From 5737c57d95cc8c17b1aa2da4809f70ad4c212716 Mon Sep 17 00:00:00 2001 From: Tim Graham Date: Fri, 9 Aug 2013 16:02:05 -0400 Subject: Fixed #20868 -- Added an email to django-announce as a security step. Thanks garrison for the report. --- docs/internals/security.txt | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'docs/internals') diff --git a/docs/internals/security.txt b/docs/internals/security.txt index 486b2c9968..327a6a5f60 100644 --- a/docs/internals/security.txt +++ b/docs/internals/security.txt @@ -108,8 +108,12 @@ On the day of disclosure, we will take the following steps: relevant patches and new releases, and crediting the reporter of the issue (if the reporter wishes to be publicly identified). +4. Post a notice to the `django-announce`_ mailing list that links to the blog + post. + .. _the Python Package Index: http://pypi.python.org/pypi .. _the official Django development blog: https://www.djangoproject.com/weblog/ +.. _django-announce: http://groups.google.com/group/django-announce If a reported issue is believed to be particularly time-sensitive -- due to a known exploit in the wild, for example -- the time between @@ -214,4 +218,4 @@ If you are added to the notification list, security-related emails will be sent to you by Django's release manager, and all notification emails will be signed with the same key used to sign Django releases; that key has the ID ``0x3684C0C08C8B2AE1``, and is available from most -commonly-used keyservers. \ No newline at end of file +commonly-used keyservers. -- cgit v1.3 From e868eaf680a3d7acfcd3c76743bb248d29ac7b60 Mon Sep 17 00:00:00 2001 From: Daniele Procida Date: Sat, 10 Aug 2013 22:24:24 +0100 Subject: clarified misleading wording about squashing commits --- docs/internals/contributing/writing-code/working-with-git.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'docs/internals') diff --git a/docs/internals/contributing/writing-code/working-with-git.txt b/docs/internals/contributing/writing-code/working-with-git.txt index dcfdd9e85b..32fc459e70 100644 --- a/docs/internals/contributing/writing-code/working-with-git.txt +++ b/docs/internals/contributing/writing-code/working-with-git.txt @@ -157,7 +157,7 @@ using interactive rebase:: The HEAD~2 above is shorthand for two latest commits. The above command will open an editor showing the two commits, prefixed with the word "pick". -Change the second line to "squash" instead. This will keep the +Change "pick" on the second line to "squash" instead. This will keep the first commit, and squash the second commit into the first one. Save and quit the editor. A second editor window should open, so you can reword the commit message for the commit now that it includes both your steps. -- cgit v1.3 From 354009d67eb56301457ec26c1c847af5fdfc083b Mon Sep 17 00:00:00 2001 From: Alasdair Nicol Date: Thu, 15 Aug 2013 00:27:16 +0100 Subject: Updated docs following deprecation of django.views.defaults.shortcut Follows 3f2befc --- docs/internals/deprecation.txt | 13 +++++-------- docs/ref/contrib/sites.txt | 7 ++++--- 2 files changed, 9 insertions(+), 11 deletions(-) (limited to 'docs/internals') diff --git a/docs/internals/deprecation.txt b/docs/internals/deprecation.txt index fe8b48a5a9..29e9231896 100644 --- a/docs/internals/deprecation.txt +++ b/docs/internals/deprecation.txt @@ -370,8 +370,11 @@ these changes. * Remove the backward compatible shims introduced to rename the attributes ``ChangeList.root_query_set`` and ``ChangeList.query_set``. -* ``django.conf.urls.shortcut`` and ``django.views.defaults.shortcut`` will be - removed. +* ``django.views.defaults.shortcut`` will be removed, as part of the + goal of removing all ``django.contrib`` references from the core + Django codebase. Instead use + ``django.contrib.contenttypes.views.shortcut``. ``django.conf.urls.shortcut`` + will also be removed. * Support for the Python Imaging Library (PIL) module will be removed, as it no longer appears to be actively maintained & does not work on Python 3. @@ -431,11 +434,5 @@ these changes. 2.0 --- -* ``django.views.defaults.shortcut()``. This function has been moved - to ``django.contrib.contenttypes.views.shortcut()`` as part of the - goal of removing all ``django.contrib`` references from the core - Django codebase. The old shortcut will be removed in the 2.0 - release. - * ``ssi`` and ``url`` template tags will be removed from the ``future`` template tag library (used during the 1.3/1.4 deprecation period). diff --git a/docs/ref/contrib/sites.txt b/docs/ref/contrib/sites.txt index 65838dfa3e..131c9645e8 100644 --- a/docs/ref/contrib/sites.txt +++ b/docs/ref/contrib/sites.txt @@ -417,9 +417,10 @@ Here's how Django uses the sites framework: :class:`~django.contrib.sites.models.Site` name to the template as ``{{ site_name }}``. -* The shortcut view (``django.views.defaults.shortcut``) uses the domain - of the current :class:`~django.contrib.sites.models.Site` object when - calculating an object's URL. +* The shortcut view (``django.contrib.contenttypes.views.shortcut``) + uses the domain of the current + :class:`~django.contrib.sites.models.Site` object when calculating + an object's URL. * In the admin framework, the "view on site" link uses the current :class:`~django.contrib.sites.models.Site` to work out the domain for the -- cgit v1.3 From c2907a6e3d96315027f7313885f3d0212dd19cbe Mon Sep 17 00:00:00 2001 From: Carl Meyer Date: Fri, 16 Aug 2013 23:55:43 -0600 Subject: Remove the last FIXME from the howto-release-Django doc. --- docs/internals/howto-release-django.txt | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) (limited to 'docs/internals') diff --git a/docs/internals/howto-release-django.txt b/docs/internals/howto-release-django.txt index 5bda2e8add..a926de27ab 100644 --- a/docs/internals/howto-release-django.txt +++ b/docs/internals/howto-release-django.txt @@ -83,10 +83,11 @@ A few items need to be taken care of before even beginning the release process. This stuff starts about a week before the release; most of it can be done any time leading up to the actual release: -#. If this is a security release, send out pre-notification **one week** - before the release. We maintain a list of who gets these pre-notification - emails at *FIXME WHERE?*. This email should be signed by the key you'll use - for the release, and should include patches for each issue being fixed. +#. If this is a security release, send out pre-notification **one week** before + the release. We maintain a list of who gets these pre-notification emails in + the private ``django-core`` repository. This email should be signed by the + key you'll use for the release, and should include patches for each issue + being fixed. #. As the release approaches, watch Trac to make sure no release blockers are left for the upcoming release. -- cgit v1.3