summaryrefslogtreecommitdiff
path: root/django
AgeCommit message (Collapse)Author
2014-10-22[1.5.x] Update version numbers for bugfix release.1.5.11James Bennett
2014-10-06[1.5.x] Fixed #23604 -- Allowed related m2m fields to be references in the ↵Emmanuelle Delescolle
admin. Thanks Simon Charette for review. Backport of a24cf21722 from master
2014-09-08[1.5.x] Fixed #23431 -- Allowed inline and hidden references to admin fields.Simon Charette
This fixes a regression introduced by the 53ff096982 security fix. Thanks to @a1tus for the report and Tim for the review. refs #23329. Backport of 342ccbd from master
2014-09-02[1.5.x] Bump version numbers for bugfix release.1.5.10James Bennett
2014-08-27Fixed #23329 -- Allowed inherited and m2m fields to be referenced in the admin.Simon Charette
Thanks to Trac alias Markush2010 and ross for the detailed reports. Backport of 3cbb759 from master
2014-08-20[1.5.x] Bumped version number post-release.Tim Graham
2014-08-20[1.5.x] Bump version numbers for security release.1.5.9James Bennett
2014-08-20[1.5.x] Prevented data leakage in contrib.admin via query string manipulation.Simon Charette
This is a security fix. Disclosure following shortly.
2014-08-20[1.5.x] Fixed #23066 -- Modified RemoteUserMiddleware to logout on ↵Preston Holmes
REMOTE_USE change. This is a security fix. Disclosure following shortly.
2014-08-20[1.5.x] Fixed #23157 -- Removed O(n) algorithm when uploading duplicate file ↵Tim Graham
names. This is a security fix. Disclosure following shortly.
2014-08-20[1.5.x] Prevented reverse() from generating URLs pointing to other hosts.Florian Apolloner
This is a security fix. Disclosure following shortly.
2014-07-14[1.5.x] Revert "Fixed #13794 -- Fixed to_field usage in BaseInlineFormSet."Ramiro Morales
This reverts commit 4ae68f677b3348765d8649d8b57beffa18fe8d3d. stable/1.5.x branch is in security-fixes-only mode.
2014-07-14[1.5.x] Fixed #13794 -- Fixed to_field usage in BaseInlineFormSet.Tim Graham
Thanks sebastien at clarisys.fr for the report and gautier for the patch. Backport of 5e2c4a4bd1 from master
2014-05-14Bumped version number post release.Jacob Kaplan-Moss
2014-05-14Bumped version numbers for release.1.5.8Jacob Kaplan-Moss
2014-05-12[1.5.x] Added additional checks in is_safe_url to account for flexible parsing.Erik Romijn
This is a security fix. Disclosure following shortly.
2014-05-12[1.5.x] Dropped fix_IE_for_vary/attach.Aymeric Augustin
This is a security fix. Disclosure following shortly.
2014-04-28[1.5.x] Post release version bump.Tim Graham
2014-04-28[1.5.x] Update version numbers for 1.5.7 bugfix release.1.5.7James Bennett
2014-04-23[1.5.x] Removed bad import in last commit.Tim Graham
2014-04-23[1.5.x] Fixed #22486 -- Restored the ability to reverse views created using ↵Tim Graham
functools.partial. Regression in 8b93b31487d6d3b0fcbbd0498991ea0db9088054. Thanks rcoup for the report. Backport of 3c06b2f2a3 from master
2014-04-22[1.5.x] Post release version bump.Tim Graham
2014-04-21[1.5.x] Update for 1.5.6 security release.1.5.6James Bennett
2014-04-21[1.5.x] Fixed queries that may return unexpected results on MySQL due to ↵Erik Romijn
typecasting. This is a security fix. Disclosure will follow shortly. Backport of 75c0d4ea3ae48970f788c482ee0bd6b29a7f1307 from master
2014-04-21[1.5.x] Prevented leaking the CSRF token through caching.Aymeric Augustin
This is a security fix. Disclosure will follow shortly. Backport of c083e3815aec23b99833da710eea574e6f2e8566 from master
2014-04-21[1.5.x] Fixed a remote code execution vulnerabilty in URL reversing.Tim Graham
Thanks Benjamin Bach for the report and initial patch. This is a security fix; disclosure to follow shortly. Backport of 8b93b31487d6d3b0fcbbd0498991ea0db9088054 from master
2014-03-24[1.5.x] Updated six to 1.6.1.Tim Graham
Backport of 2ec82c7387db071278201796208808de84c90dbf from master
2014-01-26[1.5.x] Fixed #21823 -- Upgraded six to 1.5.2Tim Graham
Backport of 780ae7e9f8 from master.
2013-11-19Fixed missing imports from 16e5fdd9cb8cca4d203b9255a9771b3c370e37d6.Baptiste Mispelon
2013-11-14[1.5.x] Propagate get_user_model exception from get_userMatt Robenolt
Fixes #21439 Backport of 3560ef04 from master. Conflicts: django/contrib/auth/tests/auth_backends.py
2013-11-01[1.5.x] Fixed spelling ("dependant" -> "dependent")Tim Graham
Dependent means reliant on. A dependant is a person like a child or spouse. Thanks Andrew Wilcox for the report. Backport of 090315f5df from master
2013-10-26Revert "[1.5.x] Fixed #21335 -- Use importlib from python3 when using python3"Claude Paroz
This reverts commit 1ef737416ab56a6becee36876769909a37541465. This would require changing some import_module calls (relative syntax, see ec0a3f50852), too much for a stable release.
2013-10-26[1.5.x] Fixed #21335 -- Use importlib from python3 when using python3Andrey Antukh
Backport of 3351e94ffa from master.
2013-10-25[1.5.x] Bump version post-release.Tim Graham
2013-10-24[1.5.x] Bump everything for 1.5.5 bugfix release.1.5.5James Bennett
2013-10-21[1.5.x] Fixed #21253 -- PBKDF2 with cached HMAC keyFlorian Apolloner
This gives a 2x speed increase compared to the existing implementation. Thanks to Steve Thomas for the initial patch and Tim Graham for finishing it. Backport of 1e4f53a6eb8d1816e51eb8bd8f95e704f6b89ead from master.
2013-10-18[1.5.x] Fixed bug causing CSRF token not to rotate on login.Tim Graham
Thanks Gavin McQuillan for the report. Backport of ac4fec5ca2 from master
2013-10-13[1.5.x] Fixed #21256 -- Error in datetime_safe.datetime.combine.Aymeric Augustin
Backport of d9b6fb8 from master
2013-10-09[1.5.x] Fixed #21248 -- Skipped test_bcrypt if no py-bcrypt foundAnssi Kääriäinen
Pre 1.6 Django worked only with py-bcrypt, not with bcrypt. Skipped test_bcrypt when using bcrypt to avoid false positives.
2013-10-09[1.5.x] Fixed #16436 -- defer + annotate + select_related crashTai Lee
Correctly calculate the ``aggregate_start`` offset from loaded fields, if any are deferred, instead of ``self.query.select`` which includes all fields on the model. Backpatch of 69f7db153d8108dcef033207d49f4c80febf3d70 from master.
2013-10-01[1.5.x] Fixed #21203 -- resolve_columns fields misalignmentMichael Manfre
In queries using .defer() together with .select_related() the values and fields arguments didn't align properly for resolve_columns(). Backpatch of 8c27247397cf16b17d0153ae059593c5a468de01 from master.
2013-09-27[1.5.x] Fix #21185: Added tests for unescape_entities.Baptiste Mispelon
Also fixed a py3 incompatibility. Thanks to brutasse for the report. Backport of 3754f4ad410640382f9fe25073da03009cdc2ea3 from master.
2013-09-27[1.5.x] Updated the bundled version of six to 1.4.0.Aymeric Augustin
Backport of 4292097078279226cb725c2921011fb14634b9af from master.
2013-09-25[1.5.x] Fixed #21126 -- QuerySet value conversion failureAnssi Kääriäinen
A .annotate().select_related() query resulted in misaligned rows vs columns for compiler.resolve_columns() method. Report & patch by Michael Manfre. Backpatch of 83554b018ef283827c0e7459ab934d447b3419d5 from master.
2013-09-24[1.5.x] Fixed #21138 -- Increased the performance of our PBKDF2 implementation.Florian Apolloner
Thanks go to Michael Gebetsroither for pointing out this issue and help on the patch. Backport of 68540fe4df44492571bc610a0a043d3d02b3d320 from master.
2013-09-24Revert "[1.5.x] Ensure that passwords are never long enough for a DoS."Florian Apolloner
This reverts commit 22b74fa09d7ccbc8c52270d648a0da7f3f0fa2bc. This fix is no longer necessary, our pbkdf2 (see next commit) implementation no longer rehashes the password every iteration.
2013-09-22[1.5.x] Fixed "Address already in use" from liveserver.Florian Apolloner
Our WSGIServer rewrapped the socket errors from server_bind into WSGIServerExceptions, which is used later on to provide nicer error messages in runserver and used by the liveserver to see if the port is already in use. But wrapping server_bind isn't enough since it only binds to the socket, socket.listen (which is called from server_activate) could also raise "Address already in use". Instead of overriding server_activate too I chose to just catch socket errors, which seems to make more sense anyways and should be more robust against changes in wsgiref. Backport of 2ca00faa913754cd5860f6e1f23c8da2529c691a from master
2013-09-17[1.5.x] Final attempt to solve sporadic test failures.Florian Apolloner
tearDownClass is not called if setUpClass throws an exception, in our case this means that LiveServerTestCase leaks LiveServerThread sockets if the test happens to be skipped later on, and AdminSeleniumWebDriverTestCase doesn't close it's already open browser window. To prevent this leakage we catch errors where needed and manually call _tearDownClassInternal. _tearDownClassInternal should be written as defensively as possible since it is not allowed to make any assumptions on how far setUpClass got. This patch should fix the sporadic "Address already in use"-errors on jenkins and also the "This code isn't under transaction management"-error for sqlite (also just on jenkins). After discussion with koniiiik, jezdez, kmtracey, tos9, lifeless, nedbat and voidspace it was decided that this is the safest approach (thanks to everyone for their comments and help). Manually calling tearDownClass was shut down cause we don't know how our users override our classes. This is a private and very specialized API on purpose and should not be used without a strong reason! This patch partially reverts the earlier attempts to fix those issues, namely: 2fa0dd73b18f55d0fdd1c1d54b1d18031bfcf1ed and 3c5775d36f7e431d9691829a78580873111cb714 Final note: If this patch breaks in a later version of Django, please be very careful on how you fix it, you might not see test failures locally. That said, this patch hopefully doesn't produce even more failures. Backport of 73a610d2a81bc3bf2d3834786b2458bc85953ed0 from master.
2013-09-15[1.5.x] Bump version post-release.Tim Graham
2013-09-15[1.5.x] Add release notes and bump version numbers for 1.5.4 security release.1.5.4James Bennett
generated by cgit v1.3 (git 2.53.0) at 2026-10-15 12:34:29 +0000