summaryrefslogtreecommitdiff
path: root/django
AgeCommit message (Collapse)Author
2009-10-30Allow CsrfResponseMiddleware to be used if templates cannot be updated.Luke Plant
For the case where someone is using contrib views with custom templates that they cannot update to use the template tag, it should be possible to use CsrfResponseMiddleware. This requires that 'csrf_response_exempt' is not used for the admin views. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11683 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-29Fixed #12057 -- Corrected regression of caching performance when a model ↵Russell Keith-Magee
contained a callable default. Thanks to Michael Thornhill for the excellent assistance tracking this problem. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11681 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-29Improved HTML in CSRF debug template - <code> instead of <tt>Luke Plant
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11680 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27Small improvement to CSRF failure template.Luke Plant
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11676 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27Misc clarifications in csrf middleware commentsLuke Plant
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11673 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27Fixed #12095 - login and other contrib views failing if template rendered ↵Luke Plant
using inclusion tag. The {% csrf_token %} tag is unable to get its value if a template is rendered using an inclusion_tag, since that creates a brand new Context, rather than using the existing one. Since this is a common pattern, and we need CSRF protection to be as simple and easy as possible, we special case the csrf_token and copy it from the parent context to the new context. A more elegant and general solution may appear in future, but this is good enough for now. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11672 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27Fixed #11057: having no actions in the admin (`actions=None`) no longer ↵Jacob Kaplan-Moss
messes up the layout. Thanks, rvdrijst. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11670 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27Slight change to CSRF error messages to make debugging easier.Luke Plant
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11669 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27Removed unused import.Luke Plant
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11664 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27Moved contrib.csrf.* to core code.Luke Plant
There is stub code for backwards compatiblity with Django 1.1 imports. The documentation has been updated, but has been left in docs/contrib/csrf.txt for now, in order to avoid dead links to documentation on the website. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11661 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-26Fixed #9977 - CsrfMiddleware gets template tag added, session dependency ↵Luke Plant
removed, and turned on by default. This is a large change to CSRF protection for Django. It includes: * removing the dependency on the session framework. * deprecating CsrfResponseMiddleware, and replacing with a core template tag. * turning on CSRF protection by default by adding CsrfViewMiddleware to the default value of MIDDLEWARE_CLASSES. * protecting all contrib apps (whatever is in settings.py) using a decorator. For existing users of the CSRF functionality, it should be a seamless update, but please note that it includes DEPRECATION of features in Django 1.1, and there are upgrade steps which are detailed in the docs. Many thanks to 'Glenn' and 'bthomas', who did a lot of the thinking and work on the patch, and to lots of other people including Simon Willison and Russell Keith-Magee who refined the ideas. Details of the rationale for these changes is found here: http://code.djangoproject.com/wiki/CsrfProtection As of this commit, the CSRF code is mainly in 'contrib'. The code will be moved to core in a separate commit, to make the changeset as readable as possible. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11660 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-26Fixed #11371: Made `django.test.Client.put()` work for non-form-data PUT ↵Jacob Kaplan-Moss
(i.e. JSON, etc.). Thanks, phyfus. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11656 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-25Polish translation updatedJarek Zgoda
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11655 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-25Fixed #12079: Changed has_results to get a single result, thus preventing ↵Karen Tracey
exists() from always returning True on backends that support chunked reads. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11654 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-24Fixed #9163 - CsrfMiddleware needs to reset ETag headerLuke Plant
Thanks to carljm for report and patch. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11650 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-24Fixed #12067 - check_dependencies in contrib.admin.sites not triggered using ↵Luke Plant
new style admin include Thanks to robhudson for report and patch. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11648 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-24Fixed a bug in r11646 - refs #11402 Luke Plant
The one line of code not covered by a test... ;-) git-svn-id: http://code.djangoproject.com/svn/django/trunk@11647 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-24Fixed #11402: added a `QuerySet.exists()` method. Thanks, Alex Gaynor.Jacob Kaplan-Moss
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11646 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-23Moved _get_foreign_key call after testing for fk_name fixing a broken test.Brian Rosner
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11643 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-23Fixed #11625: added comment moderation via admin actions.Jacob Kaplan-Moss
This is BACKWARDS INCOMPATIBLE if you were using the completely undocumented moderation view from 1.1. That view's been removed in favor of the admin actions. Thanks, Thejaswi Puthraya. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11639 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-20Fixed #12060 - equality tests between User and SimpleLazyObject-wrapped User ↵Luke Plant
failed. Also added more tests for SimpleLazyObject Thanks to ericholscher for report. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11637 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-19Fixed non-standard introspection support in LazyObject.Luke Plant
LazyObject called a public method ``get_all_members`` on wrapped objects in order to allow introspection. This could easily cause name clashes with existing methods on wrapped objects, and so has been changed to use the standard methods. This could be slightly backwards-incompatible, in obscure cases, if the undocumented LazyObject has been used externally. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11636 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-19Fixed #12049 - LazyObject-wrapped User breaks queries in template tagsLuke Plant
Thanks to chipx86 for the report and patch. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11634 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-19Moved the call to _get_foreign_key to run in all cases catching incorrect ↵Brian Rosner
inline setup sooner. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11631 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-19Fixed #11709 — Pass inline fk_name attribute when grabbing foreign key to ↵Brian Rosner
test for exclusion. Thanks yishaibeeri for the report. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11630 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-17The `OGRGeometry.coord_dim` property may now be set; implemented a ↵Justin Bronn
work-around for an OGR bug that changed geometries to 3D after transformation. Refs #11433. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11628 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-15Licence block for code added in r11586Luke Plant
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11627 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-15Fixed a regression on Python 2.6 caused by r11623Luke Plant
This might fix #12037, but I cannot reproduce that bug. Refs #12037 git-svn-id: http://code.djangoproject.com/svn/django/trunk@11625 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-14Fixed #6552, #12031 - Make django.core.context_processors.auth lazy to avoid ↵Luke Plant
"Vary: Cookie" Thanks to olau@iola.dk, Suor for the report git-svn-id: http://code.djangoproject.com/svn/django/trunk@11623 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-12Fixed #11993: fixed the the `floatformat` filter on `NaN` values in Python ↵Jacob Kaplan-Moss
2.6.3. Thanks, kklimonda. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11619 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-12Fixed #8274 - allow custom forms for auth 'login' and 'password_change' viewsLuke Plant
Thanks to julien for the suggestion and patch, and SmileyChris for work on the patch. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11618 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-09SECURITY ALERT: Corrected regular expressions for URL and email fields.Jacob Kaplan-Moss
Certain email addresses/URLs could trigger a catastrophic backtracking situation, causing 100% CPU and server overload. If deliberately triggered, this could be the basis of a denial-of-service attack. This security vulnerability was disclosed in public, so we're skipping our normal security release process to get the fix out as soon as possible. This is a security related update. A full announcement, as well as backports for the 1.1.X and 1.0.X series will follow. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11603 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-08Fixed #11995 -- Modified the admin site definition for comments so that ↵Russell Keith-Magee
users are shown as a raw id list. Thanks to James Bennett for the report and patch. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11601 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-01Removed some unused code and improved docstring on auto_adapt_to_methodsLuke Plant
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11600 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-09-28Added 'key_prefix' keyword argument to cache_page()Luke Plant
This was available before r11586, but undocumented. It has now been re-added with documentation and explicit support, as it seems like a useful feature and people were using it before. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11595 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-09-26Corrected regressions introduced in r11586 and r11593Luke Plant
I read the order of arguments in the docs incorrectly, doh! git-svn-id: http://code.djangoproject.com/svn/django/trunk@11594 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-09-23Improved error messages when people use cache_page in undocumented and now ↵Luke Plant
unsupported ways. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11593 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-09-22Fixed typo in docstring for decorator_from_middleware_with_args.Luke Plant
Thanks for the report, kmike git-svn-id: http://code.djangoproject.com/svn/django/trunk@11590 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-09-21Rewrote user_passes_test to use auto_adapt_to_methods, removing the need for ↵Luke Plant
_CheckLogin git-svn-id: http://code.djangoproject.com/svn/django/trunk@11587 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-09-21Fixed #6371 - several decorators don't work with bound methods.Luke Plant
This involved changing the way the internal function decorator_from_middleware works slightly, breaking some code that relied on the old behaviour. As a result, it is much simpler, but cache_page has been made slightly more complex to cope with the change. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11586 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-09-16Fixed #11886 -- Corrected handling of F() expressions that use parentheses. ↵Russell Keith-Magee
Thanks to Brent Hagany for the report. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11581 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-09-13Fixed #11827: Can now calculate extent in Oracle on tables with one point.Justin Bronn
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11577 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-09-13Fixed #11746 -- Marked a string for translation in the FR localflavor. ↵Russell Keith-Magee
Thanks to iapain for the report and patch. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11552 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-09-13Fixed #11862 -- Corrected an error in the Hebrew translation. Thanks to Adam ↵Russell Keith-Magee
Rimon for the fix. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11550 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-09-12Fixed #11660 -- Corrected the CONTENT_TYPE and CONTENT_LENGTH headers ↵Russell Keith-Magee
provided by the mod_python handler. Thanks to Nowell Strite and Tareque Hossain for the report and fix. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11528 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-09-12Fixed #11624: `render_to_kmz` no longer balks on non-ASCII data.Justin Bronn
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11527 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-09-11Fixed #10752. Added more advanced bash completion. Thanks, Arthur Koziel.Joseph Kocherhans
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11526 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-09-11Fixed #10968 - Form.errors should use Form.error_class.Luke Plant
Thanks for report and initial patch, matehat. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11498 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-09-11Fixed #11502 - wrong escaping in admin.Luke Plant
Thanks Tomasz Elendt. git-svn-id: http://code.djangoproject.com/svn/django/trunk@11497 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-09-11Fixed Widget.__init__() for Python 2.6 and greater. Refs #11703Luke Plant
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11496 bcc190cf-cafb-0310-a4f2-bffc1f526a37
generated by cgit v1.3 (git 2.53.0) at 2026-09-03 11:44:42 +0000