chango.git - django

Age	Commit message (Collapse)	Author
2026-04-07	[5.2.x] Fixed CVE-2026-33033 -- Mitigated potential DoS in MultiPartParser.	Natalia
	When a multipart file part used `Content-Transfer-Encoding: base64` and the non-whitespace base64 bytes did not align to a multiple of 4 within a chunk, the parser entered a loop calling `field_stream.read(1-3)` once per whitespace byte. Each such call fetched the entire internal buffer, sliced off 1-3 bytes, and pushed the remainder back via unget(), doing an O(n) memory copy per call. A 2.5 MB payload of mostly whitespace produced CPU amplification relative to a normal upload of the same size. The alignment loop now reads `self._chunk_size` bytes at a time, and accumulates stripped parts in a list joined once at the end. Thanks to Seokchan Yoon for the report and the fixing patch. Backport of 7e9885f99cee771b51692fadc5592bdbf19641aa from main.
2025-06-16	[5.2.x] Fixed #36447 -- Selected preferred media type based on quality.	Jake Howard
	When matching which entry in the `Accept` header should be used for a given media type, the specificity matters. However once those are resolved, only the quality matters when selecting preference. Regression in c075508b4de8edf9db553b409f8a8ed2f26ecead. Thank you to Anders Kaseorg for the report. Backport of 12c1557060fc94fe5e1fbddc4578a4e29d38f77c from main.
2025-06-09	[5.2.x] Fixed #36446 -- Restored "q" in internal MediaType.params property.	Natalia
	The "q" key was removed while addressing ticket #36411. Despite `MediaType.params` is undocumented and considered internal, it was used in third-party projects (Zulip reported breakage), so this work restored the `q` key in `params`. Thanks Anders Kaseorg for the report. Regression in c075508b4de8edf9db553b409f8a8ed2f26ecead. Backport of cf5f36bf903a2854f5e395149cee707115b83744 from main.
2025-06-03	[5.2.x] Fixed #36411 -- Made HttpRequest.get_preferred_type() consider media ↵	Jake Howard
	type parameters. HttpRequest.get_preferred_type() did not account for parameters in Accept header media types (e.g., "text/vcard; version=3.0"). This caused incorrect content negotiation when multiple types differed only by parameters, reducing specificity as per RFC 7231 section 5.3.2 (https://datatracker.ietf.org/doc/html/rfc7231.html#section-5.3.2). This fix updates get_preferred_type() to treat media types with parameters as distinct, allowing more precise and standards-compliant matching. Thanks to magicfelix for the report, and to David Sanders and Sarah Boyce for the reviews. Backport of c075508b4de8edf9db553b409f8a8ed2f26ecead from main.
2024-09-09	Fixed #35631 -- Added HttpRequest.get_preferred_type().	Jake Howard

2024-01-26	Applied Black's 2024 stable style.	Mariusz Felisiak
	https://github.com/psf/black/releases/tag/24.1.0
2023-11-28	Refs #21442 -- Increased test coverage of requests.	David Smith

2023-11-24	Fixed #34968 -- Made multipart parsing of headers raise an error on too long ↵	Standa Opichal
	headers. This also allow customizing the maximum size of headers via MAX_TOTAL_HEADER_SIZE.
2023-08-25	Fixed #34709 -- Raised BadRequest for non-UTF-8 requests with the ↵	Mariusz Felisiak
	application/x-www-form-urlencoded content type. Thanks Eki Xu for the report.
2023-08-02	Added more tests for django.http.request.split_domain_port().	Nick Pope

2023-06-07	Added MultiPartParser tests for parsing base64-encoded fields.	benebsiny

2023-04-12	Fixed #34484, Refs #34482 -- Reverted "Fixed #29186 -- Fixed pickling ↵	Mariusz Felisiak
	HttpRequest and subclasses." This reverts commit 6220c445c40a6a7f4d442de8bde2628346153963. Thanks Adam Johnson and Márton Salomváry for reports.
2023-02-14	Fixed CVE-2023-24580 -- Prevented DoS with too many uploaded files.	Markus Holtermann
	Thanks to Jakob Ackermann for the report.
2023-01-07	Renamed 'requests' test package.	Tim Graham
	This avoids a collision when third-party database backends depend on the Requests HTTP library.