summaryrefslogtreecommitdiff
path: root/django
AgeCommit message (Collapse)Author
2014-04-21[1.5.x] Update for 1.5.6 security release.1.5.6James Bennett
2014-04-21[1.5.x] Fixed queries that may return unexpected results on MySQL due to ↵Erik Romijn
typecasting. This is a security fix. Disclosure will follow shortly. Backport of 75c0d4ea3ae48970f788c482ee0bd6b29a7f1307 from master
2014-04-21[1.5.x] Prevented leaking the CSRF token through caching.Aymeric Augustin
This is a security fix. Disclosure will follow shortly. Backport of c083e3815aec23b99833da710eea574e6f2e8566 from master
2014-04-21[1.5.x] Fixed a remote code execution vulnerabilty in URL reversing.Tim Graham
Thanks Benjamin Bach for the report and initial patch. This is a security fix; disclosure to follow shortly. Backport of 8b93b31487d6d3b0fcbbd0498991ea0db9088054 from master
2014-03-24[1.5.x] Updated six to 1.6.1.Tim Graham
Backport of 2ec82c7387db071278201796208808de84c90dbf from master
2014-01-26[1.5.x] Fixed #21823 -- Upgraded six to 1.5.2Tim Graham
Backport of 780ae7e9f8 from master.
2013-11-19Fixed missing imports from 16e5fdd9cb8cca4d203b9255a9771b3c370e37d6.Baptiste Mispelon
2013-11-14[1.5.x] Propagate get_user_model exception from get_userMatt Robenolt
Fixes #21439 Backport of 3560ef04 from master. Conflicts: django/contrib/auth/tests/auth_backends.py
2013-11-01[1.5.x] Fixed spelling ("dependant" -> "dependent")Tim Graham
Dependent means reliant on. A dependant is a person like a child or spouse. Thanks Andrew Wilcox for the report. Backport of 090315f5df from master
2013-10-26Revert "[1.5.x] Fixed #21335 -- Use importlib from python3 when using python3"Claude Paroz
This reverts commit 1ef737416ab56a6becee36876769909a37541465. This would require changing some import_module calls (relative syntax, see ec0a3f50852), too much for a stable release.
2013-10-26[1.5.x] Fixed #21335 -- Use importlib from python3 when using python3Andrey Antukh
Backport of 3351e94ffa from master.
2013-10-25[1.5.x] Bump version post-release.Tim Graham
2013-10-24[1.5.x] Bump everything for 1.5.5 bugfix release.1.5.5James Bennett
2013-10-21[1.5.x] Fixed #21253 -- PBKDF2 with cached HMAC keyFlorian Apolloner
This gives a 2x speed increase compared to the existing implementation. Thanks to Steve Thomas for the initial patch and Tim Graham for finishing it. Backport of 1e4f53a6eb8d1816e51eb8bd8f95e704f6b89ead from master.
2013-10-18[1.5.x] Fixed bug causing CSRF token not to rotate on login.Tim Graham
Thanks Gavin McQuillan for the report. Backport of ac4fec5ca2 from master
2013-10-13[1.5.x] Fixed #21256 -- Error in datetime_safe.datetime.combine.Aymeric Augustin
Backport of d9b6fb8 from master
2013-10-09[1.5.x] Fixed #21248 -- Skipped test_bcrypt if no py-bcrypt foundAnssi Kääriäinen
Pre 1.6 Django worked only with py-bcrypt, not with bcrypt. Skipped test_bcrypt when using bcrypt to avoid false positives.
2013-10-09[1.5.x] Fixed #16436 -- defer + annotate + select_related crashTai Lee
Correctly calculate the ``aggregate_start`` offset from loaded fields, if any are deferred, instead of ``self.query.select`` which includes all fields on the model. Backpatch of 69f7db153d8108dcef033207d49f4c80febf3d70 from master.
2013-10-01[1.5.x] Fixed #21203 -- resolve_columns fields misalignmentMichael Manfre
In queries using .defer() together with .select_related() the values and fields arguments didn't align properly for resolve_columns(). Backpatch of 8c27247397cf16b17d0153ae059593c5a468de01 from master.
2013-09-27[1.5.x] Fix #21185: Added tests for unescape_entities.Baptiste Mispelon
Also fixed a py3 incompatibility. Thanks to brutasse for the report. Backport of 3754f4ad410640382f9fe25073da03009cdc2ea3 from master.
2013-09-27[1.5.x] Updated the bundled version of six to 1.4.0.Aymeric Augustin
Backport of 4292097078279226cb725c2921011fb14634b9af from master.
2013-09-25[1.5.x] Fixed #21126 -- QuerySet value conversion failureAnssi Kääriäinen
A .annotate().select_related() query resulted in misaligned rows vs columns for compiler.resolve_columns() method. Report & patch by Michael Manfre. Backpatch of 83554b018ef283827c0e7459ab934d447b3419d5 from master.
2013-09-24[1.5.x] Fixed #21138 -- Increased the performance of our PBKDF2 implementation.Florian Apolloner
Thanks go to Michael Gebetsroither for pointing out this issue and help on the patch. Backport of 68540fe4df44492571bc610a0a043d3d02b3d320 from master.
2013-09-24Revert "[1.5.x] Ensure that passwords are never long enough for a DoS."Florian Apolloner
This reverts commit 22b74fa09d7ccbc8c52270d648a0da7f3f0fa2bc. This fix is no longer necessary, our pbkdf2 (see next commit) implementation no longer rehashes the password every iteration.
2013-09-22[1.5.x] Fixed "Address already in use" from liveserver.Florian Apolloner
Our WSGIServer rewrapped the socket errors from server_bind into WSGIServerExceptions, which is used later on to provide nicer error messages in runserver and used by the liveserver to see if the port is already in use. But wrapping server_bind isn't enough since it only binds to the socket, socket.listen (which is called from server_activate) could also raise "Address already in use". Instead of overriding server_activate too I chose to just catch socket errors, which seems to make more sense anyways and should be more robust against changes in wsgiref. Backport of 2ca00faa913754cd5860f6e1f23c8da2529c691a from master
2013-09-17[1.5.x] Final attempt to solve sporadic test failures.Florian Apolloner
tearDownClass is not called if setUpClass throws an exception, in our case this means that LiveServerTestCase leaks LiveServerThread sockets if the test happens to be skipped later on, and AdminSeleniumWebDriverTestCase doesn't close it's already open browser window. To prevent this leakage we catch errors where needed and manually call _tearDownClassInternal. _tearDownClassInternal should be written as defensively as possible since it is not allowed to make any assumptions on how far setUpClass got. This patch should fix the sporadic "Address already in use"-errors on jenkins and also the "This code isn't under transaction management"-error for sqlite (also just on jenkins). After discussion with koniiiik, jezdez, kmtracey, tos9, lifeless, nedbat and voidspace it was decided that this is the safest approach (thanks to everyone for their comments and help). Manually calling tearDownClass was shut down cause we don't know how our users override our classes. This is a private and very specialized API on purpose and should not be used without a strong reason! This patch partially reverts the earlier attempts to fix those issues, namely: 2fa0dd73b18f55d0fdd1c1d54b1d18031bfcf1ed and 3c5775d36f7e431d9691829a78580873111cb714 Final note: If this patch breaks in a later version of Django, please be very careful on how you fix it, you might not see test failures locally. That said, this patch hopefully doesn't produce even more failures. Backport of 73a610d2a81bc3bf2d3834786b2458bc85953ed0 from master.
2013-09-15[1.5.x] Bump version post-release.Tim Graham
2013-09-15[1.5.x] Add release notes and bump version numbers for 1.5.4 security release.1.5.4James Bennett
2013-09-15[1.5.x] Ensure that passwords are never long enough for a DoS.Russell Keith-Magee
* Limit the password length to 4096 bytes * Password hashers will raise a ValueError * django.contrib.auth forms will fail validation * Document in release notes that this is a backwards incompatible change Thanks to Josh Wright for the report, and Donald Stufft for the patch. This is a security fix; disclosure to follow shortly. Backport of aae5a96d5754ad34e48b7f673ef2411a3bbc1015 from master.
2013-09-14Fixed #21102 -- pickling a QuerySet with prefetches twiceMinjong Chung
Fixed the bug that a QuerySet that prefetches related objects cannot be pickled and unpickled more than once (The second pickling attempt raises an exception). Added a new test for the queryset pickling idempotency. The bug was introduced by bac187c0d8e829fb3ca2ca82965eabbcbcb6ddd5.
2013-09-13[1.5.x] Fixed #18923 -- Corrected usage of sensitive_post_parameters in ↵Tim Graham
contrib.auth Thanks Collin Anderson for the report. Backport of 425d076d0c from master
2013-09-11[1.5.x] Bump version post-release.Tim Graham
2013-09-10[1.5.x] Bump version numbers for 1.5.3 security release.1.5.3James Bennett
2013-09-10[1.5.x] Prevented arbitrary file inclusion with {% ssi %} tag and relative ↵Tim Graham
paths. Thanks Rainer Koirikivi for the report and draft patch. This is a security fix; disclosure to follow shortly. Backport of 7fe5b656c9 from master
2013-09-09[1.5.x] Fixed #20707 -- Added explicit quota assignment to Oracle test userСадовский Николай
To enable testing on Oracle 12c
2013-08-22[1.5.x] Fixed #20922 -- Allowed customizing the serializer used by ↵Tim Graham
contrib.sessions Added settings.SESSION_SERIALIZER which is the import path of a serializer to use for sessions. Thanks apollo13, carljm, shaib, akaariai, charettes, and dstufft for reviews. Backport of b0ce6fe656 from master
2013-08-13Bump version post-release.Jacob Kaplan-Moss
2013-08-13Bumped version numbers for 1.5.2.Jacob Kaplan-Moss
2013-08-13Apply autoescaping to AdminURLFieldWidget.Jacob Kaplan-Moss
This is a security fix; disclosure to follow shortly.
2013-08-13Fixed is_safe_url() to reject URLs that use a scheme other than HTTP/S.Jacob Kaplan-Moss
This is a security fix; disclosure to follow shortly.
2013-07-29[1.5.x] Fixed #20774 -- Mention the new django-localflavor app as a ↵Jannis Leidel
replacement for the contrib app. Backport from master.
2013-07-28[1.5.x] Simplified smart_urlquote and added some basic tests.Florian Apolloner
Backport of b70c371fc1f18ea0c43b503122df3f311afc7105 from master.
2013-07-27[1.5.x] Optimisation in prefetch_related_objectsLuke Plant
Backport of 17559e6eb0 from master
2013-07-27[1.5.x] Fixed #19607 - prefetch_related crashLuke Plant
Thanks to av@rdf.ru and flarno11@yahoo.de for the report. Backport of 4fd94969d8 from master
2013-07-25[1.5.x] Fixed #20679 -- Corrected CachedFilesMixin.post_process docstring.Tim Graham
Thanks bmispelon for the report. Backport of 9b88dd3809 from master
2013-07-22[1.5.x] Fixed #20773 -- [gis] Fixed regression in GoogleMap outputClaude Paroz
Thanks Martyn Clement for the report and the initial patch. Backport of 27c1a7257 from master.
2013-07-13[1.5.x] Fixed #20681 -- Prevented teardown_databases from attempting to tear ↵Tim Graham
down aliases Thanks simonpercivall. Backport of d9c580306c from master
2013-07-10[1.5.x] Fixed #20075 -- Fixed session test fail when using a cache other ↵Mathijs de Bruin
than LocMemCache. As override_settings was used after the initialization of the session backend, we need to use a new session backend here. Backport of 8c1cc4b3b0 from master
2013-07-09[1.5.x] Fixed #20722 -- Fixed MemcachedCache backend get_many on Python 3.Tim Graham
Backport of 3c736207a3 from master
2013-07-07[1.5.x] Fixed #20711 -- Fixed broken link in timesince.py docstringSusanTan
Backport of d63327d843 from master.
generated by cgit v1.3 (git 2.53.0) at 2026-10-18 03:50:43 +0000