summaryrefslogtreecommitdiff
path: root/tests
AgeCommit message (Collapse)Author
2024-10-08[5.1.x] Fixed #35809 -- Set background color for selected rows in the ↵nessita
admin's form select widget. Regression in b47bdb4cd9149ee2a39bf1cc9996a36a940bd7d9. Thank you Giannis Terzopoulos for the review, and Tom Carrick and Sarah Boyce for the review. Backport of 679d57816d716cbc7cff3b364ae265d70444ebd9 from main.
2024-09-11[5.1.x] Fixed #35732 -- Wrapped ConcatPair expression in parentheses to ↵Gastón Avila
ensure operator precedence. When ConcatPair was updated to use || this lost the implicit wrapping from CONCAT(...). This broke the WHERE clauses when used in combination with PostgreSQL trigram similarity. Regression in 6364b6ee1071381eb3a23ba6b821fc0d6f0fce75. Backport of c3ca6075cc0ad425bcf905fe14062f38eb9fbcbf from main. Co-authored-by: Emiliano Cuenca <106986074+emicuencac@users.noreply.github.com>
2024-09-05[5.1.x] Fixed #32831 -– Allowed cache tests to be retried via a new ↵Wassef Ben Ahmed
"retry" decorator. Backport of 957c54d945fedb58febff05e4ce82377cc43f9f4 from main.
2024-09-03[5.1.x] Fixed CVE-2024-45231 -- Avoided server error on password reset when ↵Natalia
email sending fails. On successful submission of a password reset request, an email is sent to the accounts known to the system. If sending this email fails (due to email backend misconfiguration, service provider outage, network issues, etc.), an attacker might exploit this by detecting which password reset requests succeed and which ones generate a 500 error response. Thanks to Thibaut Spriet for the report, and to Mariusz Felisiak, Adam Johnson, and Sarah Boyce for the reviews.
2024-09-03[5.1.x] Fixed CVE-2024-45230 -- Mitigated potential DoS in urlize and ↵Sarah Boyce
urlizetrunc template filters. Thanks MProgrammer (https://hackerone.com/mprogrammer) for the report.
2024-08-30[5.1.x] Fixed #35716 -- Fixed VariableDoesNotExist when rendering admin ↵Sarah Boyce
fieldsets. Regression in 01ed59f753139afb514170ee7f7384c155ecbc2d. Thank you to Fábio Domingues and Marijke Luttekes for the report, and thank you to Natalia Bidart for the review. Backport of fd1dd767783b5a7ec1a594fcc5885e7e4178dd26 from main.
2024-08-28[5.1.x] Fixed #35688 -- Restored timezone and role setters to be PostgreSQL ↵Sarah Boyce
DatabaseWrapper methods. Following the addition of PostgreSQL connection pool support in Refs #33497, the methods for configuring the database role and timezone were moved to module-level functions. This change prevented subclasses of DatabaseWrapper from overriding these methods as needed, for example, when creating wrappers for other PostgreSQL-based backends. Thank you Christian Hardenberg for the report and to Florian Apolloner and Natalia Bidart for the review. Regression in fad334e1a9b54ea1acb8cce02a25934c5acfe99f. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 7380ac57340653854bc2cfe0ed80298cdac6061d from main.
2024-08-28[5.1.x] Fixed #35666 -- Documented stacklevel usage and testing, and ↵Simon Charette
adjusted test suite accordingly. Over the years we've had multiple instances of hit and misses when emitting warnings: either setting the wrong stacklevel or not setting it at all. This work adds assertions for the existing warnings that were declaring the correct stacklevel, but were lacking tests for it. Backport of 57307bbc7d88927989cf5b314f16d6e13ade04e6 from main.
2024-08-28[5.1.x] Refs #35405 -- Adjusted deprecation warning stacklevel in ↵Simon Charette
FieldCacheMixin.get_cache_name(). Backport of 39abd56a7fb1e2f735040df0fdfc08f57d91a49b from main.
2024-08-28[5.1.x] Refs #35326 -- Adjusted deprecation warning stacklevel in ↵Simon Charette
FileSystemStorage.OS_OPEN_FLAGS. Backport of 47f18a722624527cc72eef44cfc9d1e07ea4b4e0 from main.
2024-08-28[5.1.x] Refs #35060 -- Adjusted deprecation warning stacklevel in ↵Simon Charette
Model.save()/asave(). Backport of 52ed2b645e1dd8c9a874cfd21c4c9f2500032626 from main.
2024-08-28[5.1.x] Refs #34900 -- Updated requirements for Python 3.13.Mariusz Felisiak
Backport of 07a4d23283586bc4578eb9c82a7ad14af3724057 from main.
2024-08-27[5.1.x] Refs #34609 -- Fixed deprecation warning stack level in format_html().Adam Johnson
Co-authored-by: Simon Charette <charette.s@gmail.com> Backport of 2b71b2c8dcd40f2604310bb3914077320035b399 from main.
2024-08-26[5.1.x] Improved test coverage of urlize.Sarah Boyce
Backport of c6d1f98d2685f34e009e0fffdcff4ad275e55879 from main.
2024-08-19[5.1.x] Fixed #35678 -- Removed "usable_password" field from ↵Natalia
BaseUserCreationForm. Refs #34429: Following the implementation allowing the setting of unusable passwords via the admin site, the `BaseUserCreationForm` and `UserCreationForm` were extended to include a new field for choosing whether password-based authentication for the new user should be enabled or disabled at creation time. Given that these forms are designed to be extended when implementing custom user models, this branch ensures that this new field is moved to a new, admin-dedicated, user creation form `AdminUserCreationForm`. Regression in e626716c28b6286f8cf0f8174077f3d2244f3eb3. Thanks Simon Willison for the report, Fabian Braun and Sarah Boyce for the review. Backport of 0ebed5fa95f53b87383901bbd9341ef3c974344f from main.
2024-08-19[5.1.x] Refs #35678 -- Split tests for BaseUserCreationForm when using a ↵Natalia
custom User model. This work also allows to subclass BaseUserCreationFormTest to reuse the tests and assertions for testing forms that extend BaseUserCreationForm, which is now used for UserCreationFormTest, increasing its coverage. Backport of b60fd8722f305ec29c87f34d3fea262e56394ebd from main.
2024-08-13[5.1.x] Fixed #35665 -- Fixed a crash when passing an empty order_by to Window.Simon Charette
This also caused un-ordered sliced prefetches to crash as they rely on Window. Regression in e16d0c176e9b89628cdec5e58c418378c4a2436a that made OrderByList piggy-back ExpressionList without porting the empty handling that the latter provided. Supporting explicit empty ordering on Window functions and slicing is arguably a foot-gun design due to how backends will return undeterministic results but this is a problem that requires a larger discussion. Refs #35064. Thanks Andrew Backer for the report and Mariusz for the review. Backport of 602fe961e6834d665f2359087a1272e9f9806b71 from main.
2024-08-08[5.1.x] Fixed #35661 -- Fixed test_too_many_digits_to_rander() test crash on ↵Mariusz Felisiak
PyPy. Thanks Michał Górny for the report. Backport of 7fb15ad5bcae05324ee8913e4b2c6c982e8f2de0 from main.
2024-08-07[5.1.x] Fixed i18n.tests.TranslationTests.test_plural to use correct French ↵Natalia
translation.
2024-08-06[5.1.x] Fixed CVE-2024-42005 -- Mitigated QuerySet.values() SQL injection ↵Simon Charette
attacks against JSON fields. Thanks Eyal (eyalgabay) for the report.
2024-08-06[5.1.x] Fixed CVE-2024-41991 -- Prevented potential ReDoS in ↵Mariusz Felisiak
django.utils.html.urlize() and AdminURLFieldWidget. Thanks Seokchan Yoon for the report. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
2024-08-06[5.1.x] Fixed CVE-2024-41990 -- Mitigated potential DoS in urlize and ↵Sarah Boyce
urlizetrunc template filters. Thanks to MProgrammer for the report.
2024-08-06[5.1.x] Fixed CVE-2024-41989 -- Prevented excessive memory consumption in ↵Sarah Boyce
floatformat. Thanks Elias Myllymäki for the report. Co-authored-by: Shai Berger <shai@platonix.com>
2024-08-05[5.1.x] Fixed #35657 -- Made FileField handle db_default values.Sarah Boyce
Backport of 8deb6bb1fc427762d56646bf7306cbd11fb5bb68 from main.
2024-08-05[5.1.x] Fixed #35638 -- Updated validate_constraints to consider db_default.David Sanders
Backport of 509763c79952cde02d9f5b584af4278bdbed77b2 from main.
2024-08-05[5.1.x] Fixed #35628 -- Allowed compatible GeneratedFields for ↵John Parton
ModelAdmin.date_hierarchy. Backport of 7f8d839722b72aeb3ec5a4278ae57c18283acacd from main.
2024-08-02[5.1.x] Fixed #35643 -- Fixed a crash when ordering a QuerySet by a ↵Simon Charette
reference containing "__". Regression in b0ad41198b3e333f57351e3fce5a1fb47f23f376. Refs #34013. The initial logic did not consider that annotation aliases can include lookup or transform separators. Thanks Gert Van Gool for the report and Mariusz Felisiak for the review. Backport of a16f13a8661297eda12c4177bb01fa2e5b5ccc56 from main.
2024-07-26[5.1.x] Added missing skips in constraint tests.Tim Graham
Backport of b6ad8b687adf011245270df17a38c1a42792e3d7 from main.
2024-07-25[5.1.x] Added dedicated test for invalid inputs in floatformat template ↵nessita
filter tests. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> Backport of 1b277b45cc4059760072095f3bd6e8a4e4c4d406 from main.
2024-07-25[5.1.x] Fixed #35627 -- Raised a LookupError rather than an unhandled ↵Lorenzo Peña
ValueError in get_supported_language_variant(). LocaleMiddleware didn't handle the ValueError raised by get_supported_language_variant() when language codes were over 500 characters. Regression in 9e9792228a6bb5d6402a5d645bc3be4cf364aefb. Backport of 0e94f292cda632153f2b3d9a9037eb0141ae9c2e from main.
2024-07-25[5.1.x] Fixed #35625 -- Fixed a crash when adding a field with db_default ↵Simon Charette
and check constraint. This is the exact same issue as refs #30408 but for creating a model with a constraint containing % escapes instead of column addition. All of these issues stem from a lack of SQL and parameters separation from the BaseConstraint DDL generating methods preventing them from being mixed with other parts of the schema alteration logic that do make use of parametrization on some backends (e.g. Postgres, MySQL for DEFAULT). Prior to the addition of Field.db_default and GeneratedField in 5.0 parametrization of DDL was never exercised on model creation so this is effectively a bug with db_default as the GeneratedField case was addressed by refs #35336. Thanks Julien Chaumont for the report and Mariusz Felisiak for the review. Backport of f359990e4909db8722820849d61a6f5724338723 from main.
2024-07-24[5.1.x] Fixed #35604, Refs #35326 -- Made FileSystemStorage.exists() ↵Sarah Boyce
behaviour independent from allow_overwrite. Partially reverts 0b33a3abc2ca7d68a24f6d0772bc2b9fa603744e. Storage.exists(name) was documented to "return False if the name is available for a new file." but return True if the file exists. This is ambiguous in the overwrite file case. It will now always return whether the file exists. Thank you to Natalia Bidart and Josh Schneier for the review. Backport of 8d6a20b656ff3fa18e36954668a44a831c2f6ddd from main.
2024-07-24[5.1.x] Updated asgiref dependency for 5.1 release series.Mariusz Felisiak
Backport of df35cf578f99522dd1ba864d513be95d47bab7a5 from main.
2024-07-18[5.1.x] Fixed #35603 -- Prevented F.__contains__() from hanging.Simon Charette
Regression in 94b6f101f7dc363a8e71593570b17527dbb9f77f. Backport of 6b3f55446fdc62bd277903fd188a1781e4d92d29 from main.
2024-07-18[5.1.x] Fixed #35606, Refs #34045 -- Fixed rendering of ↵Hisham Mahmood
ModelAdmin.action_checkbox for models with a __html__ method. Thank you Claude Paroz for the report. Regression in 85366fbca723c9b37d0ac9db1d44e3f1cb188db2. Backport of 182f262b15882649bbc39d769f9b721cf3660f6f from main.
2024-07-17[5.1.x] Fixed #35594 -- Added unique nulls distinct validation for expressions.Simon Charette
Thanks Mark Gensler for the report. Backport of adc0b6aac3f8a5c96e1ca282bc9f46e28d20281c from main.
2024-07-17[5.1.x] Refs #30581 -- Made unattached UniqueConstraint(fields) validation ↵Simon Charette
testable. The logic allowing UniqueConstraint(fields).validate to preserve backward compatiblity with Model.unique_error_message failed to account for cases where the constraint might not be attached to a model which is a common pattern during testing. This changes allows for arbitrary UniqueConstraint(fields) to be tested in isolation without requiring actual models backing them up. Co-authored-by: Mark G <mark.gensler@protonmail.com> Backport of 13922580cccfb9ab2922ff4943dd39da56dfbd8c from main.
2024-07-16[5.1.x] Refs #10941 -- Renamed test file test_query_string.py to ↵nessita
test_querystring.py. This follows previous renames made in 27043bde5b795eb4a605aeca1d3bc4345d2ca478. Backport of 5dc17177c38662d6f4408258ee117cd80e0cb933 from main.
2024-07-15[5.1.x] Refs #10941 -- Renamed query_string template tag to querystring.Sarah Boyce
Backport of 27043bde5b795eb4a605aeca1d3bc4345d2ca478 from main.
2024-07-15[5.1.x] Refs #35560 -- Corrected required feature flags in ↵Mariusz Felisiak
GeneratedModelUniqueConstraint. Backport of 2d3bb414cfb2778cc64f22e7203102d7389f81e6 from main.
2024-07-09[5.1.x] Fixed CVE-2024-39614 -- Mitigated potential DoS in ↵Sarah Boyce
get_supported_language_variant(). Language codes are now parsed with a maximum length limit of 500 chars. Thanks to MProgrammer for the report.
2024-07-09[5.1.x] Fixed CVE-2024-39330 -- Added extra file name validation in ↵Natalia
Storage's save method. Thanks to Josh Schneier for the report, and to Carlton Gibson and Sarah Boyce for the reviews.
2024-07-09[5.1.x] Fixed CVE-2024-39329 -- Standarized timing of verify_password() when ↵Michael Manfre
checking unusuable passwords. Refs #20760. Thanks Michael Manfre for the fix and to Adam Johnson for the review.
2024-07-09[5.1.x] Fixed CVE-2024-38875 -- Mitigated potential DoS in urlize and ↵Adam Johnson
urlizetrunc template filters. Thank you to Elias Myllymäki for the report. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
2024-07-04[5.1.x] Fixed #35560 -- Made Model.full_clean() ignore GeneratedFields for ↵Mark Gensler
constraints. Accessing generated field values on unsaved models caused a crash when validating CheckConstraints and UniqueConstraints with expressions. Backport of 1005c2abd1ef0c156f449641e38c33e473989d37 from main.
2024-06-26[5.1.x] Fixed #35561 -- Made *args and **kwargs parsing more strict in ↵nessita
Model.save()/asave(). Backport of e56a32b89bb7fadffdfaa2cdf12b4863ccd5af9b from main.
2024-06-25[5.1.x] Fixed #35558 -- Increased inline H3 headers color prominence in ↵Sarah Boyce
admin change page. Backport of e510bb1ab1fb22837c169e0459b81cf388b6d8d2 from main.
2024-06-25[5.1.x] Fixed #35554, Refs #35060 -- Corrected deprecated *args parsing in ↵Adam Johnson
Model.save()/asave(). The transitional logic added to deprecate the usage of *args for Model.save()/asave() introduced two issues that this branch fixes: * Passing extra positional arguments no longer raised TypeError. * Passing a positional but empty update_fields would save all fields. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 28522c3c8d5eb581347aececc3ac61c134528114 from main.
2024-06-25[5.1.x] Refs #35059 -- Used asyncio.Event in ↵Carlton Gibson
ASGITest.test_asyncio_cancel_error to enforce specific interleaving. Sleep call leads to a hard to trace error in CI. Using an Event is more deterministic, and should be less prone to environment variations. Bug in 11393ab1316f973c5fbb534305750740d909b4e4. Backport of f4a08b6ddfcacadfe9ff8364bf1c6c54f5dd370f from main.
2024-06-24[5.1.x] Fixed #35545, Refs #32833 -- Fixed ↵Sarah Boyce
ContentTypeManager.get_for_models() crash in CreateModel migrations. Thank you to Csirmaz Bendegúz for the report and Simon Charettes for the review. Backport of f1705c8780c0a7587654fc736542d55fe4a7f29b from main.
generated by cgit v1.3 (git 2.53.0) at 2026-07-07 01:06:09 +0000