summaryrefslogtreecommitdiff
path: root/django
AgeCommit message (Collapse)Author
2025-12-02[5.2.x] Bumped version for 5.2.9 release.5.2.9Natalia
2025-12-02[5.2.x] Fixed CVE-2025-64460 -- Corrected quadratic inner text accumulation ↵Shai Berger
in XML serializer. Previously, `getInnerText()` recursively used `list.extend()` on strings, which added each character from child nodes as a separate list element. On deeply nested XML content, this caused the overall deserialization work to grow quadratically with input size, potentially allowing disproportionate CPU consumption for crafted XML. The fix separates collection of inner texts from joining them, so that each subtree is joined only once, reducing the complexity to linear in the size of the input. These changes also include a mitigation for a xml.dom.minidom performance issue. Thanks Seokchan Yoon (https://ch4n3.kr/) for report. Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 50efb718b31333051bc2dcb06911b8fa1358c98c from main.
2025-12-02[5.2.x] Fixed CVE-2025-13372 -- Protected FilteredRelation against SQL ↵Jacob Walls
injection in column aliases on PostgreSQL. Follow-up to CVE-2025-57833. Thanks Stackered for the report, and Simon Charette and Mariusz Felisiak for the reviews. Backport of 5b90ca1e7591fa36fccf2d6dad67cf1477e6293e from main.
2025-12-01[5.2.x] Fixed #36712 -- Evaluated type annotations lazily in template tag ↵Jacob Walls
registration. Ideally, this will be reverted when an upstream solution is available for https://github.com/python/cpython/issues/141560. Thanks Patrick Rauscher for the report and Augusto Pontes for the first iteration and test. Backport of 34186e731ca20a2344b1f88fd543a854d6b13a00 from main.
2025-12-01[5.2.x] Refs #36743 -- Corrected docstring for DisallowedRedirect.Jacob Walls
Backport of ce36c35e76f82f76cdfa5777456e794d481e5afc from main.
2025-11-26[5.2.x] Fixed #36743 -- Increased URL max length enforced in ↵varunkasyap
HttpResponseRedirectBase. Refs CVE-2025-64458. The previous limit of 2048 characters reused the URLValidator constant and proved too restrictive for legitimate redirects to some third-party services. This change introduces a separate `MAX_URL_REDIRECT_LENGTH` constant (defaulting to 16384) and uses it in HttpResponseRedirectBase. Thanks Jacob Walls for report and review. Backport of a8cf8c292cfee98fe6cc873ca5221935f1d02271 from main.
2025-11-24[5.2.x] Fixed #36751 -- Fixed empty filtered aggregation crash over ↵Simon Charette
annotated queryset. Regression in b8e5a8a9a2a767f584cbe89a878a42363706f939. Refs #36404. The replace_expressions method was innapropriately dealing with falsey but not None source expressions causing them to also be potentially evaluated when __bool__ was invoked (e.g. QuerySet.__bool__ evaluates the queryset). The changes introduced in b8e5a8a9a2, which were to deal with a similar issue, surfaced the problem as aggregation over an annotated queryset requires an inlining (or pushdown) of aggregate references which is achieved through replace_expressions. In cases where an empty Q object was provided as an aggregate filter, such as when the admin facetting feature was used as reported, it would wrongly be turned into None, instead of an empty WhereNode, causing a crash at aggregate filter compilation. Note that the crash signature differed depending on whether or not the backend natively supports aggregate filtering (supports_aggregate_filter_clause) as the fallback, which makes use Case / When expressions, would result in a TypeError instead of a NoneType AttributeError. Thanks Rafael Urben for the report, Antoliny and Youngkwang Yang for the triage. Backport of 2a6e0bd72d4a69725b957d6748a4b834f21b12b5 from main
2025-11-20[5.2.x] Fixed #36748 -- Filtered non-standard placeholders from UNNEST queries.Chris Wesseling
Backport of 5834643f43a767fe19f2c6d10217b204e7584ec8 from main.
2025-11-18[5.2.x] Fixed #36733 -- Escaped attributes in Stylesheet.__str__().varunkasyap
Thanks Mustafa Barakat for the report, Baptiste Mispelon for the triage, and Jake Howard for the review. Backport of e05f2a75695b5f5faa7682d4053db4776d4d6f93 from main.
2025-11-05[5.2.x] Post-release version bump.Natalia
2025-11-05[5.2.x] Bumped version for 5.2.8 release.5.2.8Natalia
2025-11-05[5.2.x] Refs CVE-2025-64459 -- Avoided propagating invalid arguments to Q on ↵Jacob Walls
dictionary expansion. Backport of 3c3f46357718166069948625354b8315a8505262 from main.
2025-11-05[5.2.x] Fixed CVE-2025-64459 -- Prevented SQL injections in Q/QuerySet via ↵Jacob Walls
the _connector kwarg. Thanks cyberstan for the report, Sarah Boyce, Adam Johnson, Simon Charette, and Jake Howard for the reviews. Backport of c880530ddd4fabd5939bab0e148bebe36699432a from main.
2025-11-05[5.2.x] Fixed CVE-2025-64458 -- Mitigated potential DoS in ↵Jacob Walls
HttpResponseRedirect/HttpResponsePermanentRedirect on Windows. Thanks Seokchan Yoon for the report, Markus Holtermann for the triage, and Jake Howard for the review. Follow-up to CVE-2025-27556 and 39e2297210d9d2938c75fc911d45f0e863dc4821. Backport of c880530ddd4fabd5939bab0e148bebe36699432a from main.
2025-11-04[5.2.x] Fixed #36704 -- Fixed system check error for proxy model with a ↵Hal Blackburn
composite pk. Proxy models subclassing a model with a CompositePrimaryKey were incorrectly reporting check errors because the check that requires only local fields to be used in a composite pk was evaluated against the proxy subclass, which has no fields. To fix this, composite pk field checks are not evaluated against proxy subclasses, as none of the checks are applicable to proxy subclasses. This also has the benefit of not double-reporting real check errors from an invalid superclass pk. Thanks Clifford Gama for the review. Backport of 74564946c3b42a2ef7d087047e49873847a7e1d9 from main.
2025-10-31[5.2.x] Fixed #36696 -- Fixed NameError when inspecting functions with ↵Patrick Rauscher
deferred annotations. In Python 3.14, annotations are deferred by default, so we should not assume that the names in them have been imported unconditionally.
2025-10-23[5.2.x] Fixed #35095 -- Clarified Swiss number formatting in ↵Annabelle Wiegart
docs/topics/i18n/formatting.txt. Co-authored-by: Ahmed Nassar <a.moh.nassar00@gmail.com> Backport of 74239181252ca73bebb84789856f5d8937d421b4 from main.
2025-10-14[5.2.x] Fixed #36648, Refs #33772 -- Accounted for composite pks in ↵Jacob Walls
first()/last() when aggregating. Backport of 02eed4f37879b2077496f86bb1378a076b981233 from main.
2025-10-11[5.2.x] Fixed #36646 -- Added compatibility for oracledb 3.4.0.Simon Charette
The Database.Binary, Date, and Timestamp attributes were changed from aliases to bytes, datetime.date, and datetime.datetime to factory functions in oracle/python-oracledb@869a887819cdac7fcd610f9d9d463ade49ea7 which made their usage inadequate for isinstance checks. Thanks John Wagenleitner for the report and Natalia for the triage. Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com> Backport of 315dbe675df338ae66c8fa43274a76ecbed7ef67 from main
2025-10-03[5.2.x] Fixed #36636, Refs #15902 -- Removed session-based storage reference ↵Dani Fornons
from set_language() docs. Backport of 2514857e3fae831106832cca8823237801cf2cad from main.
2025-10-01[5.2.x] Post-release version bump.Jacob Walls
2025-10-01[5.2.x] Bumped version for 5.2.7 release.5.2.7Jacob Walls
2025-10-01[5.2.x] Fixed CVE-2025-59682 -- Fixed potential partial directory-traversal ↵Sarah Boyce
via archive.extract(). Thanks stackered for the report. Follow up to 05413afa8c18cdb978fcdf470e09f7a12b234a23. Backport of 924a0c092e65fa2d0953fd1855d2dc8786d94de2 from main.
2025-10-01[5.2.x] Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), ↵Mariusz Felisiak
aggregate(), and extra() against SQL injection in column aliases on MySQL/MariaDB. Thanks sw0rd1ight for the report. Follow up to 93cae5cb2f9a4ef1514cf1a41f714fef08005200. Backport of 41b43c74bda19753c757036673ea9db74acf494a from main.
2025-09-18[5.2.x] Updated translations from Transifex.Natalia
2025-09-17[5.2.x] Fixed #36601 -- Fixed color contrast of FilteredSelectMultiple ↵antoliny0919
widget chosen labels in TabularInlines. Regression in a0f50c2a483678d31bd1ad6f08fd3a0b8399e27b. Backport of 1e7728888dbbff437ad9847c82b84feb81f785df from main.
2025-09-03[5.2.x] Post-release version bump.Sarah Boyce
2025-09-03[5.2.x] Bumped version for 5.2.6 release.5.2.6Sarah Boyce
2025-09-03[5.2.x] Fixed CVE-2025-57833 -- Protected FilteredRelation against SQL ↵Jake Howard
injection in column aliases. Thanks Eyal Gabay (EyalSec) for the report. Backport of 51711717098d3f469f795dfa6bc3758b24f69ef7 from main.
2025-08-29[5.2.x] Fixed #36431 -- Returned tuples for multi-column ForeignObject in ↵SaJH
values()/values_list(). Thanks Jacob Walls and Simon Charette for tests. Signed-off-by: SaJH <wogur981208@gmail.com> Backport of bb7a7701b1a0e8fffe14dcebf5d5bac7f176c02a from main
2025-08-22[5.2.x] Refs #35530 -- Corrected deprecation message in auth.alogin().Mariusz Felisiak
Follow up to ceecd518b19044181a3598c55ebed7c2545963cc. Backport of b3166e1e15824aedb7a609dfda18ef36ea023d06 from main.
2025-08-06[5.2.x] Post-release version bump.Sarah Boyce
2025-08-06[5.2.x] Bumped version for 5.2.5 release.5.2.5Sarah Boyce
2025-08-05[5.2.x] Fixed #36530 -- Extended fields.E347 to check for ManyToManyField ↵jkhall81
involving CompositePrimaryKey on either side. Thanks to Jacob Walls for the report. Backport of 2013092b693be0ebdf36f41dc61615a2de1bbe31 from main.
2025-08-04[5.2.x] Fixed #36535 -- Ensured compatibility with docutils 0.19 through 0.22.Natalia
Regression in 65ab92f6a83644bbb555d0eff3a02d8d9301aba4. Backport of 9cec8d9f55d90fbc162fde23d6ea7a34e322fcae from main.
2025-08-04[5.2.x] Fixed #34871, #36518 -- Implemented unresolved lookups expression ↵Simon Charette
replacement. This allows the proper resolving of lookups when performing constraint validation involving Q and Case objects. Thanks Andrew Roberts for the report and Sarah for the tests and review. Backport of 079d31e698fa08dd92e2bc4f3fe9b4817a214419 from main.
2025-08-04[5.2.x] Fixed #36198 -- Implemented unresolved transform expression replacement.Simon Charette
This allows the proper resolving of F("field__transform") when performing constraint validation. Thanks Tom Hall for the report and Sarah for the test. Prerequisite for #36518. Backport of fc303551077c3e023fe4f9d01fc1b3026c816fa4 from main.
2025-07-29[5.2.x] Fixed writer_name deprecation warning in docutils 0.22+.Mariusz Felisiak
Backport of 65ab92f6a83644bbb555d0eff3a02d8d9301aba4 from main.
2025-07-28[5.2.x] Fixed #36522 -- Added support for filtering composite pks using a ↵Simon Charette
tuple of expressions. Thanks Jacob Walls for the report, and Sarah Boyce and Mariusz Felisiak for reviews. Backport of 0a4999b422702c64e21f5a10a4d60300b7074401 from main.
2025-07-16[5.2.x] Added SimpleTestCase.enterContext() on Python < 3.11.Natalia
This reverts commit 47a618d45c6e40dd59f4cdd46fd5fc7d11626f6d and uses a solution similar to ed4f83782d9f3404ad600f6131ef78244ff1e162 instead.
2025-07-10[5.2.x] Fixed #36502 -- Restored UNNEST strategy for foreign key bulk ↵Simon Charette
inserts on PostgreSQL. Regression in 764af7a3d6c0b543dcf659a2c327f214da768fe4. Backport of 0fe218842e0e396e3ab3982bd21227968a9e7fd8 from main.
2025-07-02[5.2.x] Post-release version bump.Natalia
2025-07-02[5.2.x] Bumped version for 5.2.4 release.5.2.4Natalia
2025-06-30[5.2.x] Fixed #36464 -- Fixed "__in" tuple lookup on backends lacking native ↵Simon Charette
support. When native support for tuple lookups is missing in a DB backend, it can be emulated with an EXISTS clause. This is controlled by the backend feature flag "supports_tuple_lookups". The mishandling of subquery right-hand side in `TupleIn` (added to support `CompositePrimaryKey` in Refs #373) was likely missed because the only core backend we test with the feature flag disabled (Oracle < 23.4) supports it natively. Thanks to Nandana Raol for the report, and to Sarah Boyce, Jacob Walls, and Natalia Bidart for reviews. Backport of 192bc7a7be92e20cc250907fb4083df689715679 from main.
2025-06-16[5.2.x] Fixed #36453 -- Made When.condition resolve with for_save=False.Clifford Gama
Value(None, JSONField()) when used in When.condition incorrectly resolved with for_save=True, resulting in the value being serialized as SQL NULL instead of JSON null. Regression in c1fa3fdd040718356e5a3b9a0fe699d73f47a940. Thanks to Thomas McKay for the report, and to David Sanders and Simon Charettes for the review. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> Backport of 104cbfd44b9eff010daf0ef0e1ce434385855b13 from main.
2025-06-16[5.2.x] Fixed #36447 -- Selected preferred media type based on quality.Jake Howard
When matching which entry in the `Accept` header should be used for a given media type, the specificity matters. However once those are resolved, only the quality matters when selecting preference. Regression in c075508b4de8edf9db553b409f8a8ed2f26ecead. Thank you to Anders Kaseorg for the report. Backport of 12c1557060fc94fe5e1fbddc4578a4e29d38f77c from main.
2025-06-10[5.2.x] Post-release version bump.Sarah Boyce
2025-06-10[5.2.x] Bumped version for 5.2.3 release.5.2.3Sarah Boyce
2025-06-09[5.2.x] Fixed #36446 -- Restored "q" in internal MediaType.params property.Natalia
The "q" key was removed while addressing ticket #36411. Despite `MediaType.params` is undocumented and considered internal, it was used in third-party projects (Zulip reported breakage), so this work restored the `q` key in `params`. Thanks Anders Kaseorg for the report. Regression in c075508b4de8edf9db553b409f8a8ed2f26ecead. Backport of cf5f36bf903a2854f5e395149cee707115b83744 from main.
2025-06-06[5.2.x] Fixed #36419 -- Ensured for_save was propagated when resolving ↵Clifford Gama
expressions. The for_save flag wasn't properly propagated when resolving expressions, which prevented get_db_prep_save() from being called in some cases. This affected fields like JSONField where None would be saved as JSON null instead of SQL NULL. Regression in 00c690efbc0b10f67924687f24a7b30397bf47d9. Thanks to David Sanders and Simon Charette for reviews. Co-authored-by: Adam Johnson <me@adamj.eu> Backport of c1fa3fdd040718356e5a3b9a0fe699d73f47a940 from main.
generated by cgit v1.3 (git 2.53.0) at 2026-07-12 18:46:13 +0000