summaryrefslogtreecommitdiff
path: root/django
AgeCommit message (Collapse)Author
2014-04-21[1.4.x] Bump version numbers for 1.4.11 security release.1.4.11James Bennett
2014-04-21[1.4.x] Fixed queries that may return unexpected results on MySQL due to ↵Erik Romijn
typecasting. This is a security fix. Disclosure will follow shortly. Backport of 75c0d4ea3ae48970f788c482ee0bd6b29a7f1307 from master
2014-04-21[1.4.x] Prevented leaking the CSRF token through caching.Aymeric Augustin
This is a security fix. Disclosure will follow shortly. Backport of c083e3815aec23b99833da710eea574e6f2e8566 from master
2014-04-21[1.4.x] Fixed a remote code execution vulnerabilty in URL reversing.Tim Graham
Thanks Benjamin Bach for the report and initial patch. This is a security fix; disclosure to follow shortly. Backport of 8b93b31487d6d3b0fcbbd0498991ea0db9088054 from master
2014-03-24[1.4.x] Updated six to 1.6.1.Tim Graham
Backport of 2ec82c7387db071278201796208808de84c90dbf from master
2014-01-26[1.4.x] Fixed #21823 -- Upgraded six to 1.5.2Tim Graham
Backport of 780ae7e9f8 from master.
2014-01-02Updated six to version 1.4.1Luke Plant
This is not a bugfix. But six only exists on Django 1.4.x branch to help with future compatibility, so it is helpful if it keeps up with latest Django.
2013-11-06[1.4.x] Bump version info and add release notes for 1.4.10.1.4.10James Bennett
2013-11-02Fixed #21362 -- Restored Python 2.5 compatibility.Florian Apolloner
2013-10-25[1.4.x] Bump version post-release.Tim Graham
2013-10-24[1.4.x] Bump everything for 1.4.9 bugfix release.1.4.9James Bennett
2013-10-21[1.4.x] Fixed #21253 -- PBKDF2 with cached HMAC keyFlorian Apolloner
This gives a 2x speed increase compared to the existing implementation. Thanks to Steve Thomas for the initial patch and Tim Graham for finishing it. Backport of 1e4f53a6eb8d1816e51eb8bd8f95e704f6b89ead from master.
2013-10-13[1.4.x] Fixed #21256 -- Error in datetime_safe.datetime.combine.Aymeric Augustin
Backport of d9b6fb8 from master
2013-10-09[1.4.x] Fixed #21248 -- Skipped test_bcrypt if no py-bcrypt foundAnssi Kääriäinen
Pre 1.6 Django worked only with py-bcrypt, not with bcrypt. Skipped test_bcrypt when using bcrypt to avoid false positives. Backpatch of 9f8a36eb20895d9e542820d5190bfa77ad1b85d9 from stable/1.5.x.
2013-09-24[1.4.x] Fixed #21138 -- Increased the performance of our PBKDF2 implementation.Florian Apolloner
Thanks go to Michael Gebetsroither for pointing out this issue and help on the patch. Backport of 68540fe4df44492571bc610a0a043d3d02b3d320 from master.
2013-09-24Revert "[1.4.x] Ensure that passwords are never long enough for a DoS."Florian Apolloner
This reverts commit 3f3d887a6844ec2db743fee64c9e53e04d39a368. This fix is no longer necessary, our pbkdf2 (see next commit) implementation no longer rehashes the password every iteration.
2013-09-15[1.4.x] Bump version post-release.Tim Graham
2013-09-15[1.4.x] Fixed geos test to prevent random failureClaude Paroz
Points in the test fixtures have 20 as max coordinate. Backport of 87854b0bdf354059f949350a4d63a0ed071d564c from master.
2013-09-15[1.4.x] Removed usage of b"" string syntax for Python 2.5 compatibility.1.4.8Russell Keith-Magee
Refs commit 3f3d887a6844ec2db743fee64c9e53e04d39a368.
2013-09-14[1.4.x] Add release notes and bump version numbers for 1.4.8 security release.James Bennett
2013-09-15[1.4.x] Ensure that passwords are never long enough for a DoS.Russell Keith-Magee
* Limit the password length to 4096 bytes * Password hashers will raise a ValueError * django.contrib.auth forms will fail validation * Document in release notes that this is a backwards incompatible change Thanks to Josh Wright for the report, and Donald Stufft for the patch. This is a security fix; disclosure to follow shortly. Backport of aae5a96d5754ad34e48b7f673ef2411a3bbc1015 from master.
2013-09-13Fixed #18923 -- Corrected usage of sensitive_post_parameters in contrib.authTim Graham
Thanks Collin Anderson for the report. Backport of 425d076d0c from master
2013-09-11[1.4.x] Bump version post-release.Tim Graham
2013-09-10[1.4.x] Bump version numbers for 1.4.7 security release.1.4.7James Bennett
2013-09-10[1.4.x] Prevented arbitrary file inclusion with {% ssi %} tag and relative ↵Tim Graham
paths. Thanks Rainer Koirikivi for the report and draft patch. This is a security fix; disclosure to follow shortly. Backport of 7fe5b656c9 from master
2013-09-09[1.4.x] Fixed #20707 -- Added explicit quota assignment to Oracle test userСадовский Николай
To enable testing on Oracle 12c
2013-08-18[1.4.x] Fixed #20907 - Test failure on OracleShai Berger
Backport of the Oracle-specific part of commit a18e43c5bb8cb7c82 from master. This commit made get_indexes more consistent across backends. Thanks Tim Graham for pointer to the commit, akaariai and ikelly for the original commit.
2013-08-13Bump version post-release.Jacob Kaplan-Moss
2013-08-13Bumped version numbers for 1.4.6.Jacob Kaplan-Moss
2013-08-13Fixed is_safe_url() to reject URLs that use a scheme other than HTTP/S.Jacob Kaplan-Moss
This is a security fix; disclosure to follow shortly.
2013-06-24[1.4.x] Fixed oversight in e3b6fed3. Refs #20636.Aymeric Augustin
2013-06-24[1.4.x] Fixed #20636 -- Stopped stuffing values in the settings.Aymeric Augustin
In Django < 1.6, override_settings restores the settings module that was active when the override_settings call was executed, not when it was run. This can make a difference when override_settings is applied to a class, since it's executed when the module is imported, not when the test case is run. In addition, if the settings module for tests is stored alongside the tests themselves, importing the settings module can trigger an import of the tests. Since the settings module isn't fully imported yet, class-level override_settings statements may store a reference to an incorrect settings module. Eventually this will result in a crash during test teardown because the settings module restored by override_settings won't the one that was active during test setup. While Django should prevent this situation in the future by failing loudly in such dubious import sequences, that change won't be backported to 1.5 and 1.4. However, these versions received the "allowed hosts" patch and they're prone to "AttributeError: 'Settings' object has no attribute '_original_allowed_hosts'". To mitigate this regression, this commits stuffs _original_allowed_hosts on a random module instead of the settings module. This problem shouldn't occur in Django 1.6, see #20290, but this patch will be forward-ported for extra safety. Also tweaked backup variable names for consistency. Backport of 0261922 from stable/1.5.x. Conflicts: django/test/utils.py
2013-03-28[1.4.x] Bump version to no longer claim to be 1.4.5 final.Carl Meyer
2013-02-25[1.4.x] Fixed #18144 -- Restored compatibility with SHA1 hashes with empty salt.Aymeric Augustin
Thanks dahool for the report and initial version of the patch. Backport of 633d8de from master.
2013-02-21[1.4.x] Made a couple of selenium tests wait for page loadedAnssi Kääriäinen
The admin_widgets tests were issuing click() to the browser but didn't wait for the effects of those clicks. This caused the resulting request to be processed concurrently with the test case. When using in-memory SQLite this caused weird failures. Also added wait_page_loaded() to admin selenium tests for code reuse. Fixed #19856, cherry-pick of 50677b29af39ca670274fb45087415c883c78b04
2013-02-20[1.4.x] Bump version numbers to roll a clean package.1.4.5James Bennett
2013-02-19[1.4.x] Fixed #19857 -- Fixed broken docs link in project template.Carl Meyer
2013-02-19[1.4.x] Bump version numbers for security release.1.4.4James Bennett
2013-02-19[1.4.x] Added a default limit to the maximum number of forms in a formset.Aymeric Augustin
This is a security fix. Disclosure and advisory coming shortly.
2013-02-19[1.4.x] Checked object permissions on admin history view.Carl Meyer
This is a security fix. Disclosure and advisory coming shortly. Patch by Russell Keith-Magee.
2013-02-19[1.4.x] Restrict the XML deserializer to prevent network and ↵Carl Meyer
entity-expansion DoS attacks. This is a security fix. Disclosure and advisory coming shortly.
2013-02-19[1.4.x] Added ALLOWED_HOSTS setting for HTTP host header validation.Carl Meyer
This is a security fix; disclosure and advisory coming shortly.
2013-02-13[1.4.x] Removed try-except in django.db.close_connection()Anssi Kääriäinen
The reason was that the except clause needed to remove a connection from the django.db.connections dict, but other parts of Django do not expect this to happen. In addition the except clause was silently swallowing the exception messages. Refs #19707, special thanks to Carl Meyer for pointing out that this approach should be taken.
2013-02-10[1.4.x] Made custom m2m fields without through easier to useAnssi Kääriäinen
The change in f105fbe52b21da206bfbaedf0e92326667d7b2d4 made through=None m2m fields fail in cases where they worked before. It isn't possible to create such fields using public APIs. The fix is trivial, so it seems worth fixing this for custom m2m field users. This is not a backport from master. Master has gotten enough other changes to related fields internal API that this fix alone isn't enough to do any good.
2013-02-10[1.4.x] Fixed #19707 -- Reset transaction state after requestsAnssi Kääriäinen
Backpatch of a4e97cf315142e61bb4bc3ed8259b95d8586d09c.
2013-02-02[1.4.x] Fixed #19702 -- Changed a SQL command syntax to be MySQL 4-compatibleClaude Paroz
Thanks matf at op.pl for the report.
2013-02-02[1.5.x] Lowered field ordering requirement in ogrinspect testClaude Paroz
This test was randomly failing depending on the library environment. Backport of a1c470a6f from master.
2013-02-02[1.4.x] Fixed #18144 -- Added backwards compatibility with old unsalted MD5 ↵Claude Paroz
passwords Thanks apreobrazhensky at gmail.com for the report. Backport of 63d6a50dd from master.
2012-12-10[1.4.x] Bump version numbers for security release.1.4.3James Bennett
2012-12-10[1.4.X] Fixed a security issue in get_host.Florian Apolloner
Full disclosure and new release forthcoming.
generated by cgit v1.3 (git 2.53.0) at 2026-11-13 18:26:34 +0000