summaryrefslogtreecommitdiff
path: root/django/utils
AgeCommit message (Collapse)Author
2013-08-13Fixed is_safe_url() to reject URLs that use a scheme other than HTTP/S.Jacob Kaplan-Moss
This is a security fix; disclosure to follow shortly.
2013-07-28[1.6.x] Simplified smart_urlquote and added some basic tests.Florian Apolloner
Backport of b70c371fc1f18ea0c43b503122df3f311afc7105 from master.
2013-07-07[1.6.x] Fixed #20711 -- Fixed broken link in timesince.py docstringSusanTan
Backport of d63327d843 from master.
2013-06-26Fixed #14881 -- Modified password reset to work with a non-integer UserModel.pk.Tim Graham
uid is now base64 encoded in password reset URLs/views. A backwards compatible password_reset_confirm view/URL will allow password reset links generated before this change to continue to work. This view will be removed in Django 1.7. Thanks jonash for the initial patch and claudep for the review.
2013-06-19Removed several unused imports.Aymeric Augustin
2013-06-18Fixed #20199 -- Allow ModelForm fields to override error_messages from model ↵Loic Bistuer
fields
2013-06-03Fixed loaddata for Django checkouts with non ASCII chars in the name.Florian Apolloner
2013-06-02Switched to using some constants the hmac module exposes.Alex Gaynor
2013-06-01Added minor splitting optimization in django.utils.ipv6._unpack_ipv4Danilo Bargen
2013-05-26Replaced `and...or...` constructs with PEP 308 conditional expressions.Ramiro Morales
2013-05-25Fixed #19866 -- Added security logger and return 400 for SuspiciousOperation.Preston Holmes
SuspiciousOperations have been differentiated into subclasses, and are now logged to a 'django.security.*' logger. SuspiciousOperations that reach django.core.handlers.base.BaseHandler will now return a 400 instead of a 500. Thanks to tiwoc for the report, and Carl Meyer and Donald Stufft for review.
2013-05-25Fixed #20296 -- Allowed SafeData and EscapeData to be lazyBaptiste Mispelon
2013-05-25Fixed some minor translation-related issuesClaude Paroz
2013-05-25Removed obsolete attribute of DjangoTranslationClaude Paroz
2013-05-23Fixed #19237 (again) - Made strip_tags consistent between Python versionsClaude Paroz
2013-05-22Fixed #19237 -- Used HTML parser to strip tagsClaude Paroz
The regex method used until now for the strip_tags utility is fast, but subject to flaws and security issues. Consensus and good practice lead use to use a slower but safer method.
2013-05-21Imported copyreg from six.movesClaude Paroz
2013-05-21Fixed #20212 - __reduce__ should only be defined for Py3+.Daniel Lindsley
2013-05-19Fixed #11915: generic Accept-Language matches country-specific variantsŁukasz Langa
2013-05-19Fix a typo in a comment.Marc Tamlyn
2013-05-18Fixed #20246 -- Added non-breaking spaces between values an unitsEmil Stenström
2013-05-18Fixed #14894 -- Ensure that activating a translation doesn't run into ↵Florian Apolloner
threading issues. Thanks to maxbublis for the report and sergeykolosov for the patch.
2013-05-18Fixes #19919: get_language_from_request() disregards "en-us" and "en" languagesŁukasz Langa
when matching Accept-Language
2013-05-18Fixed #20411 -- Don't let invalid referers blow up CSRF same origin checks.Florian Apolloner
Thanks to edevil for the report and saz for the patch.
2013-05-17Replaced an antiquated pattern.Aymeric Augustin
Thanks Lennart Regebro for pointing it out.
2013-05-15Removed unicode literals from PIL compat.Florian Apolloner
2013-05-14Fixed #19934 - Use of Pillow is now preferred over PIL.Daniel Lindsley
This starts the deprecation period for PIL (support to end in 1.8).
2013-05-10Fixed #17365, #17366, #18727 -- Switched to discovery test runner.Carl Meyer
Thanks to Preston Timmons for the bulk of the work on the patch, especially updating Django's own test suite to comply with the requirements of the new runner. Thanks also to Jannis Leidel and Mahdi Yusuf for earlier work on the patch and the discovery runner. Refs #11077, #17032, and #18670.
2013-04-26Fixed #20321 -- Added missing key name in MergeDict KeyError messageClaude Paroz
Thanks mark.harviston et gmail.com for the report.
2013-04-19Fix != operations on lazy objects.Alex Gaynor
2013-04-19Fixed #20276 -- Implemented __bool__ for MergeDictAnton Baklanov
MergeDict evaluates now to False if all contained dicts are empty. Thanks til for the report and the initial patch.
2013-04-10Fixed #20231 -- Don't use allow_lazy on smart_splitBaptiste Mispelon
2013-04-01Fixed #20172 -- Ensured urlize supports IPv4/IPv6 addressesClaude Paroz
Thanks Marc Aymerich for the report and the initial patch.
2013-03-31Fixed #20167 -- Preserve the traceback of `ImportError`s in `import_by_path`.Joe Friedl
Thanks @carljm for the review.
2013-03-28Fixed spelling errorsGavin Wahl
2013-03-27Fixed #20016: worked around Jython not having a buffer.Andreas
2013-03-22Fixed #20108 -- Fixed filepath_to_uri decoding errorClaude Paroz
This was a regression due to unicode_literals usage. Thanks Ivan Virabyan for the report and the initial patch.
2013-03-22Fixed #20094 - Be more careful when checking for IteratorMarc Tamlyn
Python 2.6 has some different behaviour when checking isinstance(foo, collections.Iterator).
2013-03-19Fixed #18003 -- Preserved tracebacks when re-raising errors.konarkmodi
Thanks jrothenbuhler for draft patch, Konark Modi for updates.
2013-03-18Fixed #19456 -- Avoid infinite recursion when tracing LazyObject.__init__.Aymeric Augustin
Thanks blaze33 for the patch.
2013-03-18Fixed #18447 -- Made LazyObject unwrap on dict access.Aymeric Augustin
Thanks Roman Gladkov and Zbigniew Siciarz.
2013-03-18Clarified that constant_time_compare doesn't protect string lengths.Aymeric Augustin
2013-03-17Updated bundled version of six.Aymeric Augustin
2013-03-14Fixed #17051 -- Removed some 'invalid' field error messagesClaude Paroz
When the 'invalid' error message is set at field level, it masks the error message raised by the validator, if any.
2013-03-13Refactored qs.add_q() and utils/tree.pyAnssi Kääriäinen
The sql/query.py add_q method did a lot of where/having tree hacking to get complex queries to work correctly. The logic was refactored so that it should be simpler to understand. The new logic should also produce leaner WHERE conditions. The changes cascade somewhat, as some other parts of Django (like add_filter() and WhereNode) expect boolean trees in certain format or they fail to work. So to fix the add_q() one must fix utils/tree.py, some things in add_filter(), WhereNode and so on. This commit also fixed add_filter to see negate clauses up the path. A query like .exclude(Q(reversefk__in=a_list)) didn't work similarly to .filter(~Q(reversefk__in=a_list)). The reason for this is that only the immediate parent negate clauses were seen by add_filter, and thus a tree like AND: (NOT AND: (AND: condition)) will not be handled correctly, as there is one intermediary AND node in the tree. The example tree is generated by .exclude(~Q(reversefk__in=a_list)). Still, aggregation lost connectors in OR cases, and F() objects and aggregates in same filter clause caused GROUP BY problems on some databases. Fixed #17600, fixed #13198, fixed #17025, fixed #17000, fixed #11293.
2013-03-12Restricted a workaround for a bug in Python to the affected versions.Aymeric Augustin
2013-03-08Fixed #15363 -- Renamed and normalized to `get_queryset` the methods that ↵Loic Bistuer
return a QuerySet.
2013-03-06PEP8 cleanup of functional.pyPreston Holmes
2013-03-06Fixed #19543 -- implemented SimpleLazyObject.__repr__Preston Holmes
Thanks to Florian Hahn for the patch
2013-03-02Fixed getting default encoding in get_system_usernameClaude Paroz
Refs #19933.
generated by cgit v1.3 (git 2.53.0) at 2026-07-14 02:53:42 +0000