summaryrefslogtreecommitdiff
path: root/django
AgeCommit message (Collapse)Author
2013-11-06[1.4.x] Bump version info and add release notes for 1.4.10.1.4.10James Bennett
2013-11-02Fixed #21362 -- Restored Python 2.5 compatibility.Florian Apolloner
2013-10-25[1.4.x] Bump version post-release.Tim Graham
2013-10-24[1.4.x] Bump everything for 1.4.9 bugfix release.1.4.9James Bennett
2013-10-21[1.4.x] Fixed #21253 -- PBKDF2 with cached HMAC keyFlorian Apolloner
This gives a 2x speed increase compared to the existing implementation. Thanks to Steve Thomas for the initial patch and Tim Graham for finishing it. Backport of 1e4f53a6eb8d1816e51eb8bd8f95e704f6b89ead from master.
2013-10-13[1.4.x] Fixed #21256 -- Error in datetime_safe.datetime.combine.Aymeric Augustin
Backport of d9b6fb8 from master
2013-10-09[1.4.x] Fixed #21248 -- Skipped test_bcrypt if no py-bcrypt foundAnssi Kääriäinen
Pre 1.6 Django worked only with py-bcrypt, not with bcrypt. Skipped test_bcrypt when using bcrypt to avoid false positives. Backpatch of 9f8a36eb20895d9e542820d5190bfa77ad1b85d9 from stable/1.5.x.
2013-09-24[1.4.x] Fixed #21138 -- Increased the performance of our PBKDF2 implementation.Florian Apolloner
Thanks go to Michael Gebetsroither for pointing out this issue and help on the patch. Backport of 68540fe4df44492571bc610a0a043d3d02b3d320 from master.
2013-09-24Revert "[1.4.x] Ensure that passwords are never long enough for a DoS."Florian Apolloner
This reverts commit 3f3d887a6844ec2db743fee64c9e53e04d39a368. This fix is no longer necessary, our pbkdf2 (see next commit) implementation no longer rehashes the password every iteration.
2013-09-15[1.4.x] Bump version post-release.Tim Graham
2013-09-15[1.4.x] Fixed geos test to prevent random failureClaude Paroz
Points in the test fixtures have 20 as max coordinate. Backport of 87854b0bdf354059f949350a4d63a0ed071d564c from master.
2013-09-15[1.4.x] Removed usage of b"" string syntax for Python 2.5 compatibility.1.4.8Russell Keith-Magee
Refs commit 3f3d887a6844ec2db743fee64c9e53e04d39a368.
2013-09-14[1.4.x] Add release notes and bump version numbers for 1.4.8 security release.James Bennett
2013-09-15[1.4.x] Ensure that passwords are never long enough for a DoS.Russell Keith-Magee
* Limit the password length to 4096 bytes * Password hashers will raise a ValueError * django.contrib.auth forms will fail validation * Document in release notes that this is a backwards incompatible change Thanks to Josh Wright for the report, and Donald Stufft for the patch. This is a security fix; disclosure to follow shortly. Backport of aae5a96d5754ad34e48b7f673ef2411a3bbc1015 from master.
2013-09-13Fixed #18923 -- Corrected usage of sensitive_post_parameters in contrib.authTim Graham
Thanks Collin Anderson for the report. Backport of 425d076d0c from master
2013-09-11[1.4.x] Bump version post-release.Tim Graham
2013-09-10[1.4.x] Bump version numbers for 1.4.7 security release.1.4.7James Bennett
2013-09-10[1.4.x] Prevented arbitrary file inclusion with {% ssi %} tag and relative ↵Tim Graham
paths. Thanks Rainer Koirikivi for the report and draft patch. This is a security fix; disclosure to follow shortly. Backport of 7fe5b656c9 from master
2013-09-09[1.4.x] Fixed #20707 -- Added explicit quota assignment to Oracle test userСадовский Николай
To enable testing on Oracle 12c
2013-08-18[1.4.x] Fixed #20907 - Test failure on OracleShai Berger
Backport of the Oracle-specific part of commit a18e43c5bb8cb7c82 from master. This commit made get_indexes more consistent across backends. Thanks Tim Graham for pointer to the commit, akaariai and ikelly for the original commit.
2013-08-13Bump version post-release.Jacob Kaplan-Moss
2013-08-13Bumped version numbers for 1.4.6.Jacob Kaplan-Moss
2013-08-13Fixed is_safe_url() to reject URLs that use a scheme other than HTTP/S.Jacob Kaplan-Moss
This is a security fix; disclosure to follow shortly.
2013-06-24[1.4.x] Fixed oversight in e3b6fed3. Refs #20636.Aymeric Augustin
2013-06-24[1.4.x] Fixed #20636 -- Stopped stuffing values in the settings.Aymeric Augustin
In Django < 1.6, override_settings restores the settings module that was active when the override_settings call was executed, not when it was run. This can make a difference when override_settings is applied to a class, since it's executed when the module is imported, not when the test case is run. In addition, if the settings module for tests is stored alongside the tests themselves, importing the settings module can trigger an import of the tests. Since the settings module isn't fully imported yet, class-level override_settings statements may store a reference to an incorrect settings module. Eventually this will result in a crash during test teardown because the settings module restored by override_settings won't the one that was active during test setup. While Django should prevent this situation in the future by failing loudly in such dubious import sequences, that change won't be backported to 1.5 and 1.4. However, these versions received the "allowed hosts" patch and they're prone to "AttributeError: 'Settings' object has no attribute '_original_allowed_hosts'". To mitigate this regression, this commits stuffs _original_allowed_hosts on a random module instead of the settings module. This problem shouldn't occur in Django 1.6, see #20290, but this patch will be forward-ported for extra safety. Also tweaked backup variable names for consistency. Backport of 0261922 from stable/1.5.x. Conflicts: django/test/utils.py
2013-03-28[1.4.x] Bump version to no longer claim to be 1.4.5 final.Carl Meyer
2013-02-25[1.4.x] Fixed #18144 -- Restored compatibility with SHA1 hashes with empty salt.Aymeric Augustin
Thanks dahool for the report and initial version of the patch. Backport of 633d8de from master.
2013-02-21[1.4.x] Made a couple of selenium tests wait for page loadedAnssi Kääriäinen
The admin_widgets tests were issuing click() to the browser but didn't wait for the effects of those clicks. This caused the resulting request to be processed concurrently with the test case. When using in-memory SQLite this caused weird failures. Also added wait_page_loaded() to admin selenium tests for code reuse. Fixed #19856, cherry-pick of 50677b29af39ca670274fb45087415c883c78b04
2013-02-20[1.4.x] Bump version numbers to roll a clean package.1.4.5James Bennett
2013-02-19[1.4.x] Fixed #19857 -- Fixed broken docs link in project template.Carl Meyer
2013-02-19[1.4.x] Bump version numbers for security release.1.4.4James Bennett
2013-02-19[1.4.x] Added a default limit to the maximum number of forms in a formset.Aymeric Augustin
This is a security fix. Disclosure and advisory coming shortly.
2013-02-19[1.4.x] Checked object permissions on admin history view.Carl Meyer
This is a security fix. Disclosure and advisory coming shortly. Patch by Russell Keith-Magee.
2013-02-19[1.4.x] Restrict the XML deserializer to prevent network and ↵Carl Meyer
entity-expansion DoS attacks. This is a security fix. Disclosure and advisory coming shortly.
2013-02-19[1.4.x] Added ALLOWED_HOSTS setting for HTTP host header validation.Carl Meyer
This is a security fix; disclosure and advisory coming shortly.
2013-02-13[1.4.x] Removed try-except in django.db.close_connection()Anssi Kääriäinen
The reason was that the except clause needed to remove a connection from the django.db.connections dict, but other parts of Django do not expect this to happen. In addition the except clause was silently swallowing the exception messages. Refs #19707, special thanks to Carl Meyer for pointing out that this approach should be taken.
2013-02-10[1.4.x] Made custom m2m fields without through easier to useAnssi Kääriäinen
The change in f105fbe52b21da206bfbaedf0e92326667d7b2d4 made through=None m2m fields fail in cases where they worked before. It isn't possible to create such fields using public APIs. The fix is trivial, so it seems worth fixing this for custom m2m field users. This is not a backport from master. Master has gotten enough other changes to related fields internal API that this fix alone isn't enough to do any good.
2013-02-10[1.4.x] Fixed #19707 -- Reset transaction state after requestsAnssi Kääriäinen
Backpatch of a4e97cf315142e61bb4bc3ed8259b95d8586d09c.
2013-02-02[1.4.x] Fixed #19702 -- Changed a SQL command syntax to be MySQL 4-compatibleClaude Paroz
Thanks matf at op.pl for the report.
2013-02-02[1.5.x] Lowered field ordering requirement in ogrinspect testClaude Paroz
This test was randomly failing depending on the library environment. Backport of a1c470a6f from master.
2013-02-02[1.4.x] Fixed #18144 -- Added backwards compatibility with old unsalted MD5 ↵Claude Paroz
passwords Thanks apreobrazhensky at gmail.com for the report. Backport of 63d6a50dd from master.
2012-12-10[1.4.x] Bump version numbers for security release.1.4.3James Bennett
2012-12-10[1.4.X] Fixed a security issue in get_host.Florian Apolloner
Full disclosure and new release forthcoming.
2012-12-10[1.4.X] Fixed #18856 -- Ensured that redirects can't be poisoned by ↵Florian Apolloner
malicious users.
2012-12-03[1.4.x] Fixed #19318 -- Ensured that the admin's SimpleListFilter options ↵Sebastián Magrí
can be displayed as selected even if the lookup's first element is not a string. Backport of 88e17156393b
2012-11-24[1.4.x] Fixed SQLite's collapsing of same-valued instances in bulk_createAnssi Kääriäinen
SQLite used INSERT INTO tbl SELECT %s UNION SELECT %s, the problem was that there should have been UNION ALL instead of UNION. Refs #19351 Backpatch of a27582484cf814554907d2d1ad077852de36963f
2012-11-15[1.4.x] Fixed #19058 -- Fixed Oracle GIS crashAnssi Kääriäinen
The problem is the same as in #10888 which was reintroduced when bulk_insert was added. Thanks to Jani Tiainen for report, patch and also testing the final patch on Oracle GIS. Backpatch of 92d7f541da8b59520c833b19fbba52d3ecef2428
2012-10-29[1.4.x] Fixed #19172 -- Isolated poisoned_http_host tests from 500 handlersClaude Paroz
Thanks bernardofontes for the report. Backport of b774c5993 from master.
2012-10-28[1.4.x] Fixed #18823 -- Ensured m2m.clear() works when using through+to_fieldAnssi Kääriäinen
There was a potential data-loss issue involved -- when clearing instance's m2m assignments it was possible some other instance's m2m data was deleted instead. This commit also improved None handling for to_field cases. Backpatch of 611c4d6f1c24763e5e6e331a5dcf9b610288aaa8
2012-10-23[1.4.x] Fix an HTML-parser test that's failed in Python 2.6.8 since 5c79dd58.Carl Meyer
The problem description in #18239 asserted that http://bugs.python.org/issue670664 was fixed in Python 2.6.8, but based on http://bugs.python.org/issue670664#msg146770 it appears that's not correct; the fix was only applied in 2.7, 3.2, and Python trunk. Therefore we must use our patched HTMLParser subclass in all Python 2.6 versions. Backport of fcec904e4f from master. Fixes #19148.
generated by cgit v1.3 (git 2.53.0) at 2026-11-13 21:52:10 +0000