summaryrefslogtreecommitdiff
path: root/django/utils
AgeCommit message (Collapse)Author
2019-07-31[1.11.x] Fixed CVE-2019-14235 -- Fixed potential memory exhaustion in ↵Florian Apolloner
django.utils.encoding.uri_to_iri(). Thanks to Guido Vranken for initial report.
2019-07-29[1.11.x] Fixed CVE-2019-14233 -- Prevented excessive HTMLParser recursion in ↵Florian Apolloner
strip_tags() when handling incomplete HTML entities. Thanks to Guido Vranken for initial report.
2019-07-29[1.11.X] Fixed CVE-2019-14232 -- Adjusted regex to avoid backtracking issues ↵Florian Apolloner
when truncating HTML. Thanks to Guido Vranken for initial report.
2019-02-11[1.11.x] Fixed CVE-2019-6975 -- Fixed memory exhaustion in ↵Carlton Gibson
utils.numberformat.format(). Thanks Sjoerd Job Postmus for the report and initial patch. Thanks Michael Manfre, Tim Graham, and Florian Apolloner for review. Backport of 402c0caa851e265410fbcaa55318f22d2bf22ee2 from master.
2018-07-25[1.11.x] Fixed CVE-2018-14574 -- Fixed open redirect possibility in ↵Andreas Hug
CommonMiddleware.
2018-02-27[1.11.x] Fixed CVE-2018-7537 -- Fixed catastrophic backtracking in ↵Tim Graham
django.utils.text.Truncator. Thanks James Davis for suggesting the fix.
2018-02-27[1.11.x] Fixed CVE-2018-7536 -- Fixed catastrophic backtracking in urlize ↵Tim Graham
and urlizetrunc template filters. Thanks Florian Apolloner for assisting with the patch.
2017-08-31[1.11.x] Fixed #28487 -- Fixed runserver crash with non-Unicode system ↵Mark Rogaski
encodings on Python 2 + Windows.
2017-07-13[1.11.x] Fixed #28174 -- Fixed crash in runserver's autoreload with Python 2 ↵Mark Rogaski
on Windows with non-str environment variables.
2017-07-12[1.11.x] Fixed #28389 -- Fixed pickling of LazyObject on Python 2 when ↵Sergey Fedoseev
wrapped object doesn't have __reduce__(). Partial revert of 35355a4ffedb2aeed52d5fe3034380ffc6a438db.
2017-05-10[1.11.x] Fixed #28142 -- Fixed is_safe_url() crash on invalid IPv6 URLs.UmanShahzad
Backport of 856072dd4a3e479aa09b0ab6b498ff599ca2a809 from master
2017-04-04[1.11.x] Fixed #27912, CVE-2017-7233 -- Fixed is_safe_url() with numeric URLs.Tim Graham
This is a security fix.
2017-03-04[1.11.x] Fixed #27900 -- Made escapejs escape backticks for use in ES6 ↵Tim Graham
template literals. Backport of 6ae1b04fb584db0fdb22b8e287784c4ed3ac62ac from master
2017-01-25[1.11.x] Removed unused variables that are overwritten.Mads Jensen
Backport of ebf34c3cdcd2c75349c60a064427ac255958bf9b from master
2017-01-19[1.11.x] Fixed django/utils/http.py comment typo.Tim Graham
Backport of d29fd3f9a63f1e515fa8ed863b08a5389938b05f from master
2017-01-14Fixed #27699 -- Added negative timedelta support to parse_duration()Jinank Jain
2017-01-02Refs #27637 -- Fixed timesince, timeuntil on New Year's Eve in a leap year.vinay karanam
2016-12-28Fixed #27628 -- Fixed unarchiving a file without permission data.Anton Samarchyan
2016-12-28Fixed #27647 -- Fixed Windows segmentation fault in runserver autoreload.Aleksi Häkli
2016-12-27Fixed #27648 -- Deprecated (iLmsu) regex groups in url() patterns.Tim Graham
2016-12-27Fixed #27637 -- Fixed timesince, timeuntil in leap year edge case.Mariusz Felisiak
2016-12-21Fixed #25753 -- Made get_format() cache the formats from Django settingsJaap Roes
2016-12-14Used ternary if/else in utils.lorem_ipsum.words().Michael Lelyakin
2016-12-09Fixed #27583 -- Fixed MultiValueDict.getlist() crash when values for key is ↵Mariusz Felisiak
None. Restored the behavior before 727d7ce6cba21363470aaefb2dc5353017531be3.
2016-12-06Fixed #26494 -- Made Archive.extract() preserve file permissions.Anton Samarchyan
2016-12-01Fixed #27546 -- Removed hardcoded class names in __repr__() methods.Keda87
2016-11-29Fixed #27555 -- Removed django.utils.functional.lazy_property.Adam Chainz
2016-11-23Cleaned up some __getstate__() docstrings.Tim Graham
2016-11-14Fixed #27463 -- Fixed E741 flake8 warnings.Ramin Farajpour Cami
2016-11-14Fixed E305 flake8 warnings.Ramin Farajpour Cami
2016-11-14Decorated a few functions.Tim Graham
2016-11-07Fixed #27138 -- Restored pre-Python 3.6 behavior of localtime() and ↵Joachim Jablon
make_naive() on Python 3.6. Reverted test changes in a7a7ecd2b026c61a39a46d2d7eced0e06a92c970 and e43ea36b7681e43ea99505a2cf7550d4d36016b3 (refs #27025).
2016-11-07Fixed #27454 -- Skipped gettext calls for apps without a locale dir.Carl Meyer
2016-10-31Fixed #27063 -- Prevented i18n_patterns() from using too much of the URL as ↵Krzysztof Urbaniak
the language.
2016-10-27Fixed #27327 -- Simplified time zone handling by requiring pytz.Tim Graham
2016-10-20Removed note about obsolete Python versionClaude Paroz
2016-10-14Refs #19705 -- Changed gzip modification times to 0.Kevin Christopher Henry
This makes gzip output deterministic, which allows ConditionalGetMiddleware to reliably compare ETags on gzipped content (views using the gzip_page() decorator in particular).
2016-10-12Fixed #19705 -- Set proper headers on conditional Not Modified responses.Kevin Christopher Henry
2016-10-11Added missing roles/options to parse_color_setting()'s docstring.Nick Pope
2016-10-10Fixed #26447 -- Deprecated settings.USE_ETAGS in favor of ↵Denis Cornehl
ConditionalGetMiddleware.
2016-10-04Fixed #27309 -- Added CallableBool.__hash__().Reto Aebersold
2016-10-01Refs #26940 -- Re-allowed makemessages without settingsClaude Paroz
Thanks Tim Graham for the review.
2016-09-28Fixed #27226 -- Removed patch_response_headers()'s setting of the ↵Rinat Khabibiev
Last-Modified header.
2016-09-27Fixed #27271 -- Fixed a crash in runserver logging.Sergey Fursov
Allowed ServerFormatter to handle simple string messages or messages with formatting arguments. The formatter will set the server_time variable on the log record if it's required by the format string but wasn't passed in extra parameters.
2016-09-23Removed unused regexes from django.utils.html.Jon Dufresne
Last uses removed in commit 8b81dee60c1533e714a310fa5c3907356042a64c.
2016-09-17Refs #27025 -- Fixed "invalid escape sequence" warnings in Python 3.6.Tim Graham
http://bugs.python.org/issue27364
2016-09-16Refs #27083 -- Updated conditional header comparison to match RFC 7232.Kevin Christopher Henry
2016-09-16Fixed #27198 -- Made MultiValueDict.getlist() return a new list to prevent ↵Jani Tiainen
mutation.
2016-09-10Fixed #27083 -- Added support for weak ETags.Kevin Christopher Henry
2016-09-07Refs #26956 -- Allowed is_safe_url() to validate against multiple hostsJon Dufresne
generated by cgit v1.3 (git 2.53.0) at 2026-11-13 10:15:03 +0000