summaryrefslogtreecommitdiff
path: root/django/utils
AgeCommit message (Collapse)Author
2023-02-01[4.2.x] Refs #33476 -- Applied Black's 2023 stable style.David Smith
Black 23.1.0 is released which, as the first release of the year, introduces the 2023 stable style. This incorporates most of last year's preview style. https://github.com/psf/black/releases/tag/23.1.0 Backport of 097e3a70c1481ee7b042b2edd91b2be86fb7b5b6 from main
2023-02-01[4.2.x] Fixed CVE-2023-23969 -- Prevented DoS with pathological values for ↵Nick Pope
Accept-Language. The parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large. Accept-Language headers are now limited to a maximum length in order to avoid this issue.
2023-01-11Refs #33879 -- Fixed plural value deprecation warnings.Mariusz Felisiak
Plural value must be an integer. Regression in 8d67e16493c903adc9d049141028bc0fff43f8c8.
2023-01-05Fixed #34243 -- Fixed timesince() crash with timezone-aware dates and ↵sag᠎e
interval longer than 1 month. Regression in 8d67e16493c903adc9d049141028bc0fff43f8c8.
2023-01-05Simplified handling ambiguous/imaginary datetimes in django.utils.dateformat.Nick Pope
Instead of the separate property, we can just not set self.timezone if the datetime is ambiguous or imaginary. This ensures that this check will only ever happen once as it's dependant on the datetime object and not the format string characters.
2023-01-05Added support for datetime.date to DateFormat.r().Nick Pope
2023-01-05Simplified django.utils.dateformat.DateFormat.O()/t()/e() a bit.Nick Pope
O() - we should try to avoid calling specifier methods from each other to avoid extra function call overhead. In addition we end up, in this case, duplicating the ambiguous/imaginary datetime checks. We're also going to be looking at simplifying things by having all of these specifier methods return strings and not an random mix of types. t() - the value can only be one of 28, 29, 30, or 31. As such, there is no need to zero-pad to a width of two.
2023-01-05Optimized imports in django.utils.dateformat.Nick Pope
Avoid extra attribute lookup in specifier methods, etc. by importing classes from datetime directly.
2023-01-04Simplified django.utils.formats.date_format()/time_format() calls.Nick Pope
This removes redundant get_format() calls and passing a default value for the format argument.
2023-01-04Fixed #33879 -- Improved timesince handling of long intervals.GianpaoloBranca
2022-12-22Fixed #33735 -- Added async support to StreamingHttpResponse.Carlton Gibson
Thanks to Florian Vazelle for initial exploratory work, and to Nick Pope and Mariusz Felisiak for review.
2022-12-20Refs #34118 -- Adopted asgiref coroutine detection shims.Carlton Gibson
Thanks to Mariusz Felisiak for review.
2022-12-17Fixed #34170 -- Implemented Heal The Breach (HTB) in GzipMiddleware.Andreas Pelme
2022-12-05Fixed #34194 -- Added django.utils.http.content_disposition_header().Alex Vandiver
2022-11-10Updated documentation and comments for RFC updates.Nick Pope
- Updated references to RFC 1123 to RFC 5322 - Only partial as RFC 5322 sort of sub-references RFC 1123. - Updated references to RFC 2388 to RFC 7578 - Except RFC 2388 Section 5.3 which has no equivalent. - Updated references to RFC 2396 to RFC 3986 - Updated references to RFC 2616 to RFC 9110 - Updated references to RFC 3066 to RFC 5646 - Updated references to RFC 7230 to RFC 9112 - Updated references to RFC 7231 to RFC 9110 - Updated references to RFC 7232 to RFC 9110 - Updated references to RFC 7234 to RFC 9111 - Tidied up style of text when referring to RFC documents
2022-10-31Used more augmented assignment statements.Nick Pope
Identified using the following command: $ git grep -I '\(\<[_a-zA-Z0-9]\+\>\) *= *\1 *[-+/*^%&|<>@]'
2022-10-13Fixed #34069 -- Made LocaleMiddleware respect language from requests when ↵Sergio
i18n patterns are used.
2022-09-12Refs #34000 -- Optimized handling None values in numberformat.format().Jimmy Angelakos
2022-09-12Fixed #34000 -- Fixed numberformat.format() crash on empty strings.Jimmy Angelakos
2022-08-11Refs #30213 -- Removed post-startup check for Watchman availability.Carlton Gibson
This is checked at startup in get_reloader(). The runtime check ties the implementation to Watchman excessively.
2022-07-27Refs #32948, Refs #32946 -- Used Q.create() internally for dynamic Q() objects.Nick Pope
Node.create() which has a compatible signature with Node.__init__() takes in a single `children` argument rather than relying in unpacking *args in Q.__init__() which calls Node.__init__(). In addition, we were often needing to unpack iterables into *args and can instead pass a list direct to Node.create().
2022-07-27Refs #32948 -- Added Node.__copy__().Nick Pope
This allows the copy.copy() usage in the Q._combine() method to finish sooner, instead of having to fallback to using the __reduce_ex__(4) method. Thia also avoids having to fall into copy.copy() at in Q._combine(), when combining a Q() with another Q(). Co-authored-by: Keryn Knight <keryn@kerynknight.com>
2022-07-27Refs #32948 -- Simplified WhereNode and Node.__deepcopy__()/add().Nick Pope
We can use copy() in Node.add() instead of create() as we don't need the children to be cloned via [:] subscript in __init__().
2022-07-27Refs #32948 -- Renamed Node._new_instance() to Node.create().Nick Pope
Node._new_instance() was added in 6dd2b5468fa275d53aa60fdcaff8c28bdc5e9c25 to work around Q.__init__() having an incompatible signature with Node.__init__(). It was intended as a hook that could be overridden if subclasses needed to change the behaviour of instantiation of their specialised form of Node. In practice this doesn't ever seem to have been used for this purpose and there are very few calls to Node._new_instance() with other code, e.g. Node.__deepcopy__() calling Node and overriding __class__ as required. Rename this to Node.create() to make it a more "official" piece of private API that we can use to simplify a lot of other areas internally. The docstring and nearby comment have been reworded to read more clearly.
2022-07-26Refs #27236 -- Reverted "Refs #27236 -- Refactored out ↵Mariusz Felisiak
DeprecationForHistoricalMigrationMixin." This reverts commit 57793b47657ace966ce8ce96d801ac0d85e5efc6.
2022-07-07Refs #27236 -- Refactored out DeprecationForHistoricalMigrationMixin.David Wobrock
2022-07-01Updated vendored _urlsplit() to strip newline and tabs.Michael Manfre
Refs Python CVE-2022-0391. Django is not affected, but others who incorrectly use internal function url_has_allowed_host_and_scheme() with unsanitized input could be at risk.
2022-06-28Fixed #33779 -- Allowed customizing encoder class in ↵Hrushikesh Vaidya
django.utils.html.json_script().
2022-06-28Refs #33697 -- Used django.utils.http.parse_header_parameters() for parsing ↵Mehrdad
boundary streams. This also removes unused parse_header() and _parse_header_params() helpers in django.http.multipartparser.
2022-06-20Fixed #23689 -- Made parsing HTTP Accept-Language header case-insensitive.Zainab Amir
Thank you Daniel Samuels for test project.
2022-05-31Fixed #33748 -- Fixed date template filter crash with lazy format.Claude Paroz
Regression in 659d2421c7adbbcd205604002d521d82d6b0b465.
2022-05-25Normalized imports of functools.wraps.Aymeric Augustin
@wraps is 10 times more common than @functools.wraps. Standardize to the most common version.
2022-05-25Renamed wrapped functions to wrapper.Aymeric Augustin
All these functions are wrapping another function. They're the wrapper, while the function they're wrapping is the wrapped.
2022-05-17Advanced deprecation warnings for Django 4.2.Carlton Gibson
2022-05-12Made closing in connection handlers more DRY.Nick Pope
2022-05-11Refs #33173 -- Removed use of deprecated cgi module.Carlton Gibson
https://peps.python.org/pep-0594/#cgi
2022-04-20Fixed #33654 -- Added localdate to utils.timezone.__all__. Andrey Otto
2022-03-29Refs #32365 -- Deprecated django.utils.timezone.utc.Carlton Gibson
2022-03-24Refs #32365 -- Removed internal uses of utils.timezone.utc alias.Carlton Gibson
Remaining test case ensures that uses of the alias are mapped canonically by the migration writer.
2022-03-17Prevented initialization of unused database connections.Florian Apolloner
2022-03-15Fixed #31169 -- Adapted the parallel test runner to use spawn.David Smith
Co-authored-by: Valz <ahmadahussein0@gmail.com> Co-authored-by: Nick Pope <nick@nickpope.me.uk>
2022-03-08Refs #33173 -- Used locale.getlocale() instead of getdefaultlocale().Mariusz Felisiak
locale.getdefaultlocale() was deprecated in Python 3.11, see https://bugs.python.org/issue46659.
2022-03-03Optimized lazy wrappers a bit.Collin Anderson
This avoids an extra __getattribute__() call for self._wrapped.
2022-02-23Fixed #33532 -- Optimized CaseInsensitiveMapping instantiation for dicts.Keryn Knight
Internal usages of this class (e.g. HttpHeaders) provide it with a dict, so testing for that type first avoids the cost of going through the potential __instancecheck__ + _abc_instancecheck to establish it's a Mapping. Co-authored-by: Nick Pope <nick@nickpope.me.uk>
2022-02-22Refs #32873 -- Avoided looking up settings._USE_L10N_INTERNAL twice.Collin Anderson
2022-02-21Fixed #20296 -- Prevented mark_safe() from evaluating lazy objects.Theo Alexiou
2022-02-21Removed unnecessary str type from @keep_lazy decorator for escape()/escapejs().Mariusz Felisiak
2022-02-21Fixed #33518 -- Added RemovedAfterNextVersionWarning.saeedblanchette
2022-02-19Refs #33173 -- Fixed MailTests.test_backend_arg() on Windows and Python 3.11+.David Smith
2022-02-17Refs #28358 -- Fixed infinite recursion in LazyObject.__getattribute__().Matthias Kestenholz
Regression in 97d7990abde3fe4b525ae83958fd0b52d6a1d13f. Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com> Co-authored-by: Theo Alexiou <theofilosalexiou@gmail.com>
generated by cgit v1.3 (git 2.53.0) at 2026-07-06 22:08:47 +0000