summaryrefslogtreecommitdiff
path: root/django
AgeCommit message (Collapse)Author
2025-06-10[5.1.x] Bumped version for 5.1.11 release.5.1.11Sarah Boyce
2025-06-06[5.1.x] Refs CVE-2025-48432 -- Prevented log injection in remaining response ↵Jake Howard
logging. Migrated remaining response-related logging to use the `log_response()` helper to avoid potential log injection, to ensure untrusted values like request paths are safely escaped. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 957951755259b412d5113333b32bf85871d29814 from main.
2025-06-06[5.1.x] Refs CVE-2025-48432 -- Made SuspiciousOperation logging use ↵Natalia
log_response() for consistency. Backport of ff835f439cb1ecd8d74a24de12e3c03e5477dc9d from main.
2025-06-04[5.1.x] Post-release version bump.Natalia
2025-06-04[5.1.x] Bumped version for 5.1.10 release.5.1.10Natalia
2025-06-04[5.1.x] Fixed CVE-2025-48432 -- Escaped formatting arguments in ↵Natalia
`log_response()`. Suitably crafted requests containing a CRLF sequence in the request path may have allowed log injection, potentially corrupting log files, obscuring other attacks, misleading log post-processing tools, or forging log entries. To mitigate this, all positional formatting arguments passed to the logger are now escaped using "unicode_escape" encoding. Thanks to Seokchan Yoon (https://ch4n3.kr/) for the report. Co-authored-by: Carlton Gibson <carlton@noumenal.es> Co-authored-by: Jake Howard <git@theorangeone.net> Backport of a07ebec5591e233d8bbb38b7d63f35c5479eef0e from main.
2025-05-06[5.1.x] Post-release version bump.Natalia
2025-05-06[5.1.x] Bumped version for 5.1.9 release.5.1.9Natalia
2025-05-06[5.1.x] Fixed CVE-2025-32873 -- Mitigated potential DoS in strip_tags().Sarah Boyce
Thanks to Elias Myllymäki for the report, and Shai Berger and Jake Howard for the reviews. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 9f3419b519799d69f2aba70b9d25abe2e70d03e0 from main.
2025-04-23[5.1.x] Fixed #36341 -- Preserved whitespaces in wordwrap template filter.Matti Pohjanvirta
Regression in 55d89e25f4115c5674cdd9b9bcba2bb2bb6d820b. This work improves the django.utils.text.wrap() function to ensure that empty lines and lines with whitespace only are kept instead of being dropped. Thanks Matti Pohjanvirta for the report and fix. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 1e9db35836d42a3c72f3d1015c2f302eb6fee046 from main.
2025-04-23[5.1.x] Fixed warnings per flake8 7.2.0.Mariusz Felisiak
https://github.com/PyCQA/flake8/releases/tag/7.2.0 Backport of 281910ff8e9ae98fa78ee5d26ae3f0b713ccf418 from main.
2025-04-07[5.1.x] Fixed #36298 -- Truncated the overwritten file content in ↵Sarah Boyce
file_move_safe(). Regression in 58cd4902a71a3695dd6c21dc957f59c333db364c. Thanks Baptiste Mispelon for the report. Backport of 8ad3e80e88201f4c557f6fa79fcfc0f8a0961830 from main.
2025-04-02[5.1.x] Post-release version bump.Sarah Boyce
2025-04-02[5.1.x] Bumped version for 5.1.8 release.5.1.8Sarah Boyce
2025-04-02[5.1.x] Fixed CVE-2025-27556 -- Mitigated potential DoS in ↵Sarah Boyce
url_has_allowed_host_and_scheme() on Windows. Thank you sw0rd1ight for the report. Backport of 39e2297210d9d2938c75fc911d45f0e863dc4821 from main.
2025-03-12[5.1.x] Fixed #36234 -- Restored single_object argument to ↵Adam Johnson
LogEntry.objects.log_actions(). Thank you Adam Johnson for the report and fix. Thank you Sarah Boyce for your spot on analysis. Regression in c09bceef68e5abb79accedd12dade16aa6577a09, which is partially reverted in this branch. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> Backport of 27b68bcadf1ab2e9f7fd223aed42db352ccdc62d from main.
2025-03-06[5.1.x] Post-release version bump.Sarah Boyce
2025-03-06[5.1.x] Bumped version for 5.1.7 release.5.1.7Sarah Boyce
2025-03-06[5.1.x] Fixed CVE-2025-26699 -- Mitigated potential DoS in wordwrap template ↵Sarah Boyce
filter. Thanks sw0rd1ight for the report. Backport of 55d89e25f4115c5674cdd9b9bcba2bb2bb6d820b from main.
2025-03-04[5.1.x] Fixed #36217 -- Restored pre_save/post_save signal emission via ↵antoliny0919
LogEntry.save() for single-object deletion in the admin. Regression in 40b3975e7d3e1464a733c69171ad7d38f8814280. Thanks smiling-watermelon for the report. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> Backport of c09bceef68e5abb79accedd12dade16aa6577a09 from main.
2025-02-18[5.1.x] Fixed #36197 -- Fixed improper many-to-many count() and exists() for ↵Simon Charette
non-pk to_field. Regression in 66e47ac69a7e71cf32eee312d05668d8f1ba24bb. Thanks mfontana-elem for the report and Sarah for the tests. Backport of c3a23aa02faa1cf1d32e43d66858e793cd9ecac4 from main.
2025-02-17[5.1.x] Fixed #36191 -- Truncated the overwritten file content in ↵Gaël Utard
FileSystemStorage. Backport of 0d1dd6bba0c18b7feb6caa5cbd8df80fbac54afd from main.
2025-02-13[5.1.x] Fixed #36182 -- Returned "?" if all parameters are removed in ↵Sarah Boyce
querystring template tag. Thank you to David Feeley for the report and Natalia Bidart for the review. Backport of 05002c153c5018e4429a326a6699c7c45e5ea957 from main.
2025-02-05[5.1.x] Post-release version bump.Natalia
2025-02-05[5.1.x] Bumped version for 5.1.6 release.5.1.6Natalia
2025-02-02[5.1.x] Refs #36140 -- Added missing import in django/contrib/auth/forms.py.Mariusz Felisiak
Follow up to 8552eef95e400d5bad3261b28ad2500b57070d57.
2025-02-01[5.1.x] Fixed #36140 -- Allowed BaseUserCreationForm to define non required ↵nessita
password fields. Regression in e626716c28b6286f8cf0f8174077f3d2244f3eb3. Thanks buffgecko12 for the report and Sarah Boyce for the review. Backport of d15454a6e84a595ffc8dc1b926282f484f782a8f from main.
2025-01-15[5.1.x] Simplified GeoIP2._query() when passing IPv4Address()/IPv6Address() ↵Mariusz Felisiak
instances. There is no need to call validate_ipv46_address() for ipaddress.IPv4Address()/ipaddress.IPv6Address() instances since this relies on trying to create these kind objects from strings, so they will always be valid. Backport of 0cabed9efa2c7abd1693860069f20ec5db41fcd8 from main.
2025-01-15[5.1.x] Fixed #36098 -- Fixed ↵Mariusz Felisiak
validate_ipv6_address()/validate_ipv46_address() crash for non-string values. Regression in ca2be7724e1244a4cb723de40a070f873c6e94bf. Backport of b3c5830769d8a5dbf2f974da7116fe503c9454d9 from main.
2025-01-14[5.1.x] Post-release version bump.Natalia
2025-01-14[5.1.x] Bumped version for 5.1.5 release.5.1.5Natalia
2025-01-14[5.1.x] Fixed CVE-2024-56374 -- Mitigated potential DoS in IPv6 validation.Michael Manfre
Thanks Saravana Kumar for the report, and Sarah Boyce and Mariusz Felisiak for the reviews. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2024-12-17[5.1.x] Fixed #34856 -- Fixed references to index_together in historical ↵Andrés Reverón Molina
migrations. While AlterUniqueTogether has been documented to be still allowed in historical migrations for the foreseeable future it has been crashing since 2abf417c815c20 was merged because the latter removed support for Meta.index_together which the migration framework uses to render models to perform schema changes. CreateModel(options["unique_together"]) was also affected. Refs #27236. Co-authored-by: Simon Charette <charette.s@gmail.com> Backport of b44efdfe543c9b9f12690b59777e6b275cb08103 from main.
2024-12-17[5.1.x] Refs #27236 -- Removed references to index_together from ↵Simon Charette
ModelState.from_model. It's not possible for ModelMeta.index_together to exist anymore. Backport of 44281bc2123dac1b127000c84c759f9678021826 from main.
2024-12-04[5.1.x] Post-release version bump.Sarah Boyce
2024-12-04[5.1.x] Bumped version for 5.1.4 release.5.1.4Sarah Boyce
2024-12-04[5.1.x] Fixed CVE-2024-53908 -- Prevented SQL injections in direct ↵Simon Charette
HasKeyLookup usage on Oracle. Thanks Seokchan Yoon for the report, and Mariusz Felisiak and Sarah Boyce for the reviews.
2024-12-04[5.1.x] Fixed CVE-2024-53907 -- Mitigated potential DoS in strip_tags().Sarah Boyce
Thanks to jiangniao for the report, and Shai Berger and Natalia Bidart for the reviews.
2024-12-02[5.1.x] Fixed #35950 -- Restored refreshing of relations when fields deferred.Adam Johnson
Thank you to Simon Charette and Sarah Boyce for the review. Regression in 73df8b54a2fab53bec4c7573cda5ad8c869c2fd8. Backport of 2f6b096b83c55317c7ceef2d8d5dc3bee33293dc from main.
2024-11-26[5.1.x] Fixed #35942 -- Fixed createsuperuser crash on Python 3.13+ when ↵Tommy Allen
username is unavailable. Thanks Mariusz Felisiak and Jacob Tyler Walls for reviews. Backport of c635decb00ac957daf81c08541cdc9cf46f6d86d from main.
2024-11-05[5.1.x] Post-release version bump.Mariusz Felisiak
2024-11-05[5.1.x] Bumped version for 5.1.3 release.5.1.3Mariusz Felisiak
2024-10-31[5.1.x] Fixed #35876 -- Displayed non-ASCII fieldset names when rendering ↵Sarah Boyce
ModelAdmin.fieldsets. Thank you to Namhong Kim for the report, and to Mariusz Felisiak and Marijke Luttekes for the review. Regression in 01ed59f753139afb514170ee7f7384c155ecbc2d. Backport of 2c029c718f45341cdd43ee094c24488743c633e6 from main.
2024-10-28[5.1.x] Refs #34900 -- Removed usage of deprecated glob.glob1().earthyoung
Backport of 555f2412cba4c5844408042e92f3bf9fa5c2392c from main.
2024-10-17[5.1.x] Fixed #35841 -- Restored support for DB-IP databases in GeoIP2.Nick Pope
Thanks Felix Farquharson for the report and Claude Paroz for the review. Regression in 40b5b1596f7505416bd30d5d7582b5a9004ea7d5. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 3fad712a91a8a8f6f6f904aff3d895e3b06b24c7 from main.
2024-10-17[5.1.x] Fixed #35845 -- Updated DomainNameValidator to require entire string ↵Justin Thurman
to be a valid domain name. Bug in 4971a9afe5642569f3dcfcd3972ebb39e88dd457. Thank you to kazet for the report and Claude Paroz for the review. Backport of 99dcc59237f384d7ade98acfd1cae8d90e6d60ab from main.
2024-10-08[5.1.x] Post-release version bump.Natalia
2024-10-08[5.1.x] Bumped version for 5.1.2 release.5.1.2Natalia
2024-10-08[5.1.x] Fixed #35809 -- Set background color for selected rows in the ↵nessita
admin's form select widget. Regression in b47bdb4cd9149ee2a39bf1cc9996a36a940bd7d9. Thank you Giannis Terzopoulos for the review, and Tom Carrick and Sarah Boyce for the review. Backport of 679d57816d716cbc7cff3b364ae265d70444ebd9 from main.
2024-10-07[5.1.x] Updated translations from Transifex.nessita
generated by cgit v1.3 (git 2.53.0) at 2026-11-13 15:33:02 +0000