summaryrefslogtreecommitdiff
path: root/tests
AgeCommit message (Collapse)Author
2025-12-02[6.0.x] Refs #35444 -- Fixed typo in PostgreSQL StringAgg deprecation warning.Mariusz Felisiak
2025-12-02[6.0.x] Fixed CVE-2025-64460 -- Corrected quadratic inner text accumulation ↵Shai Berger
in XML serializer. Previously, `getInnerText()` recursively used `list.extend()` on strings, which added each character from child nodes as a separate list element. On deeply nested XML content, this caused the overall deserialization work to grow quadratically with input size, potentially allowing disproportionate CPU consumption for crafted XML. The fix separates collection of inner texts from joining them, so that each subtree is joined only once, reducing the complexity to linear in the size of the input. These changes also include a mitigation for a xml.dom.minidom performance issue. Thanks Seokchan Yoon (https://ch4n3.kr/) for report. Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 50efb718b31333051bc2dcb06911b8fa1358c98c from main.
2025-12-02[6.0.x] Fixed CVE-2025-13372 -- Protected FilteredRelation against SQL ↵Jacob Walls
injection in column aliases on PostgreSQL. Follow-up to CVE-2025-57833. Thanks Stackered for the report, and Simon Charette and Mariusz Felisiak for the reviews. Backport of 5b90ca1e7591fa36fccf2d6dad67cf1477e6293e from main.
2025-12-02[6.0.x] Refs #35444 -- Fixed typo in PostgreSQL StringAgg deprecation warning.Νικόλαος-Διγενής Καραγιάννης
Backport of cb1d2854ed2b13799f2b0cc6e04019df181bacd4 from main
2025-12-01[6.0.x] Fixed #36712 -- Evaluated type annotations lazily in template tag ↵Jacob Walls
registration. Ideally, this will be reverted when an upstream solution is available for https://github.com/python/cpython/issues/141560. Thanks Patrick Rauscher for the report and Augusto Pontes for the first iteration and test. Backport of 34186e731ca20a2344b1f88fd543a854d6b13a00 from main.
2025-12-01[6.0.x] Closed temporary files in ↵Jacob Walls
OverwritingStorageTests.test_save_overwrite_behavior_temp_file(). Backport of a08f1693f37e9aae9eca395020cce0638cb5aa5f from main.
2025-12-01[6.0.x] Refs #35535 -- Used intended decorator in ↵Jacob Walls
test_simple_block_tag_parens(). Backport of e94b19f6abdda70689aa17e399ce5fdef7897674 from main.
2025-11-26[6.0.x] Fixed #36743 -- Increased URL max length enforced in ↵varunkasyap
HttpResponseRedirectBase. Refs CVE-2025-64458. The previous limit of 2048 characters reused the URLValidator constant and proved too restrictive for legitimate redirects to some third-party services. This change introduces a separate `MAX_URL_REDIRECT_LENGTH` constant (defaulting to 16384) and uses it in HttpResponseRedirectBase. Thanks Jacob Walls for report and review. Backport of a8cf8c292cfee98fe6cc873ca5221935f1d02271 from main.
2025-11-24[6.0.x] Corrected assertions for True/False results in ↵Jake Howard
tests/auth_tests/test_handlers.py. Backport of d08ae991a83950aba5043f5a34f5af12d2effe9e from main.
2025-11-24[6.0.x] Fixed #36751 -- Fixed empty filtered aggregation crash over ↵Simon Charette
annotated queryset. Regression in b8e5a8a9a2a767f584cbe89a878a42363706f939. Refs #36404. The replace_expressions method was innapropriately dealing with falsey but not None source expressions causing them to also be potentially evaluated when __bool__ was invoked (e.g. QuerySet.__bool__ evaluates the queryset). The changes introduced in b8e5a8a9a2, which were to deal with a similar issue, surfaced the problem as aggregation over an annotated queryset requires an inlining (or pushdown) of aggregate references which is achieved through replace_expressions. In cases where an empty Q object was provided as an aggregate filter, such as when the admin facetting feature was used as reported, it would wrongly be turned into None, instead of an empty WhereNode, causing a crash at aggregate filter compilation. Note that the crash signature differed depending on whether or not the backend natively supports aggregate filtering (supports_aggregate_filter_clause) as the fallback, which makes use Case / When expressions, would result in a TypeError instead of a NoneType AttributeError. Thanks Rafael Urben for the report, Antoliny and Youngkwang Yang for the triage. Backport of 2a6e0bd72d4a69725b957d6748a4b834f21b12b5 from main
2025-11-20[6.0.x] Fixed #36748 -- Filtered non-standard placeholders from UNNEST queries.Chris Wesseling
Backport of 5834643f43a767fe19f2c6d10217b204e7584ec8 from main.
2025-11-18[6.0.x] Fixed #36733 -- Escaped attributes in Stylesheet.__str__().varunkasyap
Thanks Mustafa Barakat for the report, Baptiste Mispelon for the triage, and Jake Howard for the review. Backport of e05f2a75695b5f5faa7682d4053db4776d4d6f93 from main.
2025-11-18[6.0.x] Fixed #36141 -- Checked for applied replaced migrations recursively.Georgi Yanchev
Regression in 64b1ac7292c72d3551b2ad70b2a78c8fe4af3249. Backport of b07298a73a8d444b3618aad8005055bee5ead8cb from main.
2025-11-13[6.0.x] Fixed #36730 -- Fixed constraint validation crash for excluded FK ↵Adam Johnson
attnames. Regression in e44e8327d3d88d86895735c0e427102063ff5b55. Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com> Backport of abfa4619fb818ff694c22e962a280673e085239e from main
2025-11-10Refs #36680 -- Avoided manipulating PATH in AdminScriptTestCase.Jacob Walls
This mostly reverts 6436ec321073bf0622af815e0af08f54c97f9b30, which was fragile. Instead, if black is present, we use it to format the expected and actual results, instead of hard-coding the expected formatted value. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2025-11-05[6.0.x] Fixed #36710 -- Fixed a regression in urlize for multipart domain names.Mehraz Hossain Rumman
Thanks Mehraz Hossain Rumman for the report and Bruno Alla for the triage. Regression in a9fe98d5bd4212d069afe8316101984aadecfbb2. Backport of 125b63ca745bace1e098ed3c7362d59136f68a8b from main.
2025-11-05[6.0.x] Refs CVE-2025-64459 -- Avoided propagating invalid arguments to Q on ↵Jacob Walls
dictionary expansion. Backport of 3c3f46357718166069948625354b8315a8505262 from main.
2025-11-05[6.0.x] Fixed CVE-2025-64459 -- Prevented SQL injections in Q/QuerySet via ↵Jacob Walls
the _connector kwarg. Thanks cyberstan for the report, Sarah Boyce, Adam Johnson, Simon Charette, and Jake Howard for the reviews. Backport of 98e642c69181c942d60a10ca0085d48c6b3068bb from main.
2025-11-05[6.0.x] Fixed CVE-2025-64458 -- Mitigated potential DoS in ↵Jacob Walls
HttpResponseRedirect/HttpResponsePermanentRedirect on Windows. Thanks Seokchan Yoon for the report, Markus Holtermann for the triage, and Jake Howard for the review. Follow-up to CVE-2025-27556 and 39e2297210d9d2938c75fc911d45f0e863dc4821. Backport of c880530ddd4fabd5939bab0e148bebe36699432a from main.
2025-11-04[6.0.x] Fixed #36704 -- Fixed system check error for proxy model with a ↵Hal Blackburn
composite pk. Proxy models subclassing a model with a CompositePrimaryKey were incorrectly reporting check errors because the check that requires only local fields to be used in a composite pk was evaluated against the proxy subclass, which has no fields. To fix this, composite pk field checks are not evaluated against proxy subclasses, as none of the checks are applicable to proxy subclasses. This also has the benefit of not double-reporting real check errors from an invalid superclass pk. Thanks Clifford Gama for the review. Backport of 74564946c3b42a2ef7d087047e49873847a7e1d9 from main.
2025-10-31[6.0.x] Fixed #36696 -- Fixed NameError when inspecting functions with ↵Patrick Rauscher
deferred annotations. In Python 3.14, annotations are deferred by default, so we should not assume that the names in them have been imported unconditionally. Backport of 601914722956cc41f1f2c53972d669ddee6ffc04 from main.
2025-10-30[6.0.x] Refs #36680 -- Fixed admin_scripts tests crash when black is not ↵Mariusz Felisiak
installed. Regression in 6436ec321073bf0622af815e0af08f54c97f9b30. Backport of 3939cd279569fde44f557d79f20bb5b1a02440af from main.
2025-10-29[6.0.x] Fixed #36680 -- Parametrized formatter discovery in AdminScriptTestCase.Jacob Walls
Backport of 6436ec321073bf0622af815e0af08f54c97f9b30 from main.
2025-10-29[6.0.x] Fixed #36678 -- Limited retries in ParallelTestRunner.Jacob Walls
Thanks Natalia Bidart for the review. Backport of 1aa69a7491ce7f7f1f164a26a3dfaaa1aeeab217 from main.
2025-10-21[6.0.x] Made RemoteTestResultTest.test_pickle_errors_detection() compatible ↵Mariusz Felisiak
with tblib 3.2+. tblib 3.2+ makes exception subclasses with __init__() and the default __reduce__() picklable. This broke the test for RemoteTestResult._confirm_picklable(), which expects a specific exception to fail unpickling. https://github.com/ionelmc/python-tblib/blob/master/CHANGELOG.rst#320-2025-10-21 This fix defines ExceptionThatFailsUnpickling.__reduce__() in a way that pickle.dumps(obj) succeeds, but pickle.loads(pickle.dumps(obj)) raises TypeError. Refs #27301. This preserves the intent of the regression test from 52188a5ca6bafea0a66f17baacb315d61c7b99cd without skipping it. Backport of 548209e620b3ca34396a360453f07c8dbb8aa6c7 from main.
2025-10-21[6.0.x] Fixed #36656 -- Avoided truncating async streaming responses in ↵Adam Johnson
GZipMiddleware. Backport of a0323a0c44135c28134672e6e633e5f4a7a68d5d from main.
2025-10-20[6.0.x] Fixed #36470 -- Prevented log injection in runserver when handling ↵YashRaj1506
NOT FOUND. Migrated `WSGIRequestHandler.log_message()` to use a more robust `log_message()` helper, which was based of `log_response()` via factoring out the common bits. Refs CVE-2025-48432. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 9bb83925d6c231e964f8b54efbc982fb1333da27 from main.
2025-10-20[6.0.x] Removed duplicate display_raw key in expected data in ↵Emmanuel Ferdman
GeometryWidgetTests. Signed-off-by: Emmanuel Ferdman <emmanuelferdman@gmail.com> Backport of 5625bd590766e5ca8c2c76ba2307b98f7450ff83 from main.
2025-10-20[6.0.x] Fixed RelatedGeoModelTest.test_related_union_aggregate() test on ↵Mariusz Felisiak
Oracle and GEOS 3.12+. Backport of 344ae16e1e21ab7c0b594d755519738f7f16eaf1 from main
2025-10-19[6.0.x] Refs #36005 -- Bumped minimum supported versions of docutils to 0.22.Mariusz Felisiak
Backport of ca3e0484ef31d13053af6a9d50667813e22fc282 from main.
2025-10-17[6.0.x] Refs #35844 -- Doc'd Python 3.14 compatibility.Mariusz Felisiak
Backport of 56977b466c33ca3da14a1ed2609172425a76a34e from main.
2025-10-17[6.0.x] Refs #35844 -- Relaxed GEOSIOTest.test02_wktwriter() test assertion.Mariusz Felisiak
Backport of 2d9c194d5a0d9ae746e16ee5f641e30d544dc31b from main
2025-10-16[6.0.x] Bumped minimum isort version to 7.0.0.Jacob Walls
Added ignores relating to https://github.com/PyCQA/isort/issues/2352. Backport of d980d68609448a4c85763fa34e471ff80540888b from main.
2025-10-15[6.0.x] Refs #36648 -- Removed hardcoded pk in CompositePKAggregateTests.Jacob Walls
Backport of bee64561a6e8cd22995c2b1254bab66dae892a6d from main.
2025-10-15[6.0.x] Fixed 36622 -- Prevented LazyObject FileField storages from ↵Clifford Gama
evaluating at boot time. Co-authored-by: Fabien MICHEL <fmichel@adista.fr> Backport of 6862d46dd96d71d80d6d2fa9873a93d811b39562 from main.
2025-10-15Skipped GISFunctionsTests.test_geometry_type() test for MultiPoint on ↵Mariusz Felisiak
MariaDB and GEOS 3.12+. GEOSWKTWriter_write() behavior was changed in GEOS 3.12+ to include parentheses for sub-members (https://github.com/libgeos/geos/pull/903). MariaDB doesn't accept WKT representations with additional parentheses for MultiPoint. This is an accepted bug (MDEV-36166) in MariaDB that should be fixed in the future: - https://jira.mariadb.org/browse/MDEV-36166
2025-10-15Moved object creation to subTest() in GISFunctionsTests.test_geometry_type() ↵Mariusz Felisiak
test.
2025-10-14[6.0.x] Fixed #36648, Refs #33772 -- Accounted for composite pks in ↵Jacob Walls
first()/last() when aggregating. Backport of 02eed4f37879b2077496f86bb1378a076b981233 from main.
2025-10-14[6.0.x] Refs #31223 -- Added __class_getitem__() to SetPasswordMixin.Thibaut Decombe
Backport of d0c8f89c942d1379724bdd37127076d13452f71d from main.
2025-10-13[6.0.x] Fixed #36611, Refs #36580 -- Added system check for multicolumn ↵Sarah Boyce
ForeignObject in Meta.indexes/constraints/unique_together. ForeignObjects with multiple `from_fields` are not supported in these options. Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 5b51e6f759f2ba993219347435149173c756c478 from main.
2025-10-13[6.0.x] Fixed #36660 -- Fixed a regression in descending Index local field ↵Simon Charette
checks. Regression in 8638d8bf74c1a58302c97d4436ad2eb08438145b. Refs #36273. Thanks Federico Bond for the report. Backport of edde2891c355103ba455f3fea95cff962e40962c from main.
2025-10-02[6.0.x] Refs #36491 -- Skipped ↵Mariusz Felisiak
ParallelTestSuiteTest.test_buffer_mode_reports_setupclass_failure() without tblib. Backport of 6cb641ba75b1e6eace9a46e3cbade70e4af2ff66 from main
2025-10-01[6.0.x] Fixed CVE-2025-59682 -- Fixed potential partial directory-traversal ↵Sarah Boyce
via archive.extract(). Thanks stackered for the report. Follow up to 05413afa8c18cdb978fcdf470e09f7a12b234a23. Backport of 924a0c092e65fa2d0953fd1855d2dc8786d94de2 from main.
2025-10-01[6.0.x] Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), ↵Mariusz Felisiak
aggregate(), and extra() against SQL injection in column aliases on MySQL/MariaDB. Thanks sw0rd1ight for the report. Follow up to 93cae5cb2f9a4ef1514cf1a41f714fef08005200. Backport of 41b43c74bda19753c757036673ea9db74acf494a from main.
2025-09-29[6.0.x] Fixed assertIndexExists() crash when non-index constraint exists on ↵Mariusz Felisiak
the same columns. Backport of 8b84364d469e394d9f04b4f96a7da1fc16d93fce from main
2025-09-26[6.0.x] Fixed #36491 -- Fixed crash in ParallelTestRunner with --buffer.Shubham Singh
Thanks Javier Buzzi and Adam Johnson for reviews. Co-authored-by: Simon Charette <charette.s@gmail.com> Backport of be581ff473e8ade6365975db2df602f295a4cb4b from main.
2025-09-25[6.0.x] Fixed #36434 -- Preserved unbuffered stdio (-u) in autoreloader child.SaJH
Signed-off-by: SaJH <wogur981208@gmail.com> Backport of 68aae8878ff90dd787db55ecc44ee712525ccdc6 from main.
2025-09-23[6.0.x] Fixed #36543 -- Fixed time formats for fr_CA.Mridul Dhall
Thanks Chris Anderson for the report. Backport of b67a36ec6f5895f3fa6147264bae55cb014fa2a7 from main.
2025-09-23[6.0.x] Fixed #36264 -- Excluded proxy neighbors of parents from deletion ↵saJaeHyukc
collection when keep_parents=True. Signed-off-by: saJaeHyukc <wogur981208@gmail.com> Backport of 748551fea0b4e37231203a063356572a47e09efb from main.
2025-09-22[6.0.x] Fixed #35453 -- Made ManyToManyField.concrete False.Ryan P Kilby
ManyToManyField was already excluded from fields, concrete_fields, and local_concrete_fields in Options. Backport of f9a44cc0fac653f8e0c2ab1cdfb12b2cc5c63fc2 from main
generated by cgit v1.3 (git 2.53.0) at 2026-07-05 14:28:51 +0000