| Age | Commit message (Collapse) | Author |
|---|
|
Thank you to Mike Edmunds for the review.
|
|
Thank you to James Bligh and Tim Schilling for the reviews.
|
|
database-level on_delete.
|
|
|
|
Co-authored-by: David Smith <39445562+smithdc1@users.noreply.github.com>
|
|
|
|
Updated widget templates to render the `hidden` attribute if the input_type
is set to "hidden".
|
|
|
|
|
|
Applying a transform to an annotation alias in values() crashed with
AttributeError when the annotation's output_field was not attached to a
model:
Book.objects.annotate(published=TruncMonth("pubdate")).values("published__year")
AttributeError: 'DateField' object has no attribute 'model'
Thanks David Smith for offering a useful test case during triage.
Co-authored-by: ontowhee <82607723+ontowhee@users.noreply.github.com>
Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
|
|
|
|
This change implements DEP 16: to rename the django-admin command to django.
django-admin is kept as an alias.
Docs references to the "django-admin" command are updated to "django" or
“The django command”.
Renamed the `django-admin` Sphinx directive to `cmd`, and the
`django-admin-option` directive to `cli-option`.
Thanks Johannes Maron, Mike Edmunds, and Jacob Walls for reviews.
|
|
The distapp, geoapp, geogapp, and relatedapp test apps each shipped a
fixture named "initial". Since loaddata loads every match found in
different fixture directories, each test case using fixtures=["initial"]
loaded all four fixtures when the full gis_tests suite ran.
|
|
The adapter for psycopg2 serialized None to SQL NULL [1]. This behavior
should be maintained for psycopg3, as psql_escape returns None when no
value remain after escaping and stripping.
Thanks to Camille Daniel for the initial bug report.
[1] https://github.com/psycopg/psycopg2/blob/7d0375492ec3707b82b89f632c9654b400466d86/psycopg/adapter_asis.c#L42-L45
|
|
GDAL 3.9+.
Anything instantating `SpatialReference`, including vector and raster
`transform()` methods and `srs`/`srid` setters, was subject to request
forgery from untrusted strings, since GDAL resolves file and network
references by default.
On GDAL 3.9+, Django now uses `OSRSetFromUserInputEx()` to block file
and network access in this path. On lower GDAL versions, users should
compare inputs to an allow list or use integers when setting or
transforming a spatial reference system (SRS). A new `gis.W001` check
warns if a lower GDAL version is installed.
Thanks Adraca for the report and Sarah Boyce and David Smith for reviews.
|
|
users with custom user models.
Since Django 6.0, the admin obfuscated the password hash only when the
field's model was exactly AUTH_USER_MODEL. Other user models, and user
models inheriting the password field from a concrete parent model,
failed that check, so the full hash was displayed to users with only
the view permission.
Thanks to Aaron chen for the report, and Jake Howard for the review.
|
|
response cache.
When learning the cache key for a response, a missing header must be
cached differently to an empty one, as per RFC 9111.
Thanks to Andrew Gonzalez for the report.
Co-authored-by: Jake Howard <git@theorangeone.net>
|
|
Even though the "crs" member was removed from the GeoJSON spec in 2016,
GDAL's GeoJSON parser still supports this value and can resolve file and
network locations. An attacker could submit a malicious CRS that would
make a network request as the Django process user, or read a file, or
both. Django now rejects these values when constructing geometries and
in forms and lookups. (Utilities for processing trusted data such as
`DataSource` and `LayerMapping` continue to forward these values to GDAL
without validation.)
Any `crs` definition with `"type": "link"` or `"type": "url"` is now
rejected outright. Any definition with `"type": "name"` has its
`properties.name` compared to an allow list of known authorities, or a
regex for an OGC CRS URN, or well-known shorthands, e.g. "CRS84".
Thanks to Submersion Security Research Team for the report, and David
Smith and Sarah Boyce for the reviews.
|
|
BaseGeometryWidget.deserialize().
Suitably crafted values submitted to a GeometryField may have allowed
log injection, potentially corrupting log files, obscuring other
attacks, misleading log post-processing tools, or forging log entries.
To mitigate this, invalid values logged on deserialization errors are
now escaped using "unicode_escape" encoding, and trimmed to 4096
characters to avoid flooding logs with large inputs.
Thanks to Aaron chen for the report, and to Jacob Walls, Jake Howard,
and Shai Berger for the reviews.
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
|
|
MultiPartParser.
The mitigation for CVE-2026-33033 aligned base64 data to a multiple of
4 by reading whole chunks. As the chunk size is itself a multiple of 4,
those reads never restored the alignment, so a misaligned upload was
read and decoded in full before reaching upload handlers.
Trailing undecoded bytes are now carried over to the next chunk, so no
extra reads are needed and memory use stays bounded by the chunk size.
Thanks to Ignacy Kujawa for the report, and Jake Howard for the review.
|
|
If a deferred field has been plucked via `refresh_from_db(fields=...)`
or modified by assigning an attribute, it shouldn't be overwritten when
attribute access on a peer triggers a `fetch_many()`.
The peer fetching should also tolerate deleted instances.
Co-authored-by: Vishy <vishyzero@gmail.com>
|
|
prefixes.
|
|
Regression in 0eec2a163a4b2ea4e82c53ae1d7b71bf43ac911d.
|
|
Thank you Mike Edmunds for the review.
|
|
|
|
disable multiline template tags.
Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
|
|
Co-authored-by: tim-mccurrach <34194722+tim-mccurrach@users.noreply.github.com>
|
|
|
|
JoinPromoter didn't handle XOR conditions. Because of this, a negated
XOR could use an INNER JOIN and remove rows that should be returned.
Thanks Simon Charette and Sarah Boyce for review.
|
|
QUERY (RFC 10008) is a safe, idempotent method that carries the query in
the request content rather than in the URI's query component. Treat it as
safe throughout: exempt it from CSRF protection, evaluate request
preconditions as for GET, accept it in require_safe(), and dispatch it
from View. Query content is available as HttpRequest.body and is not
parsed into HttpRequest.POST.
Caching is left for a follow-up. Per RFC 10008 Section 2.7 the cache key
for a QUERY request must incorporate the request content, which the cache
middleware and cache_page() don't do, so they continue to ignore QUERY.
Thanks Ben Atkinson, Jonathan Biemond, and Jacob Walls for reviews.
|
|
Regression in 1a9fba7a6c2a0acead19bbb45c25ceb0fdcca7c8.
|
|
Generic relation managers eagerly bound querysets to a read database,
causing implicit subqueries to fail when the outer query used another
connection.
Passed the related instance as a routing hint while preserving explicit
database choices, and added a regression test for the reported case.
Thank you to Simon Charette for the review.
|
|
|
|
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
|
|
functools.cached_property.
Since Python 3.12, `functools.cached_property` no longer takes a lock
(https://github.com/python/cpython/issues/87634), which was the main
objection to using it instead of Django's own implementation.
`Prefetch(to_attr=...)` and the admindocs model detail page now accept
`functools.cached_property` as well as Django's own `cached_property`.
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
|
|
MySQL 9.5 added support for the "crs" attribute in GeoJSON:
https://dev.mysql.com/doc/relnotes/mysql/9.7/en/news-9-5-0.html#:~:text=ST_AsGeoJSON%20function
|
|
Before, if a directive's only source was a nonce, and that nonce was not rendered,
the directive was omitted, when in reality we should consider the set of scripts
matching the nonce to be empty, and instead fail closed.
Thanks Rob Hudson for the implementation idea and review.
|
|
Python 3.15 added the `parent_mode` argument to `os.makedirs()`, the
upstream fix for the issue that led Django to vendor its own
`makedirs()` in the fix for CVE-2026-25674. The vendored copy differed
from CPython only by an extra `chmod()` call that ignored the process
umask. Dropping that call allows using `os.makedirs()` directly on
Python 3.15+, and removing the vendored copy once Python 3.14 support
ends.
As a trade-off, directories created by `FileSystemStorage` when
`FILE_UPLOAD_DIRECTORY_PERMISSIONS` (or `directory_permissions_mode`) is
set, and by `FileBasedCache`, now have the requested permissions mode
combined with the process umask, and the set-group-ID bit and other
bits beyond the last 9 are no longer guaranteed to be set.
`FILE_UPLOAD_PERMISSIONS` is unaffected.
Thanks Shai Berger for the proposal and review, Ken Whitesell and
Carlton Gibson for the discussion, and Tim Schilling, Jacob Walls, and
Lily for reviews.
Refs #36664.
|
|
Database error messages can include the values being validated, which
may originate from user input. Logging them through `log_message()`
escapes their content and keeps large values trimmed, consistent with
other logging call sites.
Thanks Jacob Walls for reviews.
|
|
The debug page and the raster lookup check each trimmed large values
to 4096 characters with their own copy of the same code. The shared
helper also corrects the suffix, which reported characters as bytes
and showed the original length as if it were the amount trimmed.
The trimmed value and the suffix are returned separately so callers
can escape the value without escaping the suffix.
Refs #34746.
|
|
test_release_memory_without_garbage_collection().
gc.collect() doesn't actually clear gc.garbage.
|
|
Chocolatey's gettext bin directory wasn't on PATH for later steps, so
tests requiring msgfmt and xgettext were skipped on Windows.
Skipped PoFileTests.test_no_write_access on Windows, where chmod()
cannot make a directory read-only.
|
|
Thank you Michael Codispoti (codispoti) for the report. Thank you to
Jake Howard, Jacob Walls and Rob Hudson for the reviews.
|
|
|
|
|
|
|
|
|
|
Removed a builder-specific optimization from ConsoleDirective. This
fixes a bug where building with shared doctrees (as docs/Makefile does)
could result in different output depending on the order of builds. The
optimization did not noticeably impact Sphinx build time.
This also resolves a RemovedInSphinx11Warning in ConsoleDirective.run()
that "'sphinx.environment.BuildEnvironment.app' is deprecated."
Thanks to @nessita for review (and for identifying this as a bug, not
just a Sphinx deprecation).
|
|
Added test cases for djangodocs extension features that weren't yet
tested. Added a `build_sphinx()` helper in `SimpleSphinxTestCase` that
runs Sphinx on given source text and captures the results.
Bumped minimum Sphinx version to 7.3.0, which is where `SphinxTestApp`
gained the `verbosity` argument used by `build_sphinx()`.
Thanks to @nessita for review and improvements.
|
|
|
