summaryrefslogtreecommitdiff
path: root/django
AgeCommit message (Collapse)Author
2024-07-09[4.2.x] Bumped version for 4.2.14 release.4.2.14Natalia
2024-07-09[4.2.x] Fixed CVE-2024-39614 -- Mitigated potential DoS in ↵Sarah Boyce
get_supported_language_variant(). Language codes are now parsed with a maximum length limit of 500 chars. Thanks to MProgrammer for the report.
2024-07-09[4.2.x] Fixed CVE-2024-39330 -- Added extra file name validation in ↵Natalia
Storage's save method. Thanks to Josh Schneier for the report, and to Carlton Gibson and Sarah Boyce for the reviews.
2024-07-09[4.2.x] Fixed CVE-2024-39329 -- Standarized timing of verify_password() when ↵Michael Manfre
checking unusuable passwords. Refs #20760. Thanks Michael Manfre for the fix and to Adam Johnson for the review.
2024-07-09[4.2.x] Fixed CVE-2024-38875 -- Mitigated potential DoS in urlize and ↵Adam Johnson
urlizetrunc template filters. Thank you to Elias Myllymäki for the report. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
2024-05-07[4.2.x]Post-release version bump.Natalia
2024-05-07[4.2.x] Bumped version for 4.2.13 release.4.2.13Sarah Boyce
2024-05-06[4.2.x] Post-release version bump.Natalia
2024-05-06[4.2.x] Bumped version for 4.2.12 release.4.2.12Sarah Boyce
2024-04-19[4.2.x] Reverted "Fixed #34994, Fixed #35386 -- Applied checkbox-row CSS ↵Sarah Boyce
class unconditionally in Admin." This reverts commit 0fc832676cd585fa420d583937b5b2318bc2c629.
2024-04-19[4.2.x] Fixed #34994, Fixed #35386 -- Applied checkbox-row CSS class ↵Adam Johnson
unconditionally in Admin. Backport of bdd76c4c3817d8e3ed5b0450d5e18e4eae096f16 from main.
2024-04-10[4.2.x] Refs #34900, Refs #35361 -- Fixed SafeMIMEText.set_payload() crash ↵Mariusz Felisiak
on Python 3.13. Payloads with surrogates are passed to the set_payload() since https://github.com/python/cpython/commit/f97f25ef5dfcdfec0d9a359fd970abd139cf3428 Backport of b231bcd19e57267ce1fc21d42d46f0b65fdcfcf8 from main.
2024-03-04[4.2.x] Post-release version bump.Mariusz Felisiak
2024-03-04[4.2.x] Bumped version for 4.2.11 release.4.2.11Mariusz Felisiak
2024-03-04[4.2.x] Fixed CVE-2024-27351 -- Prevented potential ReDoS in Truncator.words().Shai Berger
Thanks Seokchan Yoon for the report. Co-Authored-By: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2024-02-08[4.2.x] Fixed #35172 -- Fixed intcomma for string floats.Mariusz Felisiak
Thanks Warwick Brown for the report. Regression in 55519d6cf8998fe4c8f5c8abffc2b10a7c3d14e9. Backport of 2f14c2cedc9c92373471c1f98a80c81ba299584a from main.
2024-02-06[4.2.x] Post release version bump.Natalia
2024-02-06[4.2.x] Bumped version for 4.2.10 release.4.2.10Natalia
2024-02-06[4.2.x] Fixed CVE-2024-24680 -- Mitigated potential DoS in intcomma template ↵Adam Johnson
filter. Thanks Seokchan Yoon for the report. Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Co-authored-by: Shai Berger <shai@platonix.com>
2024-01-02[4.2.x] Post-release version bump.Mariusz Felisiak
2024-01-02[4.2.x] Bumped version for 4.2.9 release.4.2.9Mariusz Felisiak
2023-12-13[4.2.x] Fixed #35012 -- Restored wrapping admin fieldsets with multiple ↵Tom Carrick
fields per line. Thanks James Gillard for the report. Regression in 729266c6f29c7a0677b24926a86a767ef3078b26. Backport of 4aae864463b149393a36e0b18345cf6ed392634d from main
2023-12-04[4.2.x] Post-release version bump.Mariusz Felisiak
2023-12-04[4.2.x] Bumped version for 4.2.8 release.4.2.8Mariusz Felisiak
2023-11-30[4.2.x] Fixed #35006 -- Fixed migrations crash when altering ↵Mariusz Felisiak
Meta.db_table_comment on SQLite. Thanks Юрий for the report. Regression in 78f163a4fb3937aca2e71786fbdd51a0ef39629e. Backport of 37fc832a54ad37e75a898a2c8f9ab0820617c4af from main
2023-11-27[4.2.x] Fixed #34982 -- Fixed admin's read-only password widget and help ↵Tom Carrick
texts alignment for tablet screen size. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> Backport of 729266c6f29c7a0677b24926a86a767ef3078b26 from main
2023-11-27[4.2.x] Fixed #34992 -- Fixed DatabaseFeatures.allows_group_by_selected_pks ↵Nathaniel Conroy
on MariaDB with ONLY_FULL_GROUP_BY sql mode. Regression in 041551d716b69ee7c81199eee86a2d10a72e15ab. Backport of 0257426fe1fe9d146fd5813f09d909917ff59360 from main.
2023-11-23[4.2.x] Fixed #34994 -- Fixed checkbox layout in admin's change page for ↵Tom Carrick
narrow screen widths. Regression in d687febce5868545f99974d2499a91f81a32fef5. Backport of a89c715c3bcf7ab1a90747cf8658ebce6304b6e4 from main
2023-11-23[4.2.x] Fixed #34991 -- Fixed pagination links and input layout in admin's ↵Tom Carrick
change list page when using list_editable. Regression in b4817d20b9e55df30be0b1b2ca8c8bb6d61aab07. Thanks Tom Carrick for the report and fix. Backport of 4eb9c3d90aff55182151b6be0122f7d0b28832fd from main
2023-11-23[4.2.x] Fixed #34987 -- Fixed queryset crash when mixing aggregate and ↵Simon Charette
window annotations. Regression in f387d024fc75569d2a4a338bfda76cc2f328f627. Just like `OrderByList` the `ExpressionList` expression used to wrap `Window.partition_by` must implement `get_group_by_cols` to ensure the necessary grouping when mixing window expressions with aggregate annotations is performed against the partition members and not the partition expression itself. This is necessary because while `partition_by` is implemented as a source expression of `Window` it's actually a fragment of the WINDOW expression at the SQL level and thus it should result in a group by its members and not the sum of them. Thanks ElRoberto538 for the report. Backport of e76cc93b0168fa3abbafb9af1ab4535814b751f0 from main
2023-11-19[4.2.x] Refs #34118 -- Fixed stacklevel in complex_setting_changed on Python ↵Mariusz Felisiak
3.12. This fix is unnecessary in Django 5.0 since e83a88566a71a2353cebc35992c110be0f8628af because signals no longer use sync_to_async().
2023-11-18[4.2.x] Fixed #34975 -- Fixed crash of conditional aggregate() over ↵Simon Charette
aggregations. Adjustments made to solve_lookup_type to defer the resolving of references for summarized aggregates failed to account for similar requirements for lookup values which can also reference annotations through Aggregate.filter. Regression in b181cae2e3697b2e53b5b67ac67e59f3b05a6f0d. Refs #25307. Thanks Sergey Nesterenko for the report. Backport of 7530cf3900ab98104edcde69e8a2a415e82b345a from main
2023-11-09[4.2.x] Fixed #34457 -- Restored output for makemigrations --check.Adam Johnson
Co-authored-by: David Sanders <shang.xiao.sanders@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of f7389c4b07ceeb036436e065898e411b247bca78 from main
2023-11-01[4.2.x] Post-release version bump.Mariusz Felisiak
2023-11-01[4.2.x] Bumped version for 4.2.7 release.4.2.7Mariusz Felisiak
2023-11-01[4.2.x] Fixed CVE-2023-46695 -- Fixed potential DoS in UsernameField on Windows.Mariusz Felisiak
Thanks MProgrammer (https://hackerone.com/mprogrammer) for the report.
2023-10-30[4.2.x] Fixed #34932 -- Restored varchar_pattern_ops/text_pattern_ops index ↵Tom Carrick
creation when deterministic collaction is set. Regression in f3f9d03edf17ccfa17263c7efa0b1350d1ac9278 (4.2) and 8ed25d65ea7546fafd808086fa07e7e5bb5428fc (5.0). Backport of 34b411762b50883d768d7b67e0a158ec39da8b09 from main.
2023-10-16[4.2.x] Fixed #34798 -- Fixed QuerySet.aggregate() crash when referencing ↵Simon Charette
expressions containing subqueries. Regression in 59bea9efd2768102fc9d3aedda469502c218e9b7, complements e5c844d6f2a4ac6ae674d741b5f1fa2a688cedf4. Refs #28477, #34551. Thanks Haldun Komsuoglu for the report. Backport of 3b4a571275d967512866012955eb0b3ae486d63c from main
2023-10-10[4.2.x] Refs #26029 -- Improved get_storage_class() deprecation warning with ↵Carlton Gibson
stacklevel=2. Addition of the `stacklevel` argument shows the source of the deprecated call, making updating the client code simpler. Backport of fa6e6f31137ee4025adfb27f88c07eebd488d446 from stable/5.0.x.
2023-10-04[4.2.x] Post release version bump.Natalia
2023-10-04[4.2.x] Bumped version for 4.2.6 release.4.2.6Natalia
2023-10-04[4.2.x] Fixed CVE-2023-43665 -- Mitigated potential DoS in ↵Natalia
django.utils.text.Truncator when truncating HTML text. Thanks Wenchao Li of Alibaba Group for the report.
2023-09-27[4.2.x] Refs #34320 -- Skipped ↵Mariusz Felisiak
SchemaTests.test_rename_field_with_check_to_truncated_name on MariaBD 10.5.2+. This crashes since MariaDB was bumped to 10.5 on Jenkins.
2023-09-22[4.2.x] Fixed #34840 -- Avoided casting string base fields on PostgreSQL.Mariusz Felisiak
Thanks Alex Vandiver for the report. Regression in 09ffc5c1212d4ced58b708cbbf3dfbfb77b782ca. Backport of 779cd28acb1f7eb06f629c0ea4ded99b5ebb670a from main.
2023-09-11[4.2.x] Fixed #34821 -- Prevented DEFAULT_FILE_STORAGE/STATICFILES_STORAGE ↵Mariusz Felisiak
settings from mutating the main STORAGES. Regression in 6b965c600054f970bdf94017ecf2e0e6e0a4326b. Backport of a7c73b944f51d6c92ec876fd7e0a171e7c01657d from main
2023-09-04[4.2.x] Post-release version bump.Mariusz Felisiak
2023-09-04[4.2.x] Bumped version for 4.2.5 release.4.2.5Mariusz Felisiak
2023-09-04[4.2.x] Fixed CVE-2023-41164 -- Fixed potential DoS in ↵Mariusz Felisiak
django.utils.encoding.uri_to_iri(). Thanks MProgrammer (https://hackerone.com/mprogrammer) for the report. Co-authored-by: nessita <124304+nessita@users.noreply.github.com>
2023-09-01[4.2.x] Fixed #34803 -- Fixed queryset crash when filtering againts deeply ↵willzhao
nested OuterRef annotations. Thanks Pierre-Nicolas Rigal for the report. Regression in c67ea79aa981ae82595d89f8018a41fcd842e7c9. Backport of 9cc0d7f7f85cecc3ad15bbc471fe6a08e4f515b6 from main
2023-08-19[4.2.x] Fixed #34779 -- Avoided unnecessary selection of non-nullable m2m ↵Juan Alvarez
fields without natural keys during serialization. By using `select_related(None)` instead of `select_related()`, the unnecessary joins are completely avoided. Note that the current tests already covers the change, when the field is not `null=True`. Regression in f9936deed1ff13b20e18bd9ca2b0750b52706b6c. Backport of 517d3bb4dd17e9c51690c98d747b86a0ed8b2fbf from main
generated by cgit v1.3 (git 2.53.0) at 2026-07-13 08:10:04 +0000