summaryrefslogtreecommitdiff
path: root/django/utils
AgeCommit message (Collapse)Author
2015-01-13Fixed is_safe_url() to handle leading whitespace.Tim Graham
This is a security fix. Disclosure following shortly.
2015-01-08Fixed #24073 -- Returned None for get_language when translations are deactivatedClaude Paroz
This fixes a regression caused by f7c287fca9. Thanks Markus Holtermann for identifying the regression.
2015-01-02Updated six to 1.9.0.Tim Graham
2014-12-28Cleaned up the django.template namespace.Aymeric Augustin
Since this package is going to hold both the implementation of the Django Template Language and the infrastructure for Multiple Template Engines, it should be untied from the DTL as much as possible within our backwards-compatibility policy. Only public APIs (i.e. APIs mentioned in the documentation) were left.
2014-12-27Fixed #23831 -- Supported strings escaped by third-party libs in Django.Aymeric Augustin
Refs #7261 -- Made strings escaped by Django usable in third-party libs. The changes in mark_safe and mark_for_escaping are straightforward. The more tricky part is to handle correctly objects that implement __html__. Historically escape() has escaped SafeData. Even if that doesn't seem a good behavior, changing it would create security concerns. Therefore support for __html__() was only added to conditional_escape() where this concern doesn't exist. Then using conditional_escape() instead of escape() in the Django template engine makes it understand data escaped by other libraries. Template filter |escape accounts for __html__() when it's available. |force_escape forces the use of Django's HTML escaping implementation. Here's why the change in render_value_in_context() is safe. Before Django 1.7 conditional_escape() was implemented as follows: if isinstance(text, SafeData): return text else: return escape(text) render_value_in_context() never called escape() on SafeData. Therefore replacing escape() with conditional_escape() doesn't change the autoescaping logic as it was originally intended. This change should be backported to Django 1.7 because it corrects a feature added in Django 1.7. Thanks mitsuhiko for the report.
2014-12-27Fixed an inconsistency introduced in 547b1810.Aymeric Augustin
mark_safe and mark_for_escaping should have been kept similar. On Python 2 this change has no effect. On Python 3 it fixes the use case shown in the regression test for mark_for_escaping, which used to raise a TypeError. The regression test for mark_safe is just for completeness.
2014-12-26Fixed #23346 -- Fixed lazy() to lookup methods on the real object, not ↵Gavin Wahl
resultclasses. Co-Authored-By: Rocky Meza <rmeza@fusionbox.com>
2014-12-26Fixed #24045 -- Removed useless mark_safe() call in trans_null.pyTim Graham
2014-12-25Fixed #23866 -- Harmonized refs to Django documentation from codeClaude Paroz
2014-12-24Fixed #20349 -- Moved setting_changed signal to django.core.signals.Collin Anderson
This removes the need to load django.test when not testing.
2014-12-22Fixed #23998 -- Added datetime.time support to migrations questioner.Oscar Ramirez
2014-12-20Fixed #2443 -- Added DurationField.Marc Tamlyn
A field for storing periods of time - modeled in Python by timedelta. It is stored in the native interval data type on PostgreSQL and as a bigint of microseconds on other backends. Also includes significant changes to the internals of time related maths in expressions, including the removal of DateModifierNode. Thanks to Tim and Josh in particular for reviews.
2014-12-13Fixed #23812 -- Changed django.utils.six.moves.xrange imports to rangeMichael Hall
2014-12-08Fixed #23968 -- Replaced list comprehension with generators and dict ↵Jon Dufresne
comprehension
2014-12-03Removed redundant numbered parameters from str.format().Berker Peksag
Since Python 2.7 and 3.1, "{0} {1}" is equivalent to "{} {}".
2014-12-03Fixed #23935 -- Converted decimals to fixed point in utils.numberformat.formatEric Rouleau
2014-11-24Fixed typo in django/utils/decorators.py comment.Tom V
2014-11-19Simplified caching of supported languages.Aymeric Augustin
2014-11-19Simplified caching of get_default_timezone().Aymeric Augustin
2014-11-15Fixed #22407 -- Added AdminEmailHandler.send_mail().Berker Peksag
2014-11-13Removed thread customizations of six which are now built-in.Tim Graham
2014-11-11Raised SuspiciousFileOperation in safe_join.Aymeric Augustin
Added a test for the condition safe_join is designed to prevent. Previously, a generic ValueError was raised. It was impossible to tell an intentional exception raised to implement safe_join's contract from an unintentional exception caused by incorrect inputs or unexpected conditions. That resulted in bizarre exception catching patterns, which this patch removes. Since safe_join is a private API and since the change is unlikely to create security issues for users who use it anyway -- at worst, an uncaught SuspiciousFileOperation exception will bubble up -- it isn't documented.
2014-11-05Added a dummy class for HTMLParserError; refs #23763.Tim Graham
2014-11-04Updated six to 1.8.0.Tim Graham
2014-11-03Fixed #18456 -- Added path escaping to HttpRequest.get_full_path().Unai Zalakain
2014-10-31Fixed #23715 -- Prevented urlize from treating a trailing ! as part of an URLMarkus Holtermann
Thanks to 57even for the report.
2014-10-31Fixed #23670 -- Prevented partial import state during module autodiscoveryMarkus Holtermann
Thanks kostko for the report.
2014-10-30Fixed #23558 -- documented slugify limitationsDavid Hoffman
2014-10-20Fixed #23688 -- Updated cached_property to preserve docstring of original ↵John-Scott Atlakson
function
2014-10-20Fixed #20221 -- Allowed some functions that use mark_safe() to result in ↵Jon Dufresne
SafeText. Thanks Baptiste Mispelon for the report.
2014-10-20Fixed #23668 -- Changed make_aware() and make_naive() to use the current ↵Jon Dufresne
timezone by default Thanks Aymeric Augustin for review.
2014-10-16Fixed #23664 -- Provided a consistent definition for OrderedSet.__bool__Thomas Chaumeny
This also defines QuerySet.__bool__ for consistency though this should not have any consequence as bool(qs) used to fallback on QuerySet.__len__ in Py3.
2014-10-16Fixed #19508 -- Implemented uri_to_iri as per RFC.Anubhav Joshi
Thanks Loic Bistuer for helping in shaping the patch and Claude Paroz for the review.
2014-10-15Added unicode_literals to the jslexer.Florian Apolloner
This ensure that ''.join(c) in jslex.py always returns text.
2014-10-10Fixed #23613 -- Deprecated django.utils.checksumsJaap Roes
2014-10-06Fixed #23593 -- Fixed crash in AdminEmailHandler with non-ASCII characters ↵Tim Graham
in request. Thanks edevil for the report and Simon Charette for review.
2014-09-30Fixed #23569 -- Allowed using configs besides dictConfig in LOGGING_CONFIG.Seth Hill
2014-09-29Replaced set([foo, ...]) by {foo, ...} literals. Refs PR 3282.Thomas Chaumeny
Thanks Collin Anderson for the review.
2014-09-21Fixed #23196 -- Short-circuited empty string translationYuri Kriachko
Translating an empty string used to return the gettext catalog metadata instead of the empty string. Thanks Ned Batchelder for the suggestion, Tim Graham for the review and Anton Berezin and Claude Paroz for contributions to the patch.
2014-09-10Avoided using deprecated version of importlib; refs #23418.Tim Graham
2014-09-09Fixed flake8 warnings.Tim Graham
2014-09-09Fixed urlize after smart_urlquote rewriteClaude Paroz
Refs #22267.
2014-09-09Fixed #22267 -- Fixed unquote/quote in smart_urlquoteClaude Paroz
Thanks Md. Enzam Hossain for the report and initial patch, and Tim Graham for the review.
2014-09-08Fixed #23399 -- Optimized django.utils.http.int_to_bas36()Tim Graham
Thanks liminspace for the patch and Keryn Knight for benchmarking.
2014-09-08Fixed flake8 warning.Tim Graham
2014-09-08Fixed #23418 -- Fail when migration deconstruct produces invalid importMarkus Holtermann
2014-09-05Revert "Fixed #23384 -- Allowed overriding part of a dictionary-type setting"Claude Paroz
This reverts commit 66757fee7e921ad4c35e0b3f80c25e026100b31c. Discussions have led to think that this functionality does not bring significant benefits to justify the added complexity. Read also discussions on ticket #22734.
2014-09-05Limited lines to 119 characters in django/Tim Graham
refs #23395.
2014-08-31Fixed #23388 -- Made django.utils.timezone.override usable as a decoratorThomas Chaumeny
2014-08-30Fixed #22820 -- Treated int and long types alike in lazy_numberClaude Paroz
Thanks kwist for the report and the initial patch.
generated by cgit v1.3 (git 2.53.0) at 2026-07-10 21:05:12 +0000