summaryrefslogtreecommitdiff
path: root/django/utils
AgeCommit message (Collapse)Author
2014-05-12[1.4.x] Added additional checks in is_safe_url to account for flexible parsing.Tim Graham
This is a security fix. Disclosure following shortly.
2014-03-24[1.4.x] Updated six to 1.6.1.Tim Graham
Backport of 2ec82c7387db071278201796208808de84c90dbf from master
2014-01-26[1.4.x] Fixed #21823 -- Upgraded six to 1.5.2Tim Graham
Backport of 780ae7e9f8 from master.
2014-01-02Updated six to version 1.4.1Luke Plant
This is not a bugfix. But six only exists on Django 1.4.x branch to help with future compatibility, so it is helpful if it keeps up with latest Django.
2013-11-02Fixed #21362 -- Restored Python 2.5 compatibility.Florian Apolloner
2013-10-21[1.4.x] Fixed #21253 -- PBKDF2 with cached HMAC keyFlorian Apolloner
This gives a 2x speed increase compared to the existing implementation. Thanks to Steve Thomas for the initial patch and Tim Graham for finishing it. Backport of 1e4f53a6eb8d1816e51eb8bd8f95e704f6b89ead from master.
2013-10-13[1.4.x] Fixed #21256 -- Error in datetime_safe.datetime.combine.Aymeric Augustin
Backport of d9b6fb8 from master
2013-09-24[1.4.x] Fixed #21138 -- Increased the performance of our PBKDF2 implementation.Florian Apolloner
Thanks go to Michael Gebetsroither for pointing out this issue and help on the patch. Backport of 68540fe4df44492571bc610a0a043d3d02b3d320 from master.
2013-08-13Fixed is_safe_url() to reject URLs that use a scheme other than HTTP/S.Jacob Kaplan-Moss
This is a security fix; disclosure to follow shortly.
2012-12-10[1.4.X] Fixed #18856 -- Ensured that redirects can't be poisoned by ↵Florian Apolloner
malicious users.
2012-10-23[1.4.x] Fix an HTML-parser test that's failed in Python 2.6.8 since 5c79dd58.Carl Meyer
The problem description in #18239 asserted that http://bugs.python.org/issue670664 was fixed in Python 2.6.8, but based on http://bugs.python.org/issue670664#msg146770 it appears that's not correct; the fix was only applied in 2.7, 3.2, and Python trunk. Therefore we must use our patched HTMLParser subclass in all Python 2.6 versions. Backport of fcec904e4f from master. Fixes #19148.
2012-10-13[1.4.x] Fixed #18881 -- Made the context option in {% trans %} and {% ↵Julien Phalip
blocktrans %} accept literals wrapped in single quotes. Thanks to lanyjie for the report.
2012-09-07[1.4.x] [py3] Added forwards-compatible aliases.Aymeric Augustin
Related documentation will go to the master branch, since there's no Python 3 documentation in the 1.5 branch.
2012-08-16[1.4.x] Fixed #18239 -- Subclassed HTMLParser only for selected Python versionsRaphaël Hertzog
Only Python versions affected by http://bugs.python.org/issue670664 should patch HTMLParser.
2012-03-22Fixed #17937 -- Avoided an error in the timeuntil filter when it receives a ↵Aymeric Augustin
date object. Thanks Dmitry Guyvoronsky for the report. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17774 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-03-12Fixed #17873 -- Removed stale code from translation utilities that should ↵Jannis Leidel
have been removed a while ago. Thanks, Aymeric Augustin. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17684 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-03-03Made django.utils.timezone.localtime a private API -- it's too specific to ↵Aymeric Augustin
the template engine. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17642 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-03-01Fixed #17730 - Renamed django.utils.htmlparser to django.utils.html_parser ↵Carl Meyer
to avoid shadowing stdlib HTMLParser in rare case-sensitivity situations. Thanks un33k for the report and gldnspud for the patch. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17607 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-02-26Fixed #17715 -- Updated the tutorial for time zone support, plus a few other ↵Aymeric Augustin
improvements. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17591 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-02-23Improved get_random_string().Paul McMillan
Improved the behavior of get_random_string to re-seed itself each time it is called if the system does not have a secure random number generator. This will change the properties of the random string produced, but will be unpredictable to an attacker. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17581 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-02-23Cleanup to use get_random_string consistently.Paul McMillan
Removes several ad hoc implementations of get_random_string() and removes an innapropriate use of settings.SECRET_KEY. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17580 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-02-18Fixed #17720 -- Stopped the LocaleMiddleware from overeagerly using the ↵Jannis Leidel
request path for language activation if it's actually not wanted. Thanks to Anssi Kääriäinen for the initial patch. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17547 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-02-16Use Python's changed comparisons, which makes this a bit more readable.Alex Gaynor
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17526 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-02-16Fixed #17693. Input validation and tests for base36 conversion utils. Thanks ↵Paul McMillan
Keryn Knight for the report. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17525 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-02-12Fixed AdminEmailHandler to format the subject message correctly when ↵Jannis Leidel
arguments are passed. This bug was hidden before r17480 as it basically didn't take the arguments into account. Refs #14973. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17512 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-02-11Fixed #17281 -- Prevented `AdminErrorHandler` from silently failing if the ↵Julien Phalip
log message contains newlines. Thanks to Russell Keith-Magee for the report and to Bartolome Sanchez Salado and Marcin Wróbel for the patch. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17501 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-02-11Fixes #16827. Adds a length check to CSRF tokens before applying the ↵Paul McMillan
santizing regex. Thanks to jedie for the report and zsiciarz for the initial patch. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17500 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-02-10Fixed #15237 (again). RSS feeds now include proper character encoding in the ↵Paul McMillan
mimetype. Thanks shadow for the report and Michal Rzechonek for the patch. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17494 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-02-10Updated a few localization formats to stop the changes done in r17473 from ↵Jannis Leidel
breaking the tests. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17486 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-02-09Fixed #16416 -- Added two new date formatting options for timezones and ISO ↵Jannis Leidel
week numbers. Thanks, poirier. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17473 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-02-09Fixed #17634 -- Optimized the performance of MultiValueDict by using append ↵Aymeric Augustin
instead of copy and by minimizing the number of dict lookups. Refs #736. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17464 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-02-05Fixed #17641 -- Work around an issue in Python distributions that remove the ↵Jannis Leidel
module attribute ('2.7.2+'). Many thanks to Ramiro Morales for finding it. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17456 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-02-04Fixed #17555 -- Added support for a missing trailing slash when redirecting ↵Jannis Leidel
based on the browser language. Thanks, neaf. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17443 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-02-04Fixed #17592 -- Handle URLs starting with a dot when using urlize. Thanks, ↵Jannis Leidel
Claude Paroz. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17435 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-02-03Small fix to comments in utils/html.py from [17347]Adrian Holovaty
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17424 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-02-02Fixed #17481. pbkdf2 hashes no longer ommit leading zeros. Paul McMillan
Some existing user passwords may need to be reset or converted after this change. See the 1.4-beta release notes for more details. Thanks bhuztez for the report and initial patch, claudep for the test. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17418 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-01-31Fixed #16921 -- Added assertHTMLEqual and assertHTMLNotEqual assertions, and ↵Carl Meyer
converted Django tests to use them where appropriate. Thanks Greg Müllegger. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17414 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-01-29Fixed #5964 -- Added unicode-aware versions of urlunquote and urlunquote_plus.Aymeric Augustin
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17407 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-01-27Fixed #15828 -- Removed explicit implementation of empty setUp / tearDown ↵Aymeric Augustin
methods. Backport of http://hg.python.org/unittest2/rev/3d33f92496fa. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17398 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-01-08Reverted parts of r17359 that could cause false positives in URL detection, ↵Aymeric Augustin
especially on file names. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17364 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-01-08Fixed #11911 -- Made the urlize filter smarter with closing punctuation.Aymeric Augustin
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17362 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-01-08Try to save memory and time when using lazy objects by refering to their ↵Alex Gaynor
function via the closure, and not making it an attribute on each instance. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17360 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-01-08Fixed #16656 -- Changed the urlize filter to accept more top-level domains.Aymeric Augustin
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17359 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-01-08Fixed #16395 -- Prevented urlize from highlighting some malformed URLs. ↵Aymeric Augustin
Thanks BernhardEssl for the report and initial patch. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17358 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-01-08Fixed #12183 -- Made the urlize filter insert the nofollow attribute ↵Aymeric Augustin
properly when an http: URL occurs after a mailto: URL. Thanks eronen for the report. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17356 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-01-07Fixed #13704 -- Handled IDN properly in the urlize template filter. Thanks ↵Aymeric Augustin
Claude Paroz for the initial version of the patch. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17348 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-01-07Fixed #9655 -- Prevented the urlize template filter from double-quoting ↵Aymeric Augustin
URLs. Thanks Claude Paroz for writing the tests. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17347 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-01-03Fixed #17492 -- Allow reversal of named backreferences. Thanks nate_bChris Beaven
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17336 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-01-02Fixed a stupid bug in the implementation of timezone.make_aware.Aymeric Augustin
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17332 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-01-02Fixed #10931 -- Made `Truncator` handle newlines properly. Thanks to gsong ↵Julien Phalip
and Claude Paroz. git-svn-id: http://code.djangoproject.com/svn/django/trunk@17329 bcc190cf-cafb-0310-a4f2-bffc1f526a37
generated by cgit v1.3 (git 2.53.0) at 2026-10-17 04:16:50 +0000