| Age | Commit message (Collapse) | Author |
|---|
|
template literals.
The deprecation warning for double-dot variable lookups checked
str(filter_expression.var), which for constants is the resolved literal
value rather than a variable lookup. Templates containing string or translated
string literals with two consecutive dots, such as {{ "a..b" }} or
{{ 'a..b'|upper }}, therefore incorrectly raised a RemovedInDjango70Warning.
The check now only applies when the filter expression's variable is a
Variable lookup.
Regression in 5d911f2d2fecc703be91b2b9b28acc59d34b35f3.
|
|
The docstring and reference documentation still described the safe
parameter as defaulting to True after its deprecation.
Follow-up to 6e15ac8066312328de279e3e072667416c205bfc.
|
|
|
|
Forwardport of c58d86162cd59602df96f0e716cae9849acb3ddb from stable/6.1.x.
|
|
|
|
|
|
feature flag.
Oracle 23.9 supported UUID() in SELECT contexts, but use in column defaults
fails until 23.26.2.0 with:
django.db.utils.DatabaseError: ORA-04044: procedure, function, package, or type is not allowed here
|
|
rendering admin links.
The admin renders URLField values as clickable links on changelists and
read-only change forms. The link was built without validating the URL,
so a potentially dangerous stored value could be rendered as a link that
runs script in a staff member's authenticated session when clicked.
The admin renders URLField values as clickable links on changelists and
read-only change forms. The link was built without validating the URL,
so a stored value using a potentially dangerous value was rendered as a
link, which could lead to cross-site scripting in an authenticated admin
session.
Refs CVE-2019-12308, #36032.
Thanks to Egor Saltykov for the report, and Sarah Boyce for reviews.
|
|
Since deeply nested geometry collections can lead to fatal errors in
GEOS, a new `max_geom_collections` argument on geometry model and form
fields, passed down to `GEOSGeometry` itself, allows limiting either
depth (WKT) or total number (WKB) before reaching GEOS.
Thanks Andrew MacPherson and kimchunbok_ for the reports, and Natalia
Bidart, Simon Charette, and Sarah Boyce for reviews.
|
|
Language codes longer than 500 characters are now rejected before the
cached lookup, so they are no longer retained as cache keys consuming
memory from each process.
Thanks Jaeyoung Jang for the report, and Sarah Boyce for reviews.
|
|
Spatial lookups optimistically parse values as rasters before retrying
as geometries. If a malicious value reached the GDALRaster constructor,
depending on the raster driver, it might write to disk or fetch from the
network regardless of the constructor's `write=False` default argument.
Although this works as designed for model field assignment, this is
potentially unexpected for querying, for example, in the admin's
changelist view, which allows staff users to execute arbitrary lookups
on models registered with the admin.
Network rasters didn't even work in lookup contexts before, providing
further evidence that this use case was unintentional. (The failure
point was after the fetching, however.)
Now, strings and dicts representing rasters are rejected by spatial
lookups. To opt in to using them, wrap them in a `GDALRaster` first.
Although it would simplify the implementation to try geometries before
rasters (instead of stashing a raster exception and raising it later),
we maintain the current order, which has been stable for a decade.
Thanks Bence Nagy, localhost-detect, and kimchunbok_ for providing
information useful in evaluating this report. Thanks Simon Charette,
Natalia Bidart, and Sarah Boyce for reviews.
|
|
This aims for consistency in the django.db.models namespace.
Thanks Natalia Bidart and Simon Charette for the idea.
|
|
Follow-up to 75d627888bf42f8de6064a0bd665c98c0df66c55.
|
|
|
|
|
|
workers.
This prevents newly spawned workers from attempting to access nonexistent
clones.
Thanks James Bligh for the review.
|
|
Regression in a2348c85fc6c20087935c74cd99340dd4ef2dcdc.
|
|
Thank you to Jacob Walls and Nick Pope for the review.
|
|
|
|
Objects with a primary key supplied by a late-saved related instance
were partitioned before their related fields were prepared. This
caused an assertion failure on backends returning rows from bulk
inserts.
Regression in 7d9aab8da0a06787d649762a702e1a518d843a63.
|
|
Co-authored-by: blighj <blighj@users.noreply.github.com>
|
|
|
|
ModelAdmin.list_display.
Thanks Rob Kuipers for the report.
Regression in 4b2b4bf0ac2707dc9c4d51cabfa72168eaea95fe.
Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
|
|
This was overzealously removed in a146fe293099d7f860ba13e4b3a571bbda55af22.
|
|
ending with newlines.
|
|
The admin view_on_site and history views now return an HTTP 403 response
when a staff user lacks view or change permission for the target model,
consistent with the changeform and autocomplete views.
Thanks Bence Nagy for the report.
|
|
|
|
Thanks to these people for pointing these out:
* Hojeong Park
* Natalia Bidart
* Sulav Raj Bista
|
|
Forwardport of ced2d118d93e33679850c061ea96bf68c70892a7 from stable/6.1.x.
|
|
Error response handling frequently makes use of the database, and so
must use the request specific connection sensitive worker thread.
Previously response_for_exception was dispatched on the event loop's
default executor. This potentially leads to pool exhaustion, and
deadlock, when using database pooling option, or a large number of
permanently held open database connections when not using pooling.
Connections held open were not subject to cleanup. If closed server
side, the reported "connection is closed" would be seen until
application restart.
Moving error response rendering to the request specific connection
sensitive worker thread resolves both of these issues.
The `thread_sensitive=False` was set in
e17ee4468875077b90b70bb6a589ebad7493f757 to maintain the prior
behaviour when asgiref switched the thread_sensitive default to
`True`. There was no specific reason for the non-tread-sensitive
behaviour beyond that. (With hindsight it was always incorrect for
the reasons here.)
|
|
|
|
|
|
django/views/templates/default_urlconf.html.
|
|
PostGISSchemaEditor._create_spatial_index_sql().
Thanks Luciano de la Iglesia for the report, and Simon Charette and David Smith
for the reviews.
|
|
|
|
Before, exceptions during settings loading were swallowed by management
commands. Now, if the new command attribute settings_required is True
(default), the error will be printed to stderr, and the command will
exit non-zero. makemessages, runserver, shell, and startproject continue
to tolerate missing settings (via settings_required=False).
Regression in c6864a01b25591d3a709da8071413b69c9e35341, which added
support for some commands (e.g. startproject) to cope with missing settings.
Thanks Mariusz Felisiak, Sarah Boyce, Jacob Walls, Mike Edmunds,
and Brian Helba for reviews.
Co-authored-by: Rohith PR <praroh2@gmail.com>
|
|
|
|
Used warn_about_implementation() for ModelAdmin deprecation warnings on
get_list_select_related() return value and missing action_location
parameters in get_actions() and get_action_choices(). Fixes a problem
where the warnings would point to wsgiref rather than the ModelAdmin
subclass using deprecated functionality.
|
|
Created warn_about_implementation() for issuing warnings about
particular code that isn't currently on the call stack.
|
|
|
|
Previously non_atomic_requests() mutated the _non_atomic_requests
attribute of the original view function instead of returning a new wrapper.
|
|
Before, only submodules worked (and only if already imported). Now,
all modules work regardless of prior import state.
Updated expected exception in auth tests where import_string() returns
a non-callable.
|
|
Previously, only create and delete operations were generated.
|
|
|
|
encode_multipart().
When data is a MultiValueDict, encode_multipart() now uses data.lists()
instead of data.items() to preserve all values per key. Previously, only
the last value for each key was encoded, silently dropping form field
values when a file upload shared the same name.
|
|
|
|
DomainNameValidator.
Thanks Bence Nagy for the report, and Jake Howard for reviews.
|
|
GDALRaster from bytes.
Previously, `sys.getsizeof()` included the size of the `PyBytesObject`
wrapper which is bigger. `len(bytes_object)` is the accurate size.
Thanks Bence Nagy for the report, and Simon Charette for reviews.
|
|
vary on Cookie.
`UpdateCacheMiddleware` skipped caching `Set-Cookie` responses that vary
on `Cookie` only when the request had no cookies at all. A request
carrying an unrelated cookie bypassed the guard, allowing a newly-issued
session cookie to be stored in Django's shared cache.
The guard now applies whenever a response both sets a cookie and varies
on Cookie, regardless of what cookies the incoming request carried.
Thanks Chris Whyland for the report, Jake Howard for initial triage, and
Jacob Walls for reviews.
|
|
status.
|
