summaryrefslogtreecommitdiff
path: root/tests
AgeCommit message (Collapse)Author
2024-09-03[4.2.x] Fixed CVE-2024-45231 -- Avoided server error on password reset when ↵Natalia
email sending fails. On successful submission of a password reset request, an email is sent to the accounts known to the system. If sending this email fails (due to email backend misconfiguration, service provider outage, network issues, etc.), an attacker might exploit this by detecting which password reset requests succeed and which ones generate a 500 error response. Thanks to Thibaut Spriet for the report, and to Mariusz Felisiak, Adam Johnson, and Sarah Boyce for the reviews.
2024-09-03[4.2.x] Fixed CVE-2024-45230 -- Mitigated potential DoS in urlize and ↵Sarah Boyce
urlizetrunc template filters. Thanks MProgrammer (https://hackerone.com/mprogrammer) for the report.
2024-07-31[4.2.x] Fixed CVE-2024-42005 -- Mitigated QuerySet.values() SQL injection ↵Simon Charette
attacks against JSON fields. Thanks Eyal (eyalgabay) for the report.
2024-07-31[4.2.x] Fixed CVE-2024-41991 -- Prevented potential ReDoS in ↵Mariusz Felisiak
django.utils.html.urlize() and AdminURLFieldWidget. Thanks Seokchan Yoon for the report. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
2024-07-31[4.2.x] Fixed CVE-2024-41990 -- Mitigated potential DoS in urlize and ↵Sarah Boyce
urlizetrunc template filters. Thanks to MProgrammer for the report.
2024-07-31[4.2.x] Fixed CVE-2024-41989 -- Prevented excessive memory consumption in ↵Sarah Boyce
floatformat. Thanks Elias Myllymäki for the report. Co-authored-by: Shai Berger <shai@platonix.com>
2024-07-25[4.2.x] Fixed #35627 -- Raised a LookupError rather than an unhandled ↵Lorenzo Peña
ValueError in get_supported_language_variant(). LocaleMiddleware didn't handle the ValueError raised by get_supported_language_variant() when language codes were over 500 characters. Regression in 9e9792228a6bb5d6402a5d645bc3be4cf364aefb. Backport of 0e94f292cda632153f2b3d9a9037eb0141ae9c2e from main.
2024-07-11[4.2.x] Fixed auth_tests and file_storage tests on Python 3.8.Mariusz Felisiak
2024-07-09[4.2.x] Fixed CVE-2024-39614 -- Mitigated potential DoS in ↵Sarah Boyce
get_supported_language_variant(). Language codes are now parsed with a maximum length limit of 500 chars. Thanks to MProgrammer for the report.
2024-07-09[4.2.x] Fixed CVE-2024-39330 -- Added extra file name validation in ↵Natalia
Storage's save method. Thanks to Josh Schneier for the report, and to Carlton Gibson and Sarah Boyce for the reviews.
2024-07-09[4.2.x] Fixed CVE-2024-39329 -- Standarized timing of verify_password() when ↵Michael Manfre
checking unusuable passwords. Refs #20760. Thanks Michael Manfre for the fix and to Adam Johnson for the review.
2024-07-09[4.2.x] Fixed CVE-2024-38875 -- Mitigated potential DoS in urlize and ↵Adam Johnson
urlizetrunc template filters. Thank you to Elias Myllymäki for the report. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
2024-03-04[4.2.x] Fixed CVE-2024-27351 -- Prevented potential ReDoS in Truncator.words().Shai Berger
Thanks Seokchan Yoon for the report. Co-Authored-By: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2024-02-10[4.2.x] Refs #34900, Refs #34118 -- Updated assertion in ↵Daniel Garcia Moreno
test_skip_class_unless_db_feature() test on Python 3.12.2+. Python 3.12.2 bring back the skipped tests in the number of running tests. Refs https://github.com/python/cpython/commit/0a737639dcd3b7181250f5d56694b192eaddeef0 Backport of bc8471f0aac8f0c215b9471b594d159783bac19b from main
2024-02-08[4.2.x] Fixed #35172 -- Fixed intcomma for string floats.Mariusz Felisiak
Thanks Warwick Brown for the report. Regression in 55519d6cf8998fe4c8f5c8abffc2b10a7c3d14e9. Backport of 2f14c2cedc9c92373471c1f98a80c81ba299584a from main.
2024-02-06[4.2.x] Fixed CVE-2024-24680 -- Mitigated potential DoS in intcomma template ↵Adam Johnson
filter. Thanks Seokchan Yoon for the report. Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Co-authored-by: Shai Berger <shai@platonix.com>
2024-01-29[4.2.x] Pinned black == 23.12.1 in GitHub actions, pre-commit and test ↵nessita
requirements.
2023-11-30[4.2.x] Fixed #35006 -- Fixed migrations crash when altering ↵Mariusz Felisiak
Meta.db_table_comment on SQLite. Thanks Юрий for the report. Regression in 78f163a4fb3937aca2e71786fbdd51a0ef39629e. Backport of 37fc832a54ad37e75a898a2c8f9ab0820617c4af from main
2023-11-27[4.2.x] Fixed #34982 -- Fixed admin's read-only password widget and help ↵Tom Carrick
texts alignment for tablet screen size. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> Backport of 729266c6f29c7a0677b24926a86a767ef3078b26 from main
2023-11-27[4.2.x] Fixed #34992 -- Fixed DatabaseFeatures.allows_group_by_selected_pks ↵Nathaniel Conroy
on MariaDB with ONLY_FULL_GROUP_BY sql mode. Regression in 041551d716b69ee7c81199eee86a2d10a72e15ab. Backport of 0257426fe1fe9d146fd5813f09d909917ff59360 from main.
2023-11-23[4.2.x] Fixed #34987 -- Fixed queryset crash when mixing aggregate and ↵Simon Charette
window annotations. Regression in f387d024fc75569d2a4a338bfda76cc2f328f627. Just like `OrderByList` the `ExpressionList` expression used to wrap `Window.partition_by` must implement `get_group_by_cols` to ensure the necessary grouping when mixing window expressions with aggregate annotations is performed against the partition members and not the partition expression itself. This is necessary because while `partition_by` is implemented as a source expression of `Window` it's actually a fragment of the WINDOW expression at the SQL level and thus it should result in a group by its members and not the sum of them. Thanks ElRoberto538 for the report. Backport of e76cc93b0168fa3abbafb9af1ab4535814b751f0 from main
2023-11-18[4.2.x] Fixed #34975 -- Fixed crash of conditional aggregate() over ↵Simon Charette
aggregations. Adjustments made to solve_lookup_type to defer the resolving of references for summarized aggregates failed to account for similar requirements for lookup values which can also reference annotations through Aggregate.filter. Regression in b181cae2e3697b2e53b5b67ac67e59f3b05a6f0d. Refs #25307. Thanks Sergey Nesterenko for the report. Backport of 7530cf3900ab98104edcde69e8a2a415e82b345a from main
2023-11-09[4.2.x] Fixed #34457 -- Restored output for makemigrations --check.Adam Johnson
Co-authored-by: David Sanders <shang.xiao.sanders@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of f7389c4b07ceeb036436e065898e411b247bca78 from main
2023-11-01[4.2.x] Fixed CVE-2023-46695 -- Fixed potential DoS in UsernameField on Windows.Mariusz Felisiak
Thanks MProgrammer (https://hackerone.com/mprogrammer) for the report.
2023-10-30[4.2.x] Fixed #34932 -- Restored varchar_pattern_ops/text_pattern_ops index ↵Tom Carrick
creation when deterministic collaction is set. Regression in f3f9d03edf17ccfa17263c7efa0b1350d1ac9278 (4.2) and 8ed25d65ea7546fafd808086fa07e7e5bb5428fc (5.0). Backport of 34b411762b50883d768d7b67e0a158ec39da8b09 from main.
2023-10-16[4.2.x] Refs #34900, Refs #34118 -- Updated assertion in ↵Mariusz Felisiak
test_skip_class_unless_db_feature() test on Python 3.12.1+. Python 3.12.1+ no longer includes skipped tests in the number of running tests. Check out: https://github.com/python/cpython/issues/110890#issuecomment-1763458686 https://github.com/python/cpython/pull/106588 Backport of 20b7aac7ca60b0352d926340622e618bcbee54a8 from main
2023-10-16[4.2.x] Fixed #34798 -- Fixed QuerySet.aggregate() crash when referencing ↵Simon Charette
expressions containing subqueries. Regression in 59bea9efd2768102fc9d3aedda469502c218e9b7, complements e5c844d6f2a4ac6ae674d741b5f1fa2a688cedf4. Refs #28477, #34551. Thanks Haldun Komsuoglu for the report. Backport of 3b4a571275d967512866012955eb0b3ae486d63c from main
2023-10-12[4.2.x] Refs #34840 -- Fixed ↵Mariusz Felisiak
test_validate_nullable_textfield_with_isnull_true() on databases that don's support table check constraints. Thanks Tim Graham for the report. Backport of 9fd3a0ffc8fb8e532b0d5717f99fb15aff175a6c from main
2023-10-04[4.2.x] Fixed CVE-2023-43665 -- Mitigated potential DoS in ↵Natalia
django.utils.text.Truncator when truncating HTML text. Thanks Wenchao Li of Alibaba Group for the report.
2023-09-22[4.2.x] Fixed #34840 -- Avoided casting string base fields on PostgreSQL.Mariusz Felisiak
Thanks Alex Vandiver for the report. Regression in 09ffc5c1212d4ced58b708cbbf3dfbfb77b782ca. Backport of 779cd28acb1f7eb06f629c0ea4ded99b5ebb670a from main.
2023-09-11[4.2.x] Fixed #34821 -- Prevented DEFAULT_FILE_STORAGE/STATICFILES_STORAGE ↵Mariusz Felisiak
settings from mutating the main STORAGES. Regression in 6b965c600054f970bdf94017ecf2e0e6e0a4326b. Backport of a7c73b944f51d6c92ec876fd7e0a171e7c01657d from main
2023-09-04[4.2.x] Fixed CVE-2023-41164 -- Fixed potential DoS in ↵Mariusz Felisiak
django.utils.encoding.uri_to_iri(). Thanks MProgrammer (https://hackerone.com/mprogrammer) for the report. Co-authored-by: nessita <124304+nessita@users.noreply.github.com>
2023-09-01[4.2.x] Fixed #34803 -- Fixed queryset crash when filtering againts deeply ↵willzhao
nested OuterRef annotations. Thanks Pierre-Nicolas Rigal for the report. Regression in c67ea79aa981ae82595d89f8018a41fcd842e7c9. Backport of 9cc0d7f7f85cecc3ad15bbc471fe6a08e4f515b6 from main
2023-08-19[4.2.x] Fixed #34779 -- Avoided unnecessary selection of non-nullable m2m ↵Juan Alvarez
fields without natural keys during serialization. By using `select_related(None)` instead of `select_related()`, the unnecessary joins are completely avoided. Note that the current tests already covers the change, when the field is not `null=True`. Regression in f9936deed1ff13b20e18bd9ca2b0750b52706b6c. Backport of 517d3bb4dd17e9c51690c98d747b86a0ed8b2fbf from main
2023-08-18[4.2.x] Fixed #34773 -- Fixed syncing ↵Mariusz Felisiak
DEFAULT_FILE_STORAGE/STATICFILES_STORAGE settings with STORAGES. Thanks Petr Dlouhý for the report. Bug in 32940d390a00a30a6409282d314d617667892841. Backport of 6b965c600054f970bdf94017ecf2e0e6e0a4326b from main
2023-08-04[4.2.x] Fixed #34754 -- Fixed JSONField check constraints validation on NULL ↵Simon Charette
values. The __isnull lookup of JSONField must special case Value(None, JSONField()) left-hand-side in order to be coherent with its convoluted null handling. Since psycopg>=3 offers no way to pass a NULL::jsonb the issue is resolved by optimizing IsNull(Value(None), True | False) to True | False. Regression in 5c23d9f0c32f166c81ecb6f3f01d5077a6084318. Thanks Alexandre Collet for the report. Backport of 3434dbd39d373df7193ad006b970c09c1a909ea3 from main
2023-08-01[4.2.x] Fixed #34750 -- Fixed QuerySet.count() when grouping by unused ↵Mariusz Felisiak
multi-valued annotations. Thanks Toan Vuong for the report. Thanks Simon Charette for the review. Regression in 59bea9efd2768102fc9d3aedda469502c218e9b7. Backport of c9b9a52edc66be117c6e5b5214fa788a4d5db7a8 from main
2023-07-30[4.2.x] Fixed warnings per flake8 6.1.0.Mariusz Felisiak
Backport of 22b0b73c7732ba67db4e69fd9fa75aad84c8e5c4 from main
2023-07-30[4.2.x] Fixed #34748 -- Fixed queryset crash when grouping by a reference in ↵Simon Charette
a subquery. Regression in dd68af62b2b27ece50d434f6a351877212e15c3f. Thanks Toan Vuong for the report. Backport of 4087367ba869be9cf305dac39a8887d4aa4041d2 from main
2023-07-19[4.2.x] Fixed #34717 -- Fixed QuerySet.aggregate() crash when referencing ↵Simon Charette
window functions. Regression in 59bea9efd2768102fc9d3aedda469502c218e9b7. Refs #28477. Thanks younes-chaoui for the report. Backport of 68912e4f6f84f21322f92a2c7b6c77f68f91b9c9 from main
2023-07-03[4.2.x] Fixed CVE-2023-36053 -- Prevented potential ReDoS in EmailValidator ↵Mariusz Felisiak
and URLValidator. Thanks Seokchan Yoon for reports.
2023-06-13[4.2.x] Refs #30220 -- Bumped required version of Selenium to 3.8.0.Mariusz Felisiak
Follow up to 8d010f39869f107820421631111417298d1c5bb9. Backport of 06881341d48dd17a4fdf25afc96991de4fb3b1ac from main
2023-06-09[4.2.x] Fixed #34645 -- Restored alignment for admin date/time timezone ↵Mariusz Felisiak
warnings. Regression in 96a598356a9ea8c2c05b22cadc12e256a3b295fd. Backport of caf80cb41f13e84803a94928282cae75333bbdfc from main
2023-06-04[4.2.x] Fixed #34620 -- Fixed serialization crash on m2m fields without ↵Mariusz Felisiak
natural keys when base querysets use select_related(). Regression in 19e0587ee596debf77540d6a08ccb6507e60b6a7. Thanks Martin Svoboda for the report. Backport of f9936deed1ff13b20e18bd9ca2b0750b52706b6c from main
2023-06-01[4.2.x] Fixed #34612 -- Fixed QuerySet.only() crash on reverse relationships.Simon Charette
Regression in b3db6c8dcb5145f7d45eff517bcd96460475c879. Thanks Ian Cubitt for the report. This also corrected test_inheritance_deferred2() test which was previously properly defined and marked as an expected failure but was then wrongly adjusted to mask the lack of support for per-alias deferral that was fixed by #21204. Backport of 2cf76f2d5d1aa16acfadaf53db3d30128a34b088 from main
2023-05-24[4.2.x] Fixed #34590 -- Reverted "Refs #33308 -- Improved adapting ↵David Sanders
DecimalField values to decimal." This reverts 7990d254b0af158baf827fafbd90fe8e890f23bd. Thanks Marc Odermatt for the report. Backport of 0c1518ee429b01c145cf5b34eab01b0b92f8c246 from main
2023-05-23[4.2.x] Refs #34118 -- Fixed ↵Mariusz Felisiak
FunctionalTests.test_cached_property_reuse_different_names() on Python 3.12+. Python 3.12+ no longer wraps exceptions in __set_name__, see https://github.com/python/cpython/commit/55c99d97e14618dfce41472dd4446f763b0da13f Backport of fc9c90d9c4611d441d2617a7d74f622b1f520f7c from main
2023-05-23[4.2.x] Fixed #34551 -- Fixed QuerySet.aggregate() crash when referencing ↵Simon Charette
subqueries. Regression in 59bea9efd2768102fc9d3aedda469502c218e9b7. Refs #28477. Thanks Denis Roldán and Mariusz for the test. Backport of e5c844d6f2a4ac6ae674d741b5f1fa2a688cedf4 from main
2023-05-23[4.2.x] Refs #34551 -- Fixed QuerySet.aggregate() crash on precending ↵Simon Charette
aggregation reference. Regression in 1297c0d0d76a708017fe196b61a0ab324df76954. Refs #31679. Backport of 2ee01747c32a7275a7a1a5f7862acba7db764921 from main
2023-05-17[4.2.x] Fixed #34568 -- Made makemigrations --update respect --name option.Mariusz Felisiak
Thanks David Sanders for the report. Backport of c52f4295f254e1c14af769d22b1a5f516a941f58 from main
generated by cgit v1.3 (git 2.53.0) at 2026-07-06 17:15:39 +0000