.Aymeric Augustin
2013-09-02Replaced "not PY3" by "PY2", new in six 1.4.0.Aymeric Augustin
2013-08-13Fixed is_safe_url() to reject URLs that use a scheme other than HTTP/S.Jacob Kaplan-Moss
This is a security fix; disclosure to follow shortly.
2013-08-07Use `usegmt` flag in formatdateDavid Evans
Slightly cleaner and faster than string manipulation. This flag has been available since Python 2.4: http://docs.python.org/2/library/email.util.html#email.utils.formatdate
2013-06-26Fixed #14881 -- Modified password reset to work with a non-integer UserModel.pk.Tim Graham
uid is now base64 encoded in password reset URLs/views. A backwards compatible password_reset_confirm view/URL will allow password reset links generated before this change to continue to work. This view will be removed in Django 1.7. Thanks jonash for the initial patch and claudep for the review.
2013-05-19Fix a typo in a comment.Marc Tamlyn
2013-05-18Fixed #20411 -- Don't let invalid referers blow up CSRF same origin checks.Florian Apolloner
Thanks to edevil for the report and saz for the patch.
2013-03-28Fixed spelling errorsGavin Wahl
2013-03-19Fixed #18003 -- Preserved tracebacks when re-raising errors.konarkmodi
Thanks jrothenbuhler for draft patch, Konark Modi for updates.
2012-12-10Fixed #18856 -- Ensured that redirects can't be poisoned by malicious users.Florian Apolloner
2012-09-26Fixed parse_http_date docstring and moved related testsClaude Paroz
Refs #18675.
2012-08-30Replaced some smart_xxx by force_xxx equivalentClaude Paroz
smart_str/smart_text should only be used when a potential lazy string should be preserved in the result of the function call.
2012-08-14[py3] Fixed conditional_processing testsClaude Paroz
2012-08-07[py3] Ported django.utils.encoding.Aymeric Augustin
* Renamed smart_unicode to smart_text (but kept the old name under Python 2 for backwards compatibility). * Renamed smart_str to smart_bytes. * Re-introduced smart_str as an alias for smart_text under Python 3 and smart_bytes under Python 2 (which is backwards compatible). Thus smart_str always returns a str objects. * Used the new smart_str in a few places where both Python 2 and 3 want a str.
2012-08-03[py3] Removed uses of sys.maxint under Python 3.Aymeric Augustin
Also fixed #18706: improved exceptions raised by int_to_base36.
2012-07-22[py3] Updated urllib/urllib2/urlparse imports.Aymeric Augustin
Lots of functions were moved. Use explicit imports in all cases to keey it easy to identify where the functions come from.
generated by cgit v1.3 (git 2.53.0) at 2026-07-06 04:06:34 +0000