| Age | Commit message (Collapse) | Author |
|
Thanks eternicode for pointing this out.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14219 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
All adhoc MAC applications have been updated to use HMAC, using SHA1 to
generate unique keys for each application based on the SECRET_KEY, which is
common practice for this situation. In all cases, backwards compatibility
with existing hashes has been maintained, aiming to phase this out as per
the normal deprecation process. In this way, under most normal
circumstances the old hashes will have expired (e.g. by session expiration
etc.) before they become invalid.
In the case of the messages framework and the cookie backend, which was
already using HMAC, there is the possibility of a backwards incompatibility
if the SECRET_KEY is shorter than the default 50 bytes, but the low
likelihood and low impact meant compatibility code was not worth it.
All known instances where tokens/hashes were compared using simple string
equality, which could potentially open timing based attacks, have also been
fixed using a constant-time comparison function.
There are no known practical attacks against the existing implementations,
so these security improvements will not be backported.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14218 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
ModelMultipleChoiceField documentation. Thanks to danielrubio for the report and PhiR for the text.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14214 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14189 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Laurent Luce.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14160 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14150 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
additional parameters when connecting to a database) and linked to Database Backend docs. Thanks to chris@cwroofs for the report.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14114 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
docs in general) more readily available from form topic overview. Thanks to john_fries for the report.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14112 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
setting does. Thanks to ttencate for the report and draft text.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14110 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14096 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
dwillis and timo for the majority of the wording.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14074 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
documentation, comments and code. Thanks to timo and Simon Meers for the work on the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14069 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14068 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
relation.
Thanks to dcramer for the report, and Russ for pointing out the workaround.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14049 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
views. Thanks to clelland for the report and patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14020 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Blue for the report.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14018 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
timo for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14017 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
the date filter. Thanks, dwillis and timo.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14013 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
for the report and patch to Stephan Jaekel.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14012 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
<renderbox@gmail.com> for the report.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14006 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
gremmie, Ramiro Morales and Gabriel Hurley for the reviews.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13982 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
draft patch, and to the many people who gave feedback during development of the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13981 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Site/RequestSite usage in various places.
Many thanks to gabrielhurley for putting most of this together. Also to
bmihelac, arthurk, qingfeng, hvendelbo, petr.pulc@s-cape.cz, Hraban for
reports and some initial patches.
The patch also contains some whitespace/PEP8 fixes.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13980 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
for report and patch, jarrow and Carl Meyer.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13968 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13966 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13964 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
idahogray.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13872 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks to KyleMac for the suggestion and SmileyChris for the patch
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13849 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Patch from SmileyChris. Fixed #7770.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13809 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks to timo and leovitch for the patch. Fixed #10328.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13772 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
from the original request. Default is current behaviour, which is not to
pass the query string (it often won't be appropriate to do so).
Thanks to steingrd@ifi.uio.no for the patch and tests. Fixed #9966.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13746 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Patch from Marc Fargas. Fixed #7435.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13738 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
mlavin.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13734 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks to mountainpaul@gmail.com for report and to dwillis patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13694 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks to idle for report and patch
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13692 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks to zendak for report and patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13687 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
to Rob Hudson for the report and patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13673 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
the default manager
Thanks to PaulM for suggestion and patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13669 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks to 7times9 for report and patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13666 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
for a given user. Thanks to Dmitri Fedortchenko for the suggestion, and to Mnewman, faldridge and Simon Meers for their work on the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13654 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks to Trindaz for the suggestion.
Also fixed some references to 'lede' which is no longer part of the
example Blog model.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13652 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Robert Coup for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13648 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13647 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks to jon@licq.org for the suggestion.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13640 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13638 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
for the report.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13633 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13628 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks, Ramiro Morales.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13608 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
tom_simpson.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13574 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
and truncatewords_html filters. Thanks to Ben Spaulding for the report and patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13555 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|