| Age | Commit message (Collapse) | Author |
|---|
|
|
|
template literals.
The deprecation warning for double-dot variable lookups checked
str(filter_expression.var), which for constants is the resolved literal
value rather than a variable lookup. Templates containing string or translated
string literals with two consecutive dots, such as {{ "a..b" }} or
{{ 'a..b'|upper }}, therefore incorrectly raised a RemovedInDjango70Warning.
The check now only applies when the filter expression's variable is a
Variable lookup.
Regression in 5d911f2d2fecc703be91b2b9b28acc59d34b35f3.
|
|
The docstring and reference documentation still described the safe
parameter as defaulting to True after its deprecation.
Follow-up to 6e15ac8066312328de279e3e072667416c205bfc.
|
|
|
|
async_client in testing tools.
|
|
|
|
|
|
security archive.
|
|
rendering admin links.
The admin renders URLField values as clickable links on changelists and
read-only change forms. The link was built without validating the URL,
so a potentially dangerous stored value could be rendered as a link that
runs script in a staff member's authenticated session when clicked.
The admin renders URLField values as clickable links on changelists and
read-only change forms. The link was built without validating the URL,
so a stored value using a potentially dangerous value was rendered as a
link, which could lead to cross-site scripting in an authenticated admin
session.
Refs CVE-2019-12308, #36032.
Thanks to Egor Saltykov for the report, and Sarah Boyce for reviews.
|
|
Since deeply nested geometry collections can lead to fatal errors in
GEOS, a new `max_geom_collections` argument on geometry model and form
fields, passed down to `GEOSGeometry` itself, allows limiting either
depth (WKT) or total number (WKB) before reaching GEOS.
Thanks Andrew MacPherson and kimchunbok_ for the reports, and Natalia
Bidart, Simon Charette, and Sarah Boyce for reviews.
|
|
Language codes longer than 500 characters are now rejected before the
cached lookup, so they are no longer retained as cache keys consuming
memory from each process.
Thanks Jaeyoung Jang for the report, and Sarah Boyce for reviews.
|
|
Spatial lookups optimistically parse values as rasters before retrying
as geometries. If a malicious value reached the GDALRaster constructor,
depending on the raster driver, it might write to disk or fetch from the
network regardless of the constructor's `write=False` default argument.
Although this works as designed for model field assignment, this is
potentially unexpected for querying, for example, in the admin's
changelist view, which allows staff users to execute arbitrary lookups
on models registered with the admin.
Network rasters didn't even work in lookup contexts before, providing
further evidence that this use case was unintentional. (The failure
point was after the fetching, however.)
Now, strings and dicts representing rasters are rejected by spatial
lookups. To opt in to using them, wrap them in a `GDALRaster` first.
Although it would simplify the implementation to try geometries before
rasters (instead of stashing a raster exception and raising it later),
we maintain the current order, which has been stable for a decade.
Thanks Bence Nagy, localhost-detect, and kimchunbok_ for providing
information useful in evaluating this report. Thanks Simon Charette,
Natalia Bidart, and Sarah Boyce for reviews.
|
|
Thanks Jacob for the triage and James for the review.
|
|
This aims for consistency in the django.db.models namespace.
Thanks Natalia Bidart and Simon Charette for the idea.
|
|
|
|
|
|
|
|
Thank you to Jacob Walls and Nick Pope for the review.
|
|
Added a documentation page that contains a concise set of guidelines to
help new contributors be more effective at sprints or other events with
in-person Django contributors.
Included a pair of links on how to filter down tickets, which calls out
adding the additional columns and filtering to docs components, and a
internal reference link for django-docker-box.
Thanks Annabelle Wiegart, Natalia Bidart, Paolo Melchiorre, Jacob Walls,
and Tim Mccurrachd for reviews.
Co-authored-by: tim-mccurrach <34194722+tim-mccurrach@users.noreply.github.com>
Co-authored-by: nessita <124304+nessita@users.noreply.github.com>
|
|
|
|
Objects with a primary key supplied by a late-saved related instance
were partitioned before their related fields were prepared. This
caused an assertion failure on backends returning rows from bulk
inserts.
Regression in 7d9aab8da0a06787d649762a702e1a518d843a63.
|
|
The removed section primarily provided usage examples and recommendations
rather than documenting the widget API. The interaction between a choice
field and its widget is already documented in the Select.choices reference.
|
|
|
|
|
|
Thank you to James Bligh and Sarah Boyce for the review.
|
|
|
|
|
|
The admin view_on_site and history views now return an HTTP 403 response
when a staff user lacks view or change permission for the target model,
consistent with the changeform and autocomplete views.
Thanks Bence Nagy for the report.
|
|
* Moved versionadded annotation to top of `mailers` section.
* Added versionadded to `mailers.default` to help avoid confusion over
deprecated annotation in same entry.
* Added missing "a" in `get_connection()` deprecation note.
|
|
Thanks to these people for pointing these out:
* Hojeong Park
* Natalia Bidart
* Sulav Raj Bista
|
|
Error response handling frequently makes use of the database, and so
must use the request specific connection sensitive worker thread.
Previously response_for_exception was dispatched on the event loop's
default executor. This potentially leads to pool exhaustion, and
deadlock, when using database pooling option, or a large number of
permanently held open database connections when not using pooling.
Connections held open were not subject to cleanup. If closed server
side, the reported "connection is closed" would be seen until
application restart.
Moving error response rendering to the request specific connection
sensitive worker thread resolves both of these issues.
The `thread_sensitive=False` was set in
e17ee4468875077b90b70bb6a589ebad7493f757 to maintain the prior
behaviour when asgiref switched the thread_sensitive default to
`True`. There was no specific reason for the non-tread-sensitive
behaviour beyond that. (With hindsight it was always incorrect for
the reasons here.)
|
|
|
|
|
|
in its reference documentation.
|
|
middleware runs.
|
|
|
|
|
|
Before, exceptions during settings loading were swallowed by management
commands. Now, if the new command attribute settings_required is True
(default), the error will be printed to stderr, and the command will
exit non-zero. makemessages, runserver, shell, and startproject continue
to tolerate missing settings (via settings_required=False).
Regression in c6864a01b25591d3a709da8071413b69c9e35341, which added
support for some commands (e.g. startproject) to cope with missing settings.
Thanks Mariusz Felisiak, Sarah Boyce, Jacob Walls, Mike Edmunds,
and Brian Helba for reviews.
Co-authored-by: Rohith PR <praroh2@gmail.com>
|
|
|
|
|
|
|
|
|
|
Co-authored-by: Daniele Procida <evildmp@users.noreply.github.com>
Co-authored-by: James Bligh <blighj@users.noreply.github.com>
|
|
|
|
docs/ref/models/querysets.txt.
|
|
Before, only submodules worked (and only if already imported). Now,
all modules work regardless of prior import state.
Updated expected exception in auth tests where import_string() returns
a non-callable.
|
|
Previously, only create and delete operations were generated.
|
|
|
|
|
|
|
