| Age | Commit message (Collapse) | Author |
|
Thanks to Andi Albrecht for his work on this patch, and to everyone else that contributed during design and development.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11709 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
There is stub code for backwards compatiblity with Django 1.1 imports.
The documentation has been updated, but has been left in
docs/contrib/csrf.txt for now, in order to avoid dead links to
documentation on the website.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11661 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
removed, and turned on by default.
This is a large change to CSRF protection for Django. It includes:
* removing the dependency on the session framework.
* deprecating CsrfResponseMiddleware, and replacing with a core template tag.
* turning on CSRF protection by default by adding CsrfViewMiddleware to
the default value of MIDDLEWARE_CLASSES.
* protecting all contrib apps (whatever is in settings.py)
using a decorator.
For existing users of the CSRF functionality, it should be a seamless update,
but please note that it includes DEPRECATION of features in Django 1.1,
and there are upgrade steps which are detailed in the docs.
Many thanks to 'Glenn' and 'bthomas', who did a lot of the thinking and work
on the patch, and to lots of other people including Simon Willison and
Russell Keith-Magee who refined the ideas.
Details of the rationale for these changes is found here:
http://code.djangoproject.com/wiki/CsrfProtection
As of this commit, the CSRF code is mainly in 'contrib'. The code will be
moved to core in a separate commit, to make the changeset as readable as
possible.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11660 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11641 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
support for Python 2.3 -- and added a quick FAQ about that dropping of support.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11640 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks to julien for the suggestion and patch, and SmileyChris for work on the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11618 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11599 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
This was available before r11586, but undocumented. It has now been
re-added with documentation and explicit support, as it seems like a useful
feature and people were using it before.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11595 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
to limit_choices_to. Since the correct reference involves undocumented ORM internals, this simply removes the reference entirely in favor of publicly-documented use of Q objects.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11591 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks to ffualo for the suggestion.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11549 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
severian for the suggestion.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11548 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks to timo for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11547 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
for the report.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11546 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
liling for the report, and gsong for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11545 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
login_required auth decorator. Thanks to trigeek38 for the suggestion, and SmileyChris for the draft.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11544 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
better).
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11532 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
to tsaylor for the report.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11531 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks Ramiro.
Refs #11477 - that ticket should have been marked a duplicate of #11554
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11499 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks arien
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11487 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks SmileyChris
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11484 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11275 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
URLs documentation. Thanks to Ramiro Morales for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11258 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Carl Meyer for the report.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11253 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
admin site, where the absence of this facility was causing problems. Thanks to the many people who contributed to and helped review this patch.
This change is backwards incompatible for anyone that is using the named URLs
introduced in [9739]. Any usage of the old admin_XXX names need to be modified
to use the new namespaced format; in many cases this will be as simple as a
search & replace for "admin_" -> "admin:". See the docs for more details on
the new URL names, and the namespace resolution strategy.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11250 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
testing docs. Thanks to gruszczy and timo.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11248 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
than a placeholder. Thanks to jcassee for the suggestion.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11237 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks to Andrew Badr for the text.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11234 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
to Ramiro Morales for the draft text.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11221 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
methods. Thanks to jroes for the report and patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11173 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
relating to the {% blocktrans %} tag. Thanks to bartTC for the report, and Ramiro Morales for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11164 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Windows. Thanks Ramiro.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11103 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
to Ramiro Morales for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11097 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
backends that are available. Thank to Nathan Auch for the draft text.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11093 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11054 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
methods. Thanks to SmileyChris for the report and patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11051 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Michael Malone for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11048 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
the report.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11047 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
m2m values. Thanks to zgoda for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11045 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks to jjinux for the review notes.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11044 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Sphinx, caused by file ommitted from [11025] and included in [11026]. Thanks to Peter Landry for the report, and Ramiro for the explanation.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11032 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11028 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
documentation.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11026 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Jacob and Adrian for the original text (from the DjangoBook), and Ramiro for doing the work of porting the docs.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11025 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
using raw SQL.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11022 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
exclude specified. Thanks to Andrew Durdin for the suggestion.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10972 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10845 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10839 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
file upload documentation in form documentation. Thanks Kyle Fox and prairiedogg.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10837 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
slicing query sets.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10835 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
parameter for model formsets.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10819 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|