summaryrefslogtreecommitdiff
path: root/django
AgeCommit message (Collapse)Author
2021-12-07[3.1.x] Bumped version for 3.1.14 release.3.1.14Mariusz Felisiak
2021-12-07[3.1.x] Fixed #30530, CVE-2021-44420 -- Fixed potential bypass of an ↵Florian Apolloner
upstream access control based on URL paths. Thanks Sjoerd Job Postmus and TengMA(@te3t123) for reports. Backport of d4dcd5b9dd9e462fec8220e33e3e6c822b7e88a6 from main.
2021-07-01[3.1.x] Post-release version bump.Mariusz Felisiak
2021-07-01[3.1.x] Bumped version for 3.1.13 release.3.1.13Mariusz Felisiak
2021-07-01[3.1.x] Fixed CVE-2021-35042 -- Prevented SQL injection in QuerySet.order_by().Simon Charette
Regression introduced in 513948735b799239f3ef8c89397592445e1a0cd5 by marking the raw SQL column reference feature for deprecation in Django 4.0 while lifting the column format validation. In retrospective the validation should have been kept around and the user should have been pointed at using RawSQL expressions during the deprecation period. The main branch is not affected because the raw SQL column reference support has been removed in 06eec3197009b88e3a633128bbcbd76eea0b46ff per the 4.0 deprecation life cycle. Thanks Joel Saunders for the report.
2021-06-02[3.1.x] Post-release version bump.Carlton Gibson
2021-06-02[3.1.x] Bumped version for 3.1.12 release.3.1.12Carlton Gibson
2021-06-02[3.1.x] Fixed CVE-2021-33571 -- Prevented leading zeros in IPv4 addresses.Mariusz Felisiak
validate_ipv4_address() was affected only on Python < 3.9.5, see [1]. URLValidator() uses a regular expressions and it was affected on all Python versions. [1] https://bugs.python.org/issue36384
2021-06-02[3.1.x] Fixed CVE-2021-33203 -- Fixed potential path-traversal via ↵Florian Apolloner
admindocs' TemplateDetailView.
2021-05-13[3.1.x] Post-release version bump.Mariusz Felisiak
2021-05-13[3.1.x] Bumped version for 3.1.11 release.3.1.11Mariusz Felisiak
2021-05-13[3.1.x] Fixed #32718 -- Relaxed file name validation in FileField.Mariusz Felisiak
- Validate filename returned by FileField.upload_to() not a filename passed to the FileField.generate_filename() (upload_to() may completely ignored passed filename). - Allow relative paths (without dot segments) in the generated filename. Thanks to Jakub Kleň for the report and review. Thanks to all folks for checking this patch on existing projects. Thanks Florian Apolloner and Markus Holtermann for the discussion and implementation idea. Regression in 0b79eb36915d178aef5c6a7bbce71b1e76d376d3. Backport of b55699968fc9ee985384c64e37f6cc74a0a23683 from main.
2021-05-06[3.1.x] Post-release version bump.Mariusz Felisiak
2021-05-06[3.1.x] Bumped version for 3.1.10 release.3.1.10Mariusz Felisiak
2021-05-06[3.1.x] Fixed #32713, Fixed CVE-2021-32052 -- Prevented newlines and tabs ↵Mariusz Felisiak
from being accepted in URLValidator on Python 3.9.5+. In Python 3.9.5+ urllib.parse() automatically removes ASCII newlines and tabs from URLs [1, 2]. Unfortunately it created an issue in the URLValidator. URLValidator uses urllib.urlsplit() and urllib.urlunsplit() for creating a URL variant with Punycode which no longer contains newlines and tabs in Python 3.9.5+. As a consequence, the regular expression matched the URL (without unsafe characters) and the source value (with unsafe characters) was considered valid. [1] https://bugs.python.org/issue43882 and [2] https://github.com/python/cpython/commit/76cd81d60310d65d01f9d7b48a8985d8ab89c8b4 Backport of e1e81aa1c4427411e3c68facdd761229ffea6f6f from main.
2021-05-04[3.1.x] Post-release version bump.Carlton Gibson
2021-05-04[3.1.x] Bumped version for 3.1.9 release.3.1.9Carlton Gibson
2021-04-27[3.1.x] Fixed CVE-2021-31542 -- Tightened path & file name sanitation in ↵Florian Apolloner
file uploads.
2021-04-06[3.1.x] Post-release version bump.Mariusz Felisiak
2021-04-06[3.1.x] Bumped version for 3.1.8 release.3.1.8Mariusz Felisiak
2021-04-06[3.1.x] Fixed CVE-2021-28658 -- Fixed potential directory-traversal via ↵Mariusz Felisiak
uploaded files. Thanks Claude Paroz for the initial patch. Thanks Dennis Brinkrolf for the report. Backport of d4d800ca1addc4141e03c5440a849bb64d1582cd from main.
2021-03-17[3.1.x] Fixed #32560 -- Fixed test runner with --pdb and --buffer on fail/error.Adam Johnson
Backport of 45814af6197cfd8f4dc72ee43b90ecde305a1d5a from main
2021-02-19[3.1.x] Post-release version bump.Carlton Gibson
2021-02-19[3.1.x] Bumped version for 3.1.7 release.3.1.7Carlton Gibson
2021-02-18[3.1.x] Fixed CVE-2021-23336 -- Fixed web cache poisoning via ↵Nick Pope
django.utils.http.limited_parse_qsl().
2021-02-02[3.1.x] Fixed #32403 -- Fixed re-raising DatabaseErrors when using only ↵Mariusz Felisiak
'postgres' database. Thanks Kazantcev Andrey for the report. Regression in f48f671223a20b161ca819cf7d6298e43b8ba5fe. Backport of f131841c601b9d4884adcdb284b4213c2ad89231 from master
2021-02-01[3.1.x] Post-release version bump.Mariusz Felisiak
2021-02-01[3.1.x] Bumped version for 3.1.6 release.3.1.6Mariusz Felisiak
2021-02-01[3.1.x] Fixed CVE-2021-3281 -- Fixed potential directory-traversal via ↵Mariusz Felisiak
archive.extract(). Thanks Florian Apolloner, Shai Berger, and Simon Charette for reviews. Thanks Wang Baohua for the report. Backport of 05413afa8c18cdb978fcdf470e09f7a12b234a23 from master.
2021-01-28[3.1.x] Fixed #32391 -- Used CSS flex properties for changelist filter.Denis Skulimovskiy
Matched layout adjustment using flex from admin sidebar added in d24ba1be7a53a113d19e2860c03aff9922efec24. Filters would become squashed when viewport was constrained or list display table became too wide. Backport of 269a76714616fd7ad166a14113f3354bab8d9b65 from master
2021-01-04[3.1.x] Post-release version bump.Carlton Gibson
2021-01-04[3.1.x] Bumped version for 3.1.5 release.3.1.5Carlton Gibson
2020-12-31[3.1.x] Fixed #32304 -- Fixed prefixing STATIC_URL and MEDIA_URL by ↵Mariusz Felisiak
SCRIPT_NAME for absolute URLs with no domain. Thanks Adam Hooper for the report. Regression in c574bec0929cd2527268c96a492d25223a9fd576. Backport of e13b71403bd1568abed237858127677144d43d23 from master
2020-12-29[3.1.x] Fixed #32299 -- Prevented mutating handlers when processing ↵Mariusz Felisiak
middlewares marking as unused in an async context. Thanks Hubert Bielenia for the report. Backport of 98ad327864aed8df245fd19ea9d2743279e11643 from master
2020-12-11[3.1.x] Fixed #32252 -- Fixed __isnull=True on key transforms on SQLite and ↵sage
Oracle. __isnull=True on key transforms should not match keys with NULL values. Backport of 8d7085e0fd004af5431389f3d903aba6220d7957 from master
2020-12-01[3.1.x] Post-release version bump.Mariusz Felisiak
2020-12-01[3.1.x] Bumped version for 3.1.4 release.3.1.4Mariusz Felisiak
2020-11-25[3.1.x] Fixed #32203 -- Fixed QuerySet.values()/values_list() crash on key ↵sage
transforms with non-string values on SQLite. Thanks Gordon Wrigley for the report. Backport of fe6e5824218bab7cf47dee112d68325b338f9947 from master
2020-11-25[3.1.x] Fixed #32224 -- Avoided suppressing connection errors in ↵Mariusz Felisiak
supports_json_field on SQLite. Regression in 6789ded0a6ab797f0dcdfa6ad5d1cfa46e23abcd. Thanks Juan Garcia Alvite for the report. Backport of f5e5aac59ebbcea46b98d37834915de0f43d7cc8 from master
2020-11-19[3.1.x] Fixed #32200 -- Fixed grouping by ExpressionWrapper() with Q objects.Hasan Ramezani
Thanks Gordon Wrigley for the report. Regression in df32fd42b84cc6dbba173201f244491b0d154a63. Backport of fe9c7ded2996364f853c524b4421274717d89d5f from master
2020-11-19[3.1.x] Fixed #32202 -- Fixed autoreloader argument generation for Windows ↵Carlton Gibson
with Python 3.7-. Backport of ead37dfb580136cc27dbd487a1f1ad90c9235d15 from master
2020-11-10[3.1.x] Fixed #32182 -- Fixed crash of JSONField nested key transforms with ↵Hannes Ljungberg
subquery annotations on PostgreSQL. Backport of 0773837e15bb632afffb6848a58c59a791008fa1 from master
2020-11-04[3.1.x] Fixed #32159 -- Ensured AsyncRequestFactory correctly sets headers.Carlton Gibson
Backport of ebb08d19424c314c75908bc6048ff57c2f872269 from master
2020-11-03[3.1.x] Fixed #32162 -- Fixed setting Content-Length header in ↵Patrick Arminio
AsyncRequestFactory. Backport of 542b4b3ab44d33dfd9b00c22f624ee4aed6f7534 from master
2020-11-02[3.1.x] Post-release version bump.Carlton Gibson
2020-11-02[3.1.x] Bumped version for 3.1.3 release.3.1.3Carlton Gibson
2020-10-29[3.1.x] Fixed #32152 -- Fixed grouping by subquery aliases.Christian Klus
Regression in 42c08ee46539ef44f8658ebb1cbefb408e0d03fe. Thanks Simon Charette for the review. Backport of 4ac2d4fa42e1659f328c35b6b8d4761b3419c11a from master
2020-10-27[3.1.x] Fixed #32127 -- Fixed admin change-form textarea layout for ↵Josh Santos
mid-sized displays. Backport of 36bc47069ce071e80c8129500de3b8664d2058a7 from master
2020-10-27[3.1.x] Fixed #32128 -- Added asgiref 3.3 compatibility.Carlton Gibson
Thread sensitive parameter is True by default from asgiref v3.3.0. Added an explicit thread_sensitive=False to previously implicit uses. Backport of e17ee4468875077b90b70bb6a589ebad7493f757 from master
2020-10-22[3.1.x] Fixed #32130 -- Fixed pre-Django 3.1 password reset tokens validation.Mariusz Felisiak
Thanks Gordon Wrigley for the report and implementation idea. Regression in 226ebb17290b604ef29e82fb5c1fbac3594ac163. Backport of 34180922380cf41cd684f846ecf00f92eb289bcf from master
generated by cgit v1.3 (git 2.53.0) at 2026-10-16 15:23:03 +0000