| Age | Commit message (Collapse) | Author |
|
|
|
Thanks tris@ for the report.
|
|
|
|
|
|
Fixed #18000 -- Moved the code to handle goto requests to an extra WizardView method.
|
|
|
|
without the need to add them in the as_view call.
|
|
|
|
Thanks almalki for the report.
|
|
|
|
|
|
Added -n to sphinx builds to catch issues going forward.
|
|
Thanks Danilo Bargen for the patch.
|
|
NamedUrlCookieWizard; thanks Tom for the report.
|
|
|
|
Lorin Hochstein for the patch.
|
|
|
|
|
|
|
|
Thanks Florian Apolloner for the patch.
|
|
uses the trans tag.
|
|
Thanks, Bradley Ayers.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17235 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks, Bradley Ayers and Stephan Jaekel.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17234 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
in `NamedUrlWizardView`. Thanks, Bradley Ayers and Stephan Jaekel.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17233 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
play nicer with mixin inheritance. Thanks, Bradley Ayers and Stephan Jaekel.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17231 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
documentation and templates. Thanks, Bradley Ayers.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17072 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
semente for the report.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16998 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
[16955]
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16983 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16906 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
docs. Thanks FunkyBob for the report and jkistler for the patch.
Also, additional fixes in that document and in the WizardView docstrings.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16904 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
*` usage.
This applies to both our own [test] code and documentation examples. Also:
* Moved the functions and handlers from `django.conf.urls.defaults` up to
`django.conf.urls` deprecating the former module.
* Added documentation for `handler403`.
* Tweaked the URLs topic document a bit.
Thanks to pupeno and cdestigter for their great work contributing patches.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16818 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
when running outside of the Django test suite. Also moved around the new wizard's templates a bit to better fit the common app layout.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16616 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16615 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
example template. Thanks, BernhardEssl.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16508 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
easily provide kwargs to each step form.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16398 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16309 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
views. Many thanks to Stephan Jäkel, ddurham and ElliottM for their work.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16307 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
the suggestion; jrothenbuhler for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16229 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
exception is translation strings, which I didn't want to disrupt
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15967 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
documentation. Thanks to codysomerville for the report.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15633 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
centering around bad crossref targets. Thanks to Aryeh Leib Taurog for the draft patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15549 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15055 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
teach people "bad habits" in regards to creating reusable apps.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14270 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
All adhoc MAC applications have been updated to use HMAC, using SHA1 to
generate unique keys for each application based on the SECRET_KEY, which is
common practice for this situation. In all cases, backwards compatibility
with existing hashes has been maintained, aiming to phase this out as per
the normal deprecation process. In this way, under most normal
circumstances the old hashes will have expired (e.g. by session expiration
etc.) before they become invalid.
In the case of the messages framework and the cookie backend, which was
already using HMAC, there is the possibility of a backwards incompatibility
if the SECRET_KEY is shorter than the default 50 bytes, but the low
likelihood and low impact meant compatibility code was not worth it.
All known instances where tokens/hashes were compared using simple string
equality, which could potentially open timing based attacks, have also been
fixed using a constant-time comparison function.
There are no known practical attacks against the existing implementations,
so these security improvements will not be backported.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14218 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks, Ramiro Morales.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13608 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
ClaesBas for the suggestion, and ElliotM and timo for draft text.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13543 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks, bthomas and thalin.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@12486 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
* Simplified Sphinx references to FormWizard class.
* Wrapped long lines.
* Added references to template loader functions.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11986 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
removed, and turned on by default.
This is a large change to CSRF protection for Django. It includes:
* removing the dependency on the session framework.
* deprecating CsrfResponseMiddleware, and replacing with a core template tag.
* turning on CSRF protection by default by adding CsrfViewMiddleware to
the default value of MIDDLEWARE_CLASSES.
* protecting all contrib apps (whatever is in settings.py)
using a decorator.
For existing users of the CSRF functionality, it should be a seamless update,
but please note that it includes DEPRECATION of features in Django 1.1,
and there are upgrade steps which are detailed in the docs.
Many thanks to 'Glenn' and 'bthomas', who did a lot of the thinking and work
on the patch, and to lots of other people including Simon Willison and
Russell Keith-Magee who refined the ideas.
Details of the rationale for these changes is found here:
http://code.djangoproject.com/wiki/CsrfProtection
As of this commit, the CSRF code is mainly in 'contrib'. The code will be
moved to core in a separate commit, to make the changeset as readable as
possible.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11660 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
timo.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11444 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|