| Age | Commit message (Collapse) | Author |
|
Thanks eternicode for pointing this out.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14219 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
All adhoc MAC applications have been updated to use HMAC, using SHA1 to
generate unique keys for each application based on the SECRET_KEY, which is
common practice for this situation. In all cases, backwards compatibility
with existing hashes has been maintained, aiming to phase this out as per
the normal deprecation process. In this way, under most normal
circumstances the old hashes will have expired (e.g. by session expiration
etc.) before they become invalid.
In the case of the messages framework and the cookie backend, which was
already using HMAC, there is the possibility of a backwards incompatibility
if the SECRET_KEY is shorter than the default 50 bytes, but the low
likelihood and low impact meant compatibility code was not worth it.
All known instances where tokens/hashes were compared using simple string
equality, which could potentially open timing based attacks, have also been
fixed using a constant-time comparison function.
There are no known practical attacks against the existing implementations,
so these security improvements will not be backported.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14218 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
ModelMultipleChoiceField documentation. Thanks to danielrubio for the report and PhiR for the text.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14214 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14203 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
[14192].
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14202 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14200 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
for the feedback.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14192 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
instances so you can unit test views as standalone functions. Thanks to Simon Willison for the suggestion and snippet on which this patch was originally based.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14191 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14189 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14186 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
function executes the correct number of queries.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14183 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14176 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14162 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14161 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Laurent Luce.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14160 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
contributing docs. Thanks to Russ for the report and cmheisel for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14154 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
release notes. Thanks to Paul McMillan for the report.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14151 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14150 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14149 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14140 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
patch, and to Luke, Karen, Justin, Alex, Łukasz Rekucki, and Chuck Harmston for their help testing and reviewing the final patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14139 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
use tuples instead of lists since they were used inconsistently throughout the page (it wasn't hurting anything, but consistency is nice). Thanks to lspcity for the report and gruszczy for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14134 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14129 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
with BOM.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14125 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks to laurentluce for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14120 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14118 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
additional parameters when connecting to a database) and linked to Database Backend docs. Thanks to chris@cwroofs for the report.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14114 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
docs in general) more readily available from form topic overview. Thanks to john_fries for the report.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14112 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
setting does. Thanks to ttencate for the report and draft text.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14110 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
extension from django-admin.py. Thanks to islands for the report and d0ugal for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14108 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14107 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
of templates attribute, which is always a list. Thanks Russell for patch review.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14106 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14096 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
is not available. Thanks to rubic for the report and niall for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14076 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
dwillis and timo for the majority of the wording.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14074 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
statements and model vs. instance differentiation. Thanks to yipengh87@gmail.com and kmtracey for the report, and timo for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14070 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
documentation, comments and code. Thanks to timo and Simon Meers for the work on the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14069 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14068 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
to adamend for the report and initial patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14066 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14064 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks to KathyManwaring for the report and stumbles for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14062 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Wassmann for the report, nickefford for the initial patch and Graham Dumpleton for the expert advice.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14059 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Batchelder for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14058 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14056 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14051 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
relation.
Thanks to dcramer for the report, and Russ for pointing out the workaround.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14049 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14047 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
the report and patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14041 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14039 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14037 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|