| Age | Commit message (Collapse) | Author |
|---|
|
QUERY (RFC 10008) is a safe, idempotent method that carries the query in
the request content rather than in the URI's query component. Treat it as
safe throughout: exempt it from CSRF protection, evaluate request
preconditions as for GET, accept it in require_safe(), and dispatch it
from View. Query content is available as HttpRequest.body and is not
parsed into HttpRequest.POST.
Caching is left for a follow-up. Per RFC 10008 Section 2.7 the cache key
for a QUERY request must incorporate the request content, which the cache
middleware and cache_page() don't do, so they continue to ignore QUERY.
Thanks Ben Atkinson, Jonathan Biemond, and Jacob Walls for reviews.
|
|
delete_confirmation_max_display=0 case.
|
|
0 was being treated equivalently to None, which didn't agree with the
behavior on ``ModelAdmin`` for the delete actions.
Thanks Natalia Bidart for the review.
Bug in 57c8c8b107248a3358dd26276ac497c577454011.
|
|
Updated references to RemovedInDjango70Warning to use the new warning,
and adjusted references to "Django 7.0" to "Django 2028".
RemovedInDjango70Warning remains importable as an alias of the same
class, so existing warning filters and except clauses in third-party
code keep working across the rename.
|
|
Many (~70) tests assert a specific row order for querysets whose SQL has no
ORDER BY. SQL standard does not define that order.
On PostgreSQL the rows usually arrive in physical storage order, which
on a freshly loaded table matches insertion order -- so these assertions
pass by coincidence rather than by contract. That breaks when rows are
updated or deleted and the space is reused, or when the planner picks a
different access path such as an index scan. A test like this can start
failing with no change to Django or to the test itself.
The patch made sure that most of these tests do not
rely on unspecified unordered selection order.
|
|
testing.
|
|
`ModelAdmin.response_add()` unpacked the `_source_model` `POST` parameter with
`source_model_name.split(".", 1)` before any error handling, so a value
without a dot separator, like `_source_model=foo`, raised `ValueError` and
returned an HTTP 500 after the object had already been saved.
This fix handles the `ValueError` together with the existing `LookupError` branch for invalid values.
Follow-up to b1ffa9a9d78b0c2c5ad6ed5a1d84e380d5cfd010.
|
|
|
|
Co-authored-by: blighj <blighj@users.noreply.github.com>
|
|
|
|
The admin view_on_site and history views now return an HTTP 403 response
when a staff user lacks view or change permission for the target model,
consistent with the changeform and autocomplete views.
Thanks Bence Nagy for the report.
|
|
Used warn_about_implementation() for ModelAdmin deprecation warnings on
get_list_select_related() return value and missing action_location
parameters in get_actions() and get_action_choices(). Fixes a problem
where the warnings would point to wsgiref rather than the ModelAdmin
subclass using deprecated functionality.
|
|
|
|
|
|
available/chosen box heights.
|
|
|
|
After incorporating a translation for "Run" in Arabic, the RTL case started failing.
|
|
We were seeing this occasional failure in FlatpagesSitemapTests.setUpClass(),
which was unexpectedly attempting a write on the "other" database because
of an instance hint from a cached Site:
django.test.testcases.DatabaseOperationForbidden:
Database queries to 'other' are not allowed in this test. Add 'other' to flatpages_tests.test_sitemaps.FlatpagesSitemapTests.databases to
ensure proper test isolation and silence this failure.
|
|
|
|
Refs #37105, #12090.
|
|
action.
|
|
Bug in f30acb184f75fd9260cfd6ddc48a3bbbd49f9c1d. Refs #12090.
|
|
Error pages, admin, and registration templates were updated to use
`{% csp_nonce %}` on their explicit `<script>`, `<link>`, and `<style>`
HTML elements.
Co-authored-by: Antoliny0919 <antoliny0919@gmail.com>
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
|
|
See DEP 0018.
Added:
* MAILERS setting.
* django.core.mail.mailers dict-like EmailBackend factory.
* `using` argument to mail sending APIs.
* `sent_using` attribute to mail.outbox messages in locmem backend.
* MAILERS in startproject settings template, set to console backend.
* AdminLogHandler.using argument.
* BrokenLinkEmailsMiddleware.send_mail() method.
Updated:
* BaseEmailBackend to track the MAILERS alias used to construct it, and
to report errors for unknown kwargs (OPTIONS).
* EmailBackend implementations to initialize from kwargs (OPTIONS) only
when MAILERS is being used.
* smtp.EmailBackend to require `host` option and to default `port`
option based on SSL/TLS options.
* SimpleTestCase setup to substitute the locmem backend for all defined
MAILERS configurations.
* Django's tests that send mail to define MAILERS.
Deprecated:
* EMAIL_BACKEND and other backend-related EMAIL_* settings.
* mail.get_connection().
* The `connection`, `fail_silently`, `auth_user`, and `auth_password`
arguments to mail functions.
* The EmailMessage.connection attribute.
* BaseEmailBackend support for `fail_silently`. Backends that support
fail_silently (SMTP, console, file) now implement it directly.
* AdminEmailHandler.email_backend argument.
Removed undocumented features without deprecation:
* EmailMessage.get_connection() method. (send() now raises an error if a
subclass has attempted to override it.)
* EmailMessage.send() no longer sets self.connection to the connection
used for sending. (It still _uses_ a pre-existing self.connection.)
* AdminEmailHandler.connection() method. (Init now raises an error if a
subclass has attempted to override it.)
Thanks to Natalia Bidart for shepherding DEP 0018 and for extensive
reviews and suggestions on the implementation.
Thanks to Jacob Rief for the initial implementation and multiple
iterations while refining the design.
Co-authored-by: Jacob Rief <jacob.rief@gmail.com>
|
|
Bug in 019acad112da3d00bb81b3022fd25ccd8457e5d9.
|
|
Thank you to Benjamin Balder Bach and Jacob Walls for reviews.
Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
|
|
Replaced obj.id permission checks with explicit boolean fields.
|
|
This change makes `list_select_related = False` avoid unnecessary joins by only
selecting the related fields that are actually used in `list_display`.
Consequently, it avoids one code path that calls `QuerySet.select_related()`
with no arguments, which is targeted for deprecation.
|
|
non-editable instances.
Added formset that excludes objects for which
user has no permission for POST formset as well.
Fixed regression test: the test was not simulating
real behaviour properly. By providing full form
data for the post request we skipped the part
where the user was actually limited in permissions
and only modified some of the rows.
Improved tests by getting rid of obj.id % 2
approach for granting permissions per object
for users, since it is not the safest.
Instead granting permissions simply by 'alive'
parameter, which is simpler and more stable.
Bug in 84db026228413dda4cd195464554d51c0b208e32.
|
|
selenium is not installed.
|
|
The new ModelAdmin.delete_confirmation_max_display attribute allows
limiting the number of related objects shown on the delete confirmation
page. When the limit is reached, a "…and N more objects." message is shown.
The feature relies on a new truncated_unordered_list template filter
added to django.contrib.admin.templatetags.admin_filters.
Thanks Jacob Tyler Walls for the review and guidance, Tobias McNulty for the report,
and terminator14 for the solution suggested.
|
|
truncated_unordered_list filter.
|
|
Added new constant django.db.models.fields.BLANK_CHOICE_LABEL for
an accessible and translatable blank choice label in forms.
Deprecated django.db.models.fields.BLANK_CHOICE_DASH constant.
Added the immediately deprecated transitional setting
USE_BLANK_CHOICE_DASH.
Co-Authored-By: Marijke Luttekes <mail@marijkeluttekes.dev>
|
|
Co-authored-by: Peter van der Does <peter@oneilinteractive.com>
Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
|
|
ModelAdmin.list_editable.
Instead of going over all objects in a queryset and filtering
by user permissions, added skipping while saving the formset
so there is no need to refetch objects again.
|
|
As originally written, this test interfered with
admin_views.tests.SeleniumTests.test_inline_uuid_pk_add_with_popup.
To fix this, register the new ModelAdmin with a different AdminSite.
|
|
ModelAdmin.list_editable.
Thanks Natalia Bidart, Jake Howard, and Markus Holtermann for reviews.
|
|
Regression in 4187da258fe212d494cb578a0bc2b52c4979ab95.
|
|
|
|
Thanks Sarah Boyce and Jacob Walls for reviews.
Co-authored-by: Hrushikesh Vaidya <hrushikeshrv@gmail.com>
|
|
|
|
Visual regression in 4187da258fe212d494cb578a0bc2b52c4979ab95.
|
|
containing only whitespace in admin.
|
|
admin.
Regression in b1ffa9a9d78b0c2c5ad6ed5a1d84e380d5cfd010.
|
|
|
|
It's how Django formats values internally and makes tests compatible
with databases that use non-integer primary keys.
|
|
|
|
Unlike Chromium-based browsers, Firefox does not automatically scroll
elements into view when using the Actions API with move_to_element.
This calls the scrollIntoView function explicitly, which fixes
some selenium tests when not running in headless mode.
|
|
the admin.
Thanks Antoliny for the review.
Regression in 4187da258fe212d494cb578a0bc2b52c4979ab95.
|
|
the admin.
The issue manifested when there were multiple relations and only some
of them participated in a filter_horizontal.
Regression in cd0479ff764272add5e0aba2afcf5649a241ca00.
|
