| Age | Commit message (Collapse) | Author |
|---|
|
Refs #37159 -- Documented building release wheel reproducibly.
|
|
Refs #37159 -- Documented building release wheel reproducibly.
|
|
|
|
Thank you to Mike Edmunds for the review.
|
|
Thank you to James Bligh and Tim Schilling for the reviews.
|
|
database-level on_delete.
|
|
|
|
|
|
|
|
Updated widget templates to render the `hidden` attribute if the input_type
is set to "hidden".
|
|
|
|
This change implements DEP 16: to rename the django-admin command to django.
django-admin is kept as an alias.
Docs references to the "django-admin" command are updated to "django" or
“The django command”.
Renamed the `django-admin` Sphinx directive to `cmd`, and the
`django-admin-option` directive to `cli-option`.
Thanks Johannes Maron, Mike Edmunds, and Jacob Walls for reviews.
|
|
Thank you Mike Edmunds for the review.
|
|
Since 9158562, Django docs have replaced "new in Django development
version" with Sphinx's standard "added in version ___" change note.
Corrected advice to keep an eye out for the old phrase, and generalized
it to cover any version mismatches.
|
|
for Windows users in docs.
Co-authored-by: Shabir Ahmad Shaik <shabirahmadshaik@gmail.com>
|
|
|
|
|
|
CVE-2026-113733, and CVE-2026-114582 to security archive.
|
|
|
|
GDAL 3.9+.
Anything instantating `SpatialReference`, including vector and raster
`transform()` methods and `srs`/`srid` setters, was subject to request
forgery from untrusted strings, since GDAL resolves file and network
references by default.
On GDAL 3.9+, Django now uses `OSRSetFromUserInputEx()` to block file
and network access in this path. On lower GDAL versions, users should
compare inputs to an allow list or use integers when setting or
transforming a spatial reference system (SRS). A new `gis.W001` check
warns if a lower GDAL version is installed.
Thanks Adraca for the report and Sarah Boyce and David Smith for reviews.
|
|
users with custom user models.
Since Django 6.0, the admin obfuscated the password hash only when the
field's model was exactly AUTH_USER_MODEL. Other user models, and user
models inheriting the password field from a concrete parent model,
failed that check, so the full hash was displayed to users with only
the view permission.
Thanks to Aaron chen for the report, and Jake Howard for the review.
|
|
response cache.
When learning the cache key for a response, a missing header must be
cached differently to an empty one, as per RFC 9111.
Thanks to Andrew Gonzalez for the report.
Co-authored-by: Jake Howard <git@theorangeone.net>
|
|
Even though the "crs" member was removed from the GeoJSON spec in 2016,
GDAL's GeoJSON parser still supports this value and can resolve file and
network locations. An attacker could submit a malicious CRS that would
make a network request as the Django process user, or read a file, or
both. Django now rejects these values when constructing geometries and
in forms and lookups. (Utilities for processing trusted data such as
`DataSource` and `LayerMapping` continue to forward these values to GDAL
without validation.)
Any `crs` definition with `"type": "link"` or `"type": "url"` is now
rejected outright. Any definition with `"type": "name"` has its
`properties.name` compared to an allow list of known authorities, or a
regex for an OGC CRS URN, or well-known shorthands, e.g. "CRS84".
Thanks to Submersion Security Research Team for the report, and David
Smith and Sarah Boyce for the reviews.
|
|
BaseGeometryWidget.deserialize().
Suitably crafted values submitted to a GeometryField may have allowed
log injection, potentially corrupting log files, obscuring other
attacks, misleading log post-processing tools, or forging log entries.
To mitigate this, invalid values logged on deserialization errors are
now escaped using "unicode_escape" encoding, and trimmed to 4096
characters to avoid flooding logs with large inputs.
Thanks to Aaron chen for the report, and to Jacob Walls, Jake Howard,
and Shai Berger for the reviews.
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
|
|
MultiPartParser.
The mitigation for CVE-2026-33033 aligned base64 data to a multiple of
4 by reading whole chunks. As the chunk size is itself a multiple of 4,
those reads never restored the alignment, so a misaligned upload was
read and decoded in full before reaching upload handlers.
Trailing undecoded bytes are now carried over to the next chunk, so no
extra reads are needed and memory use stays bounded by the chunk size.
Thanks to Ignacy Kujawa for the report, and Jake Howard for the review.
|
|
values.
|
|
If a deferred field has been plucked via `refresh_from_db(fields=...)`
or modified by assigning an attribute, it shouldn't be overwritten when
attribute access on a peer triggers a `fetch_many()`.
The peer fetching should also tolerate deleted instances.
Co-authored-by: Vishy <vishyzero@gmail.com>
|
|
release notes.
|
|
Updated custom djangodocs Sphinx theme to switch to pydata-sphinx-theme
(PST) with minimal customizations:
* Replaced PST's split top/left main nav with single left sidebar main
nav. (Borrowed approach from sphinx-book-theme.)
* Moved `docstitle` from navbar_start (in "logo") to navbar_center, to
avoid wrapping in the header with long development version numbers.
Thanks to Natalia Bidart for review and improvements.
|
|
Starting with Django 2028, DEP 20 changes the Python version support
policy, gives every feature release three years of support, and moves
to calendar versions. Documented these in the Python version FAQ, the
upgrade guide, and the release how-to.
|
|
The target called the lint, black, and spelling subroutines in sequence
and then exited with the status of the last one, so a failure in an
earlier check was printed to the screen but still reported overall
success. It now records each failure and exits non-zero if any check
failed, matching the equivalent `Makefile` target.
Spelling is also run with `-q -W` under `check`, as the `Makefile` does.
|
|
Updated fix from commit 8274ae1 to build the path with `os.path.join()`.
Sphinx matches `epub_exclude_files` against OS native paths, so the
hardcoded forward slash never matched on Windows.
|
|
Updated docs `make black` and `make lint` checks to use Sphinx's own
source file discovery to get the list of docs source files. This makes
docs/conf.py the single source of truth for which files are/aren't docs
sources. The exclusions were previously duplicated by hand in Makefile,
make.bat, and lint.py, where they could drift from conf.py.
Created a Python blacken-sources.py wrapper around blacken-docs, similar
to the existing lint.py for sphinx-lint. This replaces shell and batch
file commands that tried (only partially successfully) to replicate
Sphinx's source discovery.
Removed `--jobs 0` from the sphinx-lint arguments to allow parallel
linting, since sphinx-lint treats `--jobs 0` as serial instead of
defaulting to `auto`.
Also added Sphinx to the tox environments running the docs checks, since
neither `blacken-docs` nor `sphinx-lint` depends on Sphinx.
Thanks to Natalia Bidart for review and improvements.
|
|
Regression in 0eec2a163a4b2ea4e82c53ae1d7b71bf43ac911d.
|
|
object key order.
Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
|
|
Thank you Mike Edmunds for the review.
|
|
disable multiline template tags.
Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
|
|
Co-authored-by: tim-mccurrach <34194722+tim-mccurrach@users.noreply.github.com>
|
|
Created an "epubcheck" target in the docs makefiles and docs workflow.
Because EPUBCheck requires a Java runtime, did not include it in the
general "make check" target.
|
|
Fixed a problem introduced in 0e128d5 where wide console content could
appear flush right in narrow windows, clipped off the left side
(depending on the theme). Constrained the tab content <section> to the
available width with horizontal scrolling by default. This also works
correctly with themes that wrap overflow text in Pygments code blocks
(e.g., djangoproject.com).
|
|
Fixed epubcheck validation failures related to console-tabs.css modern
CSS syntax by preventing it from being bundled into epub output. (Since
console tabs are not rendered for epub, the css isn't needed.)
|
|
The draw.io export used HTML labels inside `foreignObject` elements,
including a `<font>` element, which made the epub build fail EPUBCheck
validation. It also embedded about 20KB of draw.io source, and its
light-dark() colors could not be edited in SVG editors like Inkscape.
Labels are now SVG text elements, light colors are presentation
attributes, and dark mode is a prefers-color-scheme media query. In
dark mode, arrows keep the color of the role making each transition,
matching the legend.
Thanks Mike Edmunds for the report.
Regression in eaf7b563a5d3861026242fdb503a58f71acf17f6.
|
|
|
|
|
|
QUERY (RFC 10008) is a safe, idempotent method that carries the query in
the request content rather than in the URI's query component. Treat it as
safe throughout: exempt it from CSRF protection, evaluate request
preconditions as for GET, accept it in require_safe(), and dispatch it
from View. Query content is available as HttpRequest.body and is not
parsed into HttpRequest.POST.
Caching is left for a follow-up. Per RFC 10008 Section 2.7 the cache key
for a QUERY request must incorporate the request content, which the cache
middleware and cache_page() don't do, so they continue to ignore QUERY.
Thanks Ben Atkinson, Jonathan Biemond, and Jacob Walls for reviews.
|
|
Improved accessibility for docs console tabs within constraints of the
current CSS-only, hidden radio button implementation.
* Switched to flex layout. (Previous `text-align: right` could cause
problems in rtl scripts.)
* Changed radio buttons from `display: none` to visually hidden. This
allows them to participate in keyboard navigation (with or without
a screen reader).
* Rendered a focus outline on the visible label when the hidden radio
button has focus.
* Increased border widths on the active tab to allow distinguishing it
with high contrast settings (forced-colors: active).
* Increased contrast on inactive tab label and active tab border.
* Created `--tab-*` CSS properties in `.console-block` to allow adapting
to other themes or contexts (e.g., on docs.djangoproject.com).
Screen readers will announce console tabs as radio buttons. (JavaScript
would be needed to properly implement the WAI-ARIA tab pattern with the
expected behavior for tab-group, tab, and tab-panel ARIA roles.)
Thanks to Natalia Bidart (nessita), Tom Carrick, and Akintola Rahmat for
their reviews and suggestions.
|
|
|
|
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
|
|
functools.cached_property.
Since Python 3.12, `functools.cached_property` no longer takes a lock
(https://github.com/python/cpython/issues/87634), which was the main
objection to using it instead of Django's own implementation.
`Prefetch(to_attr=...)` and the admindocs model detail page now accept
`functools.cached_property` as well as Django's own `cached_property`.
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
|
|
MySQL 9.5 added support for the "crs" attribute in GeoJSON:
https://dev.mysql.com/doc/relnotes/mysql/9.7/en/news-9-5-0.html#:~:text=ST_AsGeoJSON%20function
|
