| Age | Commit message (Collapse) | Author |
|---|
|
The docstring and reference documentation still described the safe
parameter as defaulting to True after its deprecation.
Follow-up to 6e15ac8066312328de279e3e072667416c205bfc.
|
|
|
|
Since deeply nested geometry collections can lead to fatal errors in
GEOS, a new `max_geom_collections` argument on geometry model and form
fields, passed down to `GEOSGeometry` itself, allows limiting either
depth (WKT) or total number (WKB) before reaching GEOS.
Thanks Andrew MacPherson and kimchunbok_ for the reports, and Natalia
Bidart, Simon Charette, and Sarah Boyce for reviews.
|
|
Language codes longer than 500 characters are now rejected before the
cached lookup, so they are no longer retained as cache keys consuming
memory from each process.
Thanks Jaeyoung Jang for the report, and Sarah Boyce for reviews.
|
|
Spatial lookups optimistically parse values as rasters before retrying
as geometries. If a malicious value reached the GDALRaster constructor,
depending on the raster driver, it might write to disk or fetch from the
network regardless of the constructor's `write=False` default argument.
Although this works as designed for model field assignment, this is
potentially unexpected for querying, for example, in the admin's
changelist view, which allows staff users to execute arbitrary lookups
on models registered with the admin.
Network rasters didn't even work in lookup contexts before, providing
further evidence that this use case was unintentional. (The failure
point was after the fetching, however.)
Now, strings and dicts representing rasters are rejected by spatial
lookups. To opt in to using them, wrap them in a `GDALRaster` first.
Although it would simplify the implementation to try geometries before
rasters (instead of stashing a raster exception and raising it later),
we maintain the current order, which has been stable for a decade.
Thanks Bence Nagy, localhost-detect, and kimchunbok_ for providing
information useful in evaluating this report. Thanks Simon Charette,
Natalia Bidart, and Sarah Boyce for reviews.
|
|
Thanks Jacob for the triage and James for the review.
|
|
This aims for consistency in the django.db.models namespace.
Thanks Natalia Bidart and Simon Charette for the idea.
|
|
|
|
|
|
|
|
The removed section primarily provided usage examples and recommendations
rather than documenting the widget API. The interaction between a choice
field and its widget is already documented in the Select.choices reference.
|
|
Thank you to James Bligh and Sarah Boyce for the review.
|
|
Thanks to these people for pointing these out:
* Hojeong Park
* Natalia Bidart
* Sulav Raj Bista
|
|
|
|
in its reference documentation.
|
|
|
|
|
|
docs/ref/models/querysets.txt.
|
|
Before, only submodules worked (and only if already imported). Now,
all modules work regardless of prior import state.
Updated expected exception in auth tests where import_string() returns
a non-callable.
|
|
|
|
|
|
Changed `?flat?` to `"flat"` in synopsis. (Guessing this was an encoding
problem related to fancy quotes in some earlier version.)
Removed `simple` from synopsis, matching other page content.
|
|
|
|
see for details.
|
|
Reworked the outdated "Preventing header injection" section:
* Added a "Safely sending email" section noting that the topic is
relevant but beyond the scope of Django's own docs.
* Added a section on correctly formatting email addresses with a
variable display name to avoid injection attacks.
* Updated the existing "Preventing header injection" section to note
that Django (via Python) already prevents CRLF injection, but that
custom email backends that bypass Django's protections may need to
handle it.
Also added references to the new "Formatting email addresses" section
from the `ADMINS`, `DEFAULT_FROM_EMAIL`, and `SERVER_EMAIL` settings.
|
|
Updated the `ContactForm` examples in the "Forms" topic and reference
docs to avoid broken and unsafe practices around sending email:
* Stopped using user-provided `sender` address as `from_email`. Instead,
renamed to `contact_email` and used it as the `reply_to` address.
* Removed `cc_myself` option to prevent using the form to send spam.
Substituted an `urgent` field to demonstrate `BooleanField` use.
* Identified email as coming from the contact form and added other
content to reduce impersonation/phishing risks.
Also updated some example output in the forms reference docs where it
had drifted from the example code over time: email fields default to
`maxlength=320`; the `ContactForm` example has been using a `TextArea`
widget for its message field.
|
|
|
|
|
|
Added mail.E001 deployment-only system check to detect one of Django's
not-for-production-use email backends in the "default" MAILERS entry.
|
|
MAILERS setting.
Thanks Mike Edmunds for reviews.
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
|
|
|
|
This reverts docs changes from commit f970a98e464320c09dde8d45009eadfb4d038a57.
|
|
|
|
|
|
|
|
delete_confirmation_max_display.
|
|
Follow-up to 6e15ac8066312328de279e3e072667416c205bfc.
|
|
transitional setting to False.
|
|
Extract()/Trunc().
|
|
Made signed cookies derive their signer namespace from an injective
encoding of `(name, salt)` while preserving compatibility with legacy
`name + salt` cookies behind SIGNED_COOKIE_LEGACY_SALT_FALLBACK.
Thanks Peng Zhou for the report, and Shai Berger, Markus Holterman,
Jake Howard, and Paul McMillan for reviews.
Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
|
|
Thanks JaeHyuck Sa, Jacob Walls, and Tim McCurrach for reviews.
Co-authored-by: Ülgen Sarıkavak <ulgensrkvk@gmail.com>
|
|
|
|
Thanks Mike Edmunds for flagging these issues and for the review.
|
|
Peer frameworks have long since dropped their analogous checks for this
vulnerability that was fixed in ES5.
|
|
This follows the contributing guidelines that state:
[...] Avoid referring to a specific version of Django outside a
``deprecated`` block. Even inside a block, it's often redundant to do so
as these annotations render as "Deprecated since version A.B".
|
|
Also expended a bit on details for the setting so readers know what is
it about.
|
|
|
|
|
|
Thanks David Smith for reviews.
|
|
* Fixed typos related to automated EMAIL_PROVIDERS -> MAILERS renaming.
* Clarified wording in some recently added/updated sections.
* Removed deprecated, extraneous `fail_silently=False` from examples.
* Moved EmailBackend API documentation out of "Email backends" intro
into a dedicated section in email.txt.
* Sorted MAILERS alphabetically in settings.txt.
|
