| Age | Commit message (Collapse) | Author |
|---|
|
Thank you to Mike Edmunds for the review.
|
|
|
|
Updated widget templates to render the `hidden` attribute if the input_type
is set to "hidden".
|
|
|
|
This change implements DEP 16: to rename the django-admin command to django.
django-admin is kept as an alias.
Docs references to the "django-admin" command are updated to "django" or
“The django command”.
Renamed the `django-admin` Sphinx directive to `cmd`, and the
`django-admin-option` directive to `cli-option`.
Thanks Johannes Maron, Mike Edmunds, and Jacob Walls for reviews.
|
|
GDAL 3.9+.
Anything instantating `SpatialReference`, including vector and raster
`transform()` methods and `srs`/`srid` setters, was subject to request
forgery from untrusted strings, since GDAL resolves file and network
references by default.
On GDAL 3.9+, Django now uses `OSRSetFromUserInputEx()` to block file
and network access in this path. On lower GDAL versions, users should
compare inputs to an allow list or use integers when setting or
transforming a spatial reference system (SRS). A new `gis.W001` check
warns if a lower GDAL version is installed.
Thanks Adraca for the report and Sarah Boyce and David Smith for reviews.
|
|
Even though the "crs" member was removed from the GeoJSON spec in 2016,
GDAL's GeoJSON parser still supports this value and can resolve file and
network locations. An attacker could submit a malicious CRS that would
make a network request as the Django process user, or read a file, or
both. Django now rejects these values when constructing geometries and
in forms and lookups. (Utilities for processing trusted data such as
`DataSource` and `LayerMapping` continue to forward these values to GDAL
without validation.)
Any `crs` definition with `"type": "link"` or `"type": "url"` is now
rejected outright. Any definition with `"type": "name"` has its
`properties.name` compared to an allow list of known authorities, or a
regex for an OGC CRS URN, or well-known shorthands, e.g. "CRS84".
Thanks to Submersion Security Research Team for the report, and David
Smith and Sarah Boyce for the reviews.
|
|
values.
|
|
object key order.
Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
|
|
Co-authored-by: tim-mccurrach <34194722+tim-mccurrach@users.noreply.github.com>
|
|
QUERY (RFC 10008) is a safe, idempotent method that carries the query in
the request content rather than in the URI's query component. Treat it as
safe throughout: exempt it from CSRF protection, evaluate request
preconditions as for GET, accept it in require_safe(), and dispatch it
from View. Query content is available as HttpRequest.body and is not
parsed into HttpRequest.POST.
Caching is left for a follow-up. Per RFC 10008 Section 2.7 the cache key
for a QUERY request must incorporate the request content, which the cache
middleware and cache_page() don't do, so they continue to ignore QUERY.
Thanks Ben Atkinson, Jonathan Biemond, and Jacob Walls for reviews.
|
|
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
|
|
functools.cached_property.
Since Python 3.12, `functools.cached_property` no longer takes a lock
(https://github.com/python/cpython/issues/87634), which was the main
objection to using it instead of Django's own implementation.
`Prefetch(to_attr=...)` and the admindocs model detail page now accept
`functools.cached_property` as well as Django's own `cached_property`.
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
|
|
MySQL 9.5 added support for the "crs" attribute in GeoJSON:
https://dev.mysql.com/doc/relnotes/mysql/9.7/en/news-9-5-0.html#:~:text=ST_AsGeoJSON%20function
|
|
Before, if a directive's only source was a nonce, and that nonce was not rendered,
the directive was omitted, when in reality we should consider the set of scripts
matching the nonce to be empty, and instead fail closed.
Thanks Rob Hudson for the implementation idea and review.
|
|
Python 3.15 added the `parent_mode` argument to `os.makedirs()`, the
upstream fix for the issue that led Django to vendor its own
`makedirs()` in the fix for CVE-2026-25674. The vendored copy differed
from CPython only by an extra `chmod()` call that ignored the process
umask. Dropping that call allows using `os.makedirs()` directly on
Python 3.15+, and removing the vendored copy once Python 3.14 support
ends.
As a trade-off, directories created by `FileSystemStorage` when
`FILE_UPLOAD_DIRECTORY_PERMISSIONS` (or `directory_permissions_mode`) is
set, and by `FileBasedCache`, now have the requested permissions mode
combined with the process umask, and the set-group-ID bit and other
bits beyond the last 9 are no longer guaranteed to be set.
`FILE_UPLOAD_PERMISSIONS` is unaffected.
Thanks Shai Berger for the proposal and review, Ken Whitesell and
Carlton Gibson for the discussion, and Tim Schilling, Jacob Walls, and
Lily for reviews.
Refs #36664.
|
|
Thank you Michael Codispoti (codispoti) for the report. Thank you to
Jake Howard, Jacob Walls and Rob Hudson for the reviews.
|
|
ba7206cd8 (for Django 1.7) made the return type of
ContentType.model_class optional, in the case of stale content types
(essentially for deleted models). Previously this would raise
`LookupError`.
It's a niche case but, the behaviour here was undocumented, requiring
a trip to the source code to determine. This change adds a small note
to the bottom of the docs section, and tweaks the method docstring to
clarify that the return type is optional.
|
|
The docs home page used "Overview" as the link text 15 times, the only
duplicated link text on that page. A reader navigating by a list of
links got identical entries with no indication of which section each
belonged to. A sixteenth "Overview" comes from the main site's navbar
and is outside this repository.
Every one of those targets already has a distinct title of its own,
which `docs/index.txt` was overriding with the generic word. Most of
them now use it, via `:doc:` without an explicit title. Three would have
repeated their group label, and are given a short unique title instead.
Also retitled five of those documents so that the home page can use their
own titles: two to sentence case, matching the rest, and three to drop a
redundant "in Django" suffix.
|
|
request.body vs request.POST.
|
|
Claude Paroz:
This specific way of adding links is not i18n-friendly. You can imagine
the translator does not want to keep that English word in the translation.
If I remember correctly, the sphinx i18n tool tries to guess by matching
the first occurrence with the first link, etc. which explains why the
second occurrence has no match, and hence wrong.
|
|
Thank you to Lily, Tim McCurrach and 사재혁 for reviews.
|
|
The WKB geometry collection limiter could be bypassed by invalid
byte-order markers, which GEOS tolerates, and recursively invalid
multi-geometry nesting such as a MULTIPOINT containing another
MULTIPOINT. Big-endian ISO HEXWKB also bypassed the limiter because
geometry types were unconditionally byte-swapped.
Replaced byte-pattern scanning with a lightweight structural WKB scan.
This also avoids rejecting valid inputs whose coordinate data resembles
a GeometryCollection header. The WKB limit now measures nesting depth
rather than total collection count, consistently with WKT.
Thanks "blacknianthejdan", Kimi Security Team, and David Sarkisyan for
the reports, and David Smith and Natalia Bidart for reviews.
|
|
Even though raster values provided via bytes write to the in-memory
virtual filesystem, that does not prevent network fetches when resolving
references.
Thank you to sicksec for the report, and Jacob Walls, Jake Howard, and
David Smith for reviews.
|
|
|
|
Address is the safe way to build an email address with a display name
from variable parts (see #34753), but `ADMINS` and `MANAGERS` rejected
non-string values, so it could not be used there. This branch allows
`Address` instances in those settings, documents, and tests the support
already present in `DEFAULT_FROM_EMAIL`, `SERVER_EMAIL`, `send_mail()`,
`send_mass_mail()`, and `EmailMessage`.
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
|
|
docs pages.
|
|
Replaced bare `async for` over a not-locally-defined async iterable with
`async with (maybe_)aclosing(aiter(...)) as it: async for item in it:` at
every consumption site, so the iterator's aclose() runs deterministically
when the consumer exits — instead of being deferred to asyncio's asyncgen
finalizer hook.
Added django.utils.asyncio.maybe_aclosing as a small wrapper that uses
contextlib.aclosing when the iterator has aclose() and contextlib.nullcontext
otherwise (for caller-supplied iterators that may only implement __aiter__
and __anext__).
Sites:
- contrib/auth/backends.py:_aget_permissions (aclosing)
- core/paginator.py:AsyncPage.__aiter__ (maybe_aclosing)
- core/paginator.py:AsyncPage.aget_object_list (maybe_aclosing)
- db/models/query.py:QuerySet.aiterator (aclosing, hoisted across both
prefetch and no-prefetch branches)
- http/response.py:StreamingHttpResponse.streaming_content awrapper
(maybe_aclosing)
- http/response.py:StreamingHttpResponse.__iter__ to_list (maybe_aclosing)
- http/response.py:StreamingHttpResponse.__aiter__ (aclosing)
- shortcuts.py:aget_list_or_404 (aclosing)
- test/client.py:aclosing_iterator_wrapper (maybe_aclosing)
- utils/text.py:acompress_sequence (maybe_aclosing)
|
|
|
|
Just like ba7a420012799b26ec9e969d0276d2ccee93c1f5.
Regressed in d6cca8b904de144946453aea93dd627c09abfca9.
|
|
|
|
|
|
Thanks Lilian Tran and Raffaella Suardini for reviews.
|
|
in GeneratedField.".
This reverts commit 6025eab3c509b4de922117e16866bbfe0ee99aa6, includes a
release note for 6.1.2, and keeps fields.W225 documented as removed.
Thanks to Michal Porteš for the report, and to Jacob Walls and
Simon Charette for reviews.
|
|
Documented its interaction with CONN_MAX_AGE and CONN_HEALTH_CHECKS.
|
|
`EmailValidator` now includes the invalid `username` or `domain` in the
`params` of the `ValidationError` it raises, so error messages can
reference the part that failed.
Address parsing and validation are now split into overridable methods
(`parse_address()`, `validate()`, `validate_username()`, and
`validate_domain()`), each receiving the full address being validated.
Subclasses can customize parsing, an individual part, or a rule spanning
both parts, without re-parsing the address.
The undocumented `validate_domain_part()` method is deprecated in favor
of `validate_domain()`, which raises `ValidationError` for invalid
domains instead of returning a boolean.
Refs #27029.
Thanks Mike Edmunds for the many ideas and quality reviews.
|
|
This is important when considering dichromatic color viewing deficiency.
Co-authored-by: James Beard <james@smallsaucepan.com>
|
|
GDALRaster.__del__() issues an unlink call to GDAL to remove temporary
files from the in-memory virtual filesystem. When #32670 allowed using
any virtual filesystem, including commercial storage ones like vsis3 for
Amazon S3, this meant network rasters could be unintentionally deleted.
Thanks "garden_" for the report and Sarah Boyce for the review.
|
|
|
|
|
|
|
|
|
|
no tzinfo.
In Django 2029, the current timezone will be stored in the migration.
|
|
Updated references to RemovedInDjango70Warning to use the new warning,
and adjusted references to "Django 7.0" to "Django 2028".
RemovedInDjango70Warning remains importable as an alias of the same
class, so existing warning filters and except clauses in third-party
code keep working across the rename.
|
|
|
|
|
|
|
|
|
|
Composite and db_default primary keys are not None when unset, so the
old pk is None check treated distinct unsaved instances as equal.
|
|
|
