| Age | Commit message (Collapse) | Author |
|
|
|
|
|
This is a security fix. Disclosure and advisory coming shortly.
|
|
This is a security fix. Disclosure and advisory coming shortly.
Patch by Russell Keith-Magee.
|
|
entity-expansion DoS attacks.
This is a security fix. Disclosure and advisory coming shortly.
|
|
This is a security fix; disclosure and advisory coming shortly.
|
|
from IntegerField to AutoField.
Thanks Keryn Knight.
Backport of 218bbef0c4 from master
|
|
Thanks diegueus9 for the report and itsallvoodoo for the draft patch.
Backport of 7a80904b00 from master
|
|
Backport of 976dc07baf from master
|
|
Thanks pedro.calcao@ for the report.
|
|
The reason was that the except clause needed to remove a connection
from the django.db.connections dict, but other parts of Django do not
expect this to happen. In addition the except clause was silently
swallowing the exception messages.
Refs #19707, special thanks to Carl Meyer for pointing out that this
approach should be taken.
|
|
Partial backport of 3abf6105b6 from master. Refs #19042.
|
|
The change in f105fbe52b21da206bfbaedf0e92326667d7b2d4 made through=None
m2m fields fail in cases where they worked before. It isn't possible to
create such fields using public APIs. The fix is trivial, so it seems
worth fixing this for custom m2m field users.
This is not a backport from master. Master has gotten enough other
changes to related fields internal API that this fix alone isn't enough
to do any good.
|
|
Backpatch of a4e97cf315142e61bb4bc3ed8259b95d8586d09c.
|
|
Backpatch of f556df90be995a83b979cf875705d98521ab4dc7. Backpatching
these tests so that it will be easier to backpatch the fix for #19707.
|
|
and markup.
Backport of 43efefae69 from master
|
|
Thanks matf at op.pl for the report.
|
|
This test was randomly failing depending on the library environment.
Backport of a1c470a6f from master.
|
|
passwords
Thanks apreobrazhensky at gmail.com for the report.
Backport of 63d6a50dd from master.
|
|
Thanks rodrigorosa.lg and others for the report.
Backport of 99315f709e from master
|
|
Thanks Sam Lai for mentioning this on the mailing list.
Backport of 227bd3f8db from master
|
|
Thanks Mike O'Connor for the report.
Backport of 52a2588df6 from master
|
|
abd0f304b162b3120b1c7321fbfc3090e5f3c92c from master.
|
|
to Bradley Ayers for the patch.
Backport of f5a9e5e9 from master
|
|
Backport of 1eb0da1c5ba3096f218d1df13d02a2b8e1ac7a36 from master.
|
|
|
|
Full disclosure and new release forthcoming.
|
|
malicious users.
|
|
Backport of c196e01100b2
|
|
can be displayed as selected even if the lookup's first element is not a string.
Backport of 88e17156393b
|
|
Backpatch of dc569c880143db07e01b3293d698ad8fe4a0136f
|
|
Refs #18823.
|
|
SQLite used INSERT INTO tbl SELECT %s UNION SELECT %s, the problem
was that there should have been UNION ALL instead of UNION.
Refs #19351
Backpatch of a27582484cf814554907d2d1ad077852de36963f
|
|
Thanks tome for the suggestion and patch.
Backport of 3587991ba8 from master
|
|
thanks to Brent O'Connor for the idea and intial docs
|
|
Backport of a32f30c79c1be8e088917bced0f97760a92045ef from master
|
|
documented the value_from_datadict method.
Backport of 04775b4598 from master
|
|
The problem is the same as in #10888 which was reintroduced when
bulk_insert was added. Thanks to Jani Tiainen for report, patch and
also testing the final patch on Oracle GIS.
Backpatch of 92d7f541da8b59520c833b19fbba52d3ecef2428
|
|
Backport of 17b14d4819 from master
|
|
Thanks SunPowered for the report.
|
|
Thanks Graham Dumpleton for the patch.
Backport of bc00075 from master.
|
|
Thanks bernardofontes for the report.
Backport of b774c5993 from master.
|
|
There was a potential data-loss issue involved -- when clearing
instance's m2m assignments it was possible some other instance's
m2m data was deleted instead.
This commit also improved None handling for to_field cases.
Backpatch of 611c4d6f1c24763e5e6e331a5dcf9b610288aaa8
|
|
adroffne for the suggestion.
Backport of da958eb209 from master
|
|
The problem description in #18239 asserted that
http://bugs.python.org/issue670664 was fixed in Python 2.6.8, but based on
http://bugs.python.org/issue670664#msg146770 it appears that's not correct; the
fix was only applied in 2.7, 3.2, and Python trunk. Therefore we must use our
patched HTMLParser subclass in all Python 2.6 versions.
Backport of fcec904e4f from master. Fixes #19148.
|
|
|
|
driver caching; thanks jtiai for the suggestion.
Backport of 2f722d9728 from master
|
|
|
|
Backport of eed4faf16f from master
|
|
methods need to handle None if the field may be null.
Backport of 4cef9a09f9 from master
|