chango.git - django

Age	Commit message (Collapse)	Author
2016-03-04	[1.9.x] Added safety to URL decoding in is_safe_url() on Python 2	Claude Paroz
	The errors='replace' parameter to force_text altered the URL before checking it, which wasn't considered sane. Refs 24fc935218 and ada7a4aef. Backport of 552f03869e from master.
2016-03-04	[1.9.x] Fixed #26308 -- Prevented crash with binary URLs in is_safe_url()	Claude Paroz
	This fixes a regression introduced by c5544d28923. Thanks John Eskew for the reporti and Tim Graham for the review. Backport of ada7a4aef from master.
2016-03-01	[1.9.x] Fixed CVE-2016-2512 -- Prevented spoofing is_safe_url() with basic auth.	Mark Striemer
	This is a security fix.
2016-01-05	[1.9.x] Fixed #26024 -- Fixed regression in ConditionalGetMiddleware ETag ↵	Denis Cornehl
	support. Backport of 186b6c61bfe85afa4d6bf213d04a28dd2853fed2 from master
2015-12-03	[1.9.x] Fixed many spelling mistakes in code, comments, and docs.	Josh Soref
	Backport of 93452a70e8a62c7408eeded444f5088d4a26212d from master
2015-09-16	Fixed #24496 -- Added CSRF Referer checking against CSRF_COOKIE_DOMAIN.	Matt Robenolt
	Thanks Seth Gottlieb for help with the documentation and Carl Meyer and Joshua Kehn for reviews.
2015-03-18	Made is_safe_url() reject URLs that start with control characters.	Tim Graham
	This is a security fix; disclosure to follow shortly.
2015-02-12	Fixed #24321 -- Improved `utils.http.same_origin` compliance with RFC6454	Lukas Klein

2015-02-06	Sorted imports with isort; refs #23860.	Tim Graham

2015-01-13	Fixed is_safe_url() to handle leading whitespace.	Tim Graham
	This is a security fix. Disclosure following shortly.
2014-11-03	Fixed #23620 -- Used more specific assertions in the Django test suite.	Berker Peksag

2014-09-23	Consolidated some text utils into the utils_tests test package.	Loic Bistuer

2014-08-22	Fixed #23333 -- Made urlsafe_base64_decode() return proper type on Python 3.	Ian Foote

2014-07-07	Fixed #22909 -- Removed camelCasing in some tests.	Tim Graham
	Thanks brylie.
2014-05-14	Added additional checks in is_safe_url to account for flexible parsing.	Erik Romijn
	This is a security fix. Disclosure following shortly.
2014-05-14	Dropped fix_IE_for_vary/attach.	Aymeric Augustin
	This is a security fix. Disclosure following shortly.
2013-10-14	Fixed #21266 -- Fixed E201,E202 pep8 warnings.	Larry O'Neill

2013-09-02	Replaced "not PY3" by "PY2", new in six 1.4.0.	Aymeric Augustin

2013-07-01	Stopped using django.utils.unittest in the test suite.	Aymeric Augustin
	Refs #20680.
2013-04-12	Modified utils_tests for unittest2 discovery.	Preston Timmons