| Age | Commit message (Collapse) | Author |
|---|
|
async_client in testing tools.
|
|
This aims for consistency in the django.db.models namespace.
Thanks Natalia Bidart and Simon Charette for the idea.
|
|
* Moved versionadded annotation to top of `mailers` section.
* Added versionadded to `mailers.default` to help avoid confusion over
deprecated annotation in same entry.
* Added missing "a" in `get_connection()` deprecation note.
|
|
Thanks to these people for pointing these out:
* Hojeong Park
* Natalia Bidart
* Sulav Raj Bista
|
|
middleware runs.
|
|
|
|
|
|
Co-authored-by: Daniele Procida <evildmp@users.noreply.github.com>
Co-authored-by: James Bligh <blighj@users.noreply.github.com>
|
|
|
|
see for details.
|
|
Reworked the outdated "Preventing header injection" section:
* Added a "Safely sending email" section noting that the topic is
relevant but beyond the scope of Django's own docs.
* Added a section on correctly formatting email addresses with a
variable display name to avoid injection attacks.
* Updated the existing "Preventing header injection" section to note
that Django (via Python) already prevents CRLF injection, but that
custom email backends that bypass Django's protections may need to
handle it.
Also added references to the new "Formatting email addresses" section
from the `ADMINS`, `DEFAULT_FROM_EMAIL`, and `SERVER_EMAIL` settings.
|
|
Updated the `ContactForm` examples in the "Forms" topic and reference
docs to avoid broken and unsafe practices around sending email:
* Stopped using user-provided `sender` address as `from_email`. Instead,
renamed to `contact_email` and used it as the `reply_to` address.
* Removed `cc_myself` option to prevent using the form to send spam.
Substituted an `urgent` field to demonstrate `BooleanField` use.
* Identified email as coming from the contact form and added other
content to reduce impersonation/phishing risks.
Also updated some example output in the forms reference docs where it
had drifted from the example code over time: email fields default to
`maxlength=320`; the `ContactForm` example has been using a `TextArea`
widget for its message field.
|
|
Replaced "plain-text" with "plaintext" where it is used to describe the
unencrypted input to a password hashing function. (In a cryptography
context this is the preferred spelling, and it is already used that way
in Django's release notes.) This reduces ambiguity about whether
make_password() expects UTF-8 encoded Unicode text ("plain-text bytes")
or the unencrypted material for the user's password ("plaintext bytes").
(See #37184.)
All other current uses of "plain text" and "plain-text" in docs and
docstrings (including the one elsewhere in passwords.txt) are describing
text that is plain (unformatted; not rich text).
|
|
|
|
|
|
Removed outdated warnings, and updated performance considerations to
reflect current realities.
Thanks to Mykhailo Havelia for the detailed review.
|
|
Bcc addresses are sent via the SMTP envelope and must never appear in
the message itself. A "Bcc" key in `extra_headers` was not excluded like
From/To/Cc/Reply-To, so it leaked into the generated message as a
visible header.
Thanks Mike Edmunds for reviews.
|
|
|
|
|
|
Revises the AnimalTestCase to better show test data isolation
and avoid the opportunity to use setUpTestData.
|
|
|
|
(a)force_login().
Co-authored-by: Mykhailo Havelia <Arfey17.mg@gmail.com>
|
|
|
|
responses.
Thanks Shai Berger for the report, and Natalia Bidart and Sarah Boyce for reviews.
|
|
Obsolete since 330638b89f14e1fb06e9d313ccc9768ae167c53f.
|
|
|
|
|
|
|
|
This makes the name consistent with the `savepoint_commit` and
`savepoint_rollback` functions. The previous name is maintained as a
deprecated alias.
This also frees up the `savepoint` name, which would allow the context
manager from `django-subatomic` to be included in Django.
Co-authored-by: Lily <code@lilyf.org>
|
|
* Fixed typos related to automated EMAIL_PROVIDERS -> MAILERS renaming.
* Clarified wording in some recently added/updated sections.
* Removed deprecated, extraneous `fail_silently=False` from examples.
* Moved EmailBackend API documentation out of "Email backends" intro
into a dedicated section in email.txt.
* Sorted MAILERS alphabetically in settings.txt.
|
|
See DEP 0018.
Added:
* MAILERS setting.
* django.core.mail.mailers dict-like EmailBackend factory.
* `using` argument to mail sending APIs.
* `sent_using` attribute to mail.outbox messages in locmem backend.
* MAILERS in startproject settings template, set to console backend.
* AdminLogHandler.using argument.
* BrokenLinkEmailsMiddleware.send_mail() method.
Updated:
* BaseEmailBackend to track the MAILERS alias used to construct it, and
to report errors for unknown kwargs (OPTIONS).
* EmailBackend implementations to initialize from kwargs (OPTIONS) only
when MAILERS is being used.
* smtp.EmailBackend to require `host` option and to default `port`
option based on SSL/TLS options.
* SimpleTestCase setup to substitute the locmem backend for all defined
MAILERS configurations.
* Django's tests that send mail to define MAILERS.
Deprecated:
* EMAIL_BACKEND and other backend-related EMAIL_* settings.
* mail.get_connection().
* The `connection`, `fail_silently`, `auth_user`, and `auth_password`
arguments to mail functions.
* The EmailMessage.connection attribute.
* BaseEmailBackend support for `fail_silently`. Backends that support
fail_silently (SMTP, console, file) now implement it directly.
* AdminEmailHandler.email_backend argument.
Removed undocumented features without deprecation:
* EmailMessage.get_connection() method. (send() now raises an error if a
subclass has attempted to override it.)
* EmailMessage.send() no longer sets self.connection to the connection
used for sending. (It still _uses_ a pre-existing self.connection.)
* AdminEmailHandler.connection() method. (Init now raises an error if a
subclass has attempted to override it.)
Thanks to Natalia Bidart for shepherding DEP 0018 and for extensive
reviews and suggestions on the implementation.
Thanks to Jacob Rief for the initial implementation and multiple
iterations while refining the design.
Co-authored-by: Jacob Rief <jacob.rief@gmail.com>
|
|
|
|
Thank you James Walls and James Bligh for reviews.
Co-authored-by: Johannes Maron <johannes@maron.family>
|
|
New default tag `{% csp_nonce_attr %}` was added for explicit CSP nonce
inclusion into `<script>` and `<link>` elements.
`{% csp_nonce_attr %}` renders `nonce="<value>"` when `csp_nonce` is
present in the template context, and renders nothing otherwise.
`{% csp_nonce_attr media %}` renders a `Media` object's assets with the
nonce attr applied to each tag.
Thanks Jacob Walls for the accurate and spot on review comments.
Co-authored-by: Johannes Maron <johannes@maron.family>
|
|
HttpResponseRedirect.
|
|
Where the docs used `:pep:` links for established Python language
features, replaced them with direct references to the Python docs
(usually glossary terms).
|
|
ForeignObject should not be treated as an internal tool. In the past
we made changes in its API with a proper deprecation, e.g.
8b1ff0da4b162e87edebd94e61f2cd153e9e159d.
|
|
* Indented get_connection() details into its function block.
* Updated introductory paragraph to better reflect current capabilities.
* Changed link in "Quick examples" to go to descriptive text rather than
reference for send_mail().
* Avoided implying that send_mail() is only reliable "in most cases."
* Improved description of development SMTP server.
* Expanded information on third-party backends.
* Moved "Email backends" introductory paragraph above API methods and
expanded it to match section content.
|
|
|
|
Moved "Sending multiple emails" from the "Email backends" section to the
"Sending messages" section and renamed it to "Sending many messages
efficiently" to better reflect its content.
Moved the related connection manager example from the "Email backends"
intro into the same section.
|
|
Moved "Obtaining an instance of an email backend" after documentation
for individual backends (matching similar approach in Tasks docs).
|
|
Moved documentation section for each email backend to be a direct child
of "Email backends" (rather than subsections of "Obtaining an instance
of an email backend"). Added a section header for "Third-party backends"
to surface it in the outline and separate it from "Dummy backend."
|
|
Moved the "Preventing header injection" discussion below sections on
EmailMessage and related classes.
|
|
Introduced a top-level "Sending messages" section to group together
send_mail(), send_mass_mail(), mail_admins(), mail_managers(), the
EmailMessage and EmailMultiAlternatives classes, and other topics
related to sending.
|
|
The top-level "Examples" section of docs/topics/email.txt seemed intended
to illustrate the difference between send_mail() and send_mass_mail(),
not to provide general examples of sending email. Moved it into the
existing "send_mass_mail() vs. send_mail()" section.
(There's already a "Quick examples" section at the top of the page with
general examples.)
|
|
|
|
|
|
For use in checking user permissions via has_perm().
Co-authored-by: 사재혁 <jaehyuck.sa.dev@gmail.com>
|
|
request bodies.
Notably that the limit can be bypassed under ASGI.
|
|
Thanks James Bligh for the review.
Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
|
