| Age | Commit message (Collapse) | Author |
|---|
|
non-Django templates.
Backport of 1f2abf784a9fe550959de242d91963b2ad6f7e9c from master
|
|
This is a security fix; disclosure to follow shortly.
|
|
This is a security fix; disclosure to follow shortly.
|
|
Specifically stopped using the dir argument.
Backport of a8fe12417f778a76837f8e4f8503779f52a396ba from master
|
|
source contains non-ASCII characters.
Backport of 307c0f299a6c26f5231d3516df5b4edc54b36553 from master
|
|
RFC6454
Backport of 93b3ef9b2e from master.
|
|
Backport of 0ed7d155635da9f79d4dd67e4889087d3673c6da from master
|
|
Report and original patch by Kay Cha.
Backport of 540ca563de from master.
|
|
The function no longer flushes zfile after each write as doing so can
lead to the gzipped streamed content being larger than the original
content; each flush adds a 5/6 byte type 0 block. Removing this means
buf.read() may return nothing, so only yield if that has some data.
Testing shows without the flush() the buffer is being flushed every 17k
or so and compresses the same as if it had been done as a whole string.
Backport of caa3562d5bec1196502352a715a539bdb0f73c2d from master
|
|
This is a security fix. Disclosure following shortly.
|
|
|
|
|
|
Refs #7261 -- Made strings escaped by Django usable in third-party libs.
The changes in mark_safe and mark_for_escaping are straightforward. The
more tricky part is to handle correctly objects that implement __html__.
Historically escape() has escaped SafeData. Even if that doesn't seem a
good behavior, changing it would create security concerns. Therefore
support for __html__() was only added to conditional_escape() where this
concern doesn't exist.
Then using conditional_escape() instead of escape() in the Django
template engine makes it understand data escaped by other libraries.
Template filter |escape accounts for __html__() when it's available.
|force_escape forces the use of Django's HTML escaping implementation.
Here's why the change in render_value_in_context() is safe. Before Django
1.7 conditional_escape() was implemented as follows:
if isinstance(text, SafeData):
return text
else:
return escape(text)
render_value_in_context() never called escape() on SafeData. Therefore
replacing escape() with conditional_escape() doesn't change the
autoescaping logic as it was originally intended.
This change should be backported to Django 1.7 because it corrects a
feature added in Django 1.7.
Thanks mitsuhiko for the report.
|
|
mark_safe and mark_for_escaping should have been kept similar.
On Python 2 this change has no effect. On Python 3 it fixes the use case
shown in the regression test for mark_for_escaping, which used to raise
a TypeError. The regression test for mark_safe is just for completeness.
|
|
resultclasses.
Co-Authored-By: Rocky Meza <rmeza@fusionbox.com>
|
|
|
|
A field for storing periods of time - modeled in Python by timedelta. It
is stored in the native interval data type on PostgreSQL and as a bigint
of microseconds on other backends.
Also includes significant changes to the internals of time related maths
in expressions, including the removal of DateModifierNode.
Thanks to Tim and Josh in particular for reviews.
|
|
|
|
warnings from appearing in tests.
|
|
Since Python 2.7 and 3.1, "{0} {1}" is equivalent to "{} {}".
|
|
|
|
Added a test for the condition safe_join is designed to prevent.
Previously, a generic ValueError was raised. It was impossible to tell
an intentional exception raised to implement safe_join's contract from
an unintentional exception caused by incorrect inputs or unexpected
conditions. That resulted in bizarre exception catching patterns, which
this patch removes.
Since safe_join is a private API and since the change is unlikely to
create security issues for users who use it anyway -- at worst, an
uncaught SuspiciousFileOperation exception will bubble up -- it isn't
documented.
|
|
TestCase decorator.
|
|
|
|
|
|
Thanks kostko for the report.
|
|
function
|
|
SafeText.
Thanks Baptiste Mispelon for the report.
|
|
This also defines QuerySet.__bool__ for consistency though this should not have any consequence as bool(qs) used to fallback on QuerySet.__len__ in Py3.
|
|
Thanks Loic Bistuer for helping in shaping the patch and Claude Paroz
for the review.
|
|
|
|
This ensure that ''.join(c) in jslex.py always returns text.
|
|
|
|
Thanks Collin Anderson for the review.
|
|
|
|
Refs #22267.
|
|
Thanks Md. Enzam Hossain for the report and initial patch, and
Tim Graham for the review.
|
|
|
|
|
|
Also the unused, undocumented django.utils.html.strip_entities() function.
|
|
os.close(fd) is needed to avoid "The process cannot access the file
because it is being used by another process"
|
|
If the temporary file name contained a p or y as its last
characters, it would be stripped. refs #23083.
|
|
Thanks Collin Anderson for the report and hirokiky for the fix.
|
|
This fixes a regression introduced in 6d302f639.
Thanks lorinkoz at gmail.com for the report, Collin Anderson
for the initial patch and Simon Charette for the review.
|
|
Moved the {% lorem %} tag to built-in tags.
|
|
|
|
Thanks brylie.
|
|
Refs #9722. Thanks Tim Graham for the review.
|
|
|
|
|
