| Age | Commit message (Collapse) | Author |
|
Certain email addresses/URLs could trigger a catastrophic backtracking
situation, causing 100% CPU and server overload. If deliberately triggered, this
could be the basis of a denial-of-service attack.
This security vulnerability was disclosed in public, so we're skipping our
normal security release process to get the fix out as soon as possible.
This is a security related update. A full announcement will follow.
git-svn-id: http://code.djangoproject.com/svn/django/branches/releases/1.1.X@11604 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
parentheses. Thanks to Brent Hagany for the report.
Merge of r11581 from trunk.
git-svn-id: http://code.djangoproject.com/svn/django/branches/releases/1.1.X@11582 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
test. Thanks to shields@msrl.com for the report, and apologies to Admiral Hopper for the error.
Merge of r11551 from trunk.
git-svn-id: http://code.djangoproject.com/svn/django/branches/releases/1.1.X@11573 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks for report and initial patch, matehat.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11498 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks vvd
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11493 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks steveire
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11492 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11477 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11475 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11474 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11423 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
lead to the exposure of system files. Thanks to Gary Wilson for the patch.
This is a security-related update. A full announcement, as well as backports for 1.0.X and 0.96.X will be forthcoming.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11351 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
include proxy models in their output. Thanks to Anssi Kaariainen for the report.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11343 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
on 32/64 bit differences. Thanks to Richard Davies for the report.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11328 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
expressions in single object updates. Thanks to Zachary Voase for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11322 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
admin when the admin is deployed using the old style admin.root approach. Thanks to JP for the report.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11314 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
prevent an encoding bug that occurs in some installations.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11285 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
admin site, where the absence of this facility was causing problems. Thanks to the many people who contributed to and helped review this patch.
This change is backwards incompatible for anyone that is using the named URLs
introduced in [9739]. Any usage of the old admin_XXX names need to be modified
to use the new namespaced format; in many cases this will be as simple as a
search & replace for "admin_" -> "admin:". See the docs for more details on
the new URL names, and the namespace resolution strategy.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11250 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks to Ramiro Morales and Michael Newmann for their work on the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11229 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
fields with an intermediate model. Thanks to J Clifford Dyer for the report and fix.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11215 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
objects are updated on save when the ordering field is editable. Thanks to Alex Gaynor, Karen Tracy, and Will Hardy for their contributions to this patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11160 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
ever return None. Thanks to Chris Cahoon for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11120 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
cases. Thanks to Nathan Auch for the report and patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11119 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
long cache keys. Thanks to 235 for the report and patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11068 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
steveire for the report.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11067 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
a delete to cascade to a related object even when the relationship had been set to None. Thanks to TheShark for the report and test case, and to juriejan and Jacob for their work on the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11009 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
problems with m2m relations between models that had non-integer primary keys. Thanks to Ronny for the report and test case.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11007 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Thanks to Loek Engels for the bulk of the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10983 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
always using the manager called `objects`. Thanks to Marc Remolt for the report.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10967 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
extension, save_base(raw=True) for Proxy models).
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10955 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
post_save signal.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10954 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
object is a custom primary key. Thanks to Alex Gaynor for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10952 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
newlines. Thanks Honza Kral.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10941 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
aren't pre-evaluated. Thanks to Henry Andrews for the report, and clement for the fix.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10929 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
to multiple foreign keys in only() clauses. Thanks to mrts for the report.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10928 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
when used on inherited models.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10926 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
cause an infinite loop when using MySQL InnoDB.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10913 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10863 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10860 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
setting image dimension fields.
* Moved dimension field update logic out of `ImageFileDescriptor.__set__` and into its own method on `ImageField`.
* New `ImageField.update_dimension_fields` method is attached to model instance's `post_init` signal so that:
* Dimension fields are set when defined before the ImageField.
* Dimension fields are set when the field is assigned in the model constructor (fixes #11196), but only if the dimension fields don't already have values, so we avoid updating the dimensions every time an object is loaded from the database (fixes #11084).
* Clear dimension fields when the ImageField is set to None, which also causes dimension fields to be cleared when `ImageFieldFile.delete()` is used.
* Added many more tests for ImageField that test edge cases we weren't testing before, and moved the ImageField tests out of `file_storage` and into their own module within `model_fields`.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10858 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
longer mess things up for other handlers. Thanks, Honza Kral.
While I was at it I also cleaned up the formatting of the docstrings a bit.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10831 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
to Alex Gaynor and Tom Tobin for the report via IRC.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10828 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
when saving a model form.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10826 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
Adam for the fix.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10824 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
deleting objects. Thanks to Bob Thomas for the fix, and markshep for the improvements on the test case.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10822 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
comments. Thanks kaikuehne.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10801 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10789 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
broken by r10756. Thanks to George Song and Michael Strickland for the simultaneous reports.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10787 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
retrieving one comment twice.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10785 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
comment moderation was added to `django.contrib.comments`.
The is a potentially backwards-incompatible change for users already relying on the internals of comment moderaration. To wit:
* The moderation system now listens to the new `comment_will_be_posted`/`comment_was_posted` signals instead of `pre/post_save`. This means that import request-based information is available to moderation as it should be.
* Some experimental code from `django.contrib.comments.moderation` has been removed. It was never intended to be merged into Django, and was completely untested and likely buggy.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10784 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|
|
`ModelAdmin.queryset()`.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10782 bcc190cf-cafb-0310-a4f2-bffc1f526a37
|