summaryrefslogtreecommitdiff
path: root/django
AgeCommit message (Collapse)Author
19 hoursFixed #37075 -- Allowed overriding the PostgreSQL pool's "check" callable.HEADmainRaoni Timo
Setting "check" in OPTIONS["pool"] previously raised TypeError because the PostgreSQL backend always passed check= to ConnectionPool() and unpacked **pool_options on top, regardless of CONN_HEALTH_CHECKS. The user's callable now takes precedence via setdefault(); pool_options is copied first to avoid mutating the user's settings dict.
31 hoursFixed #36919 -- Allowed Task and TaskResult to be pickled.varunkasyap
2 daysFixed #16429 -- Extracted set_choices() method from FilePathField.__init__().TildaDares
2 daysFixed #37067 -- Added trailing slash in django_file_prefixes().Fashad Ahmed
Ensure skip_file_prefixes does not match sibling packages like django*. Bug in f42b89f1bf49a5b89ed852b60f79342320a81c5e and 34bd3ed944bf38792c631b55e581963d44d52284.
2 daysFixed #35951 -- Mentioned server timezone in admin DateTime widgets.Vedran Karacic
The existing note that is shown to the users when entering a time value from a different timezone than the server's timezone was not descriptive enough and led to confusion. This commit updates the note to explicitly state that the user should enter times in the server's timezone.
3 daysRefs #15759 -- Fixed ModelAdmin.list_editable form submission for ↵Artyom Kotovskiy
non-editable instances. Added formset that excludes objects for which user has no permission for POST formset as well. Fixed regression test: the test was not simulating real behaviour properly. By providing full form data for the post request we skipped the part where the user was actually limited in permissions and only modified some of the rows. Improved tests by getting rid of obj.id % 2 approach for granting permissions per object for users, since it is not the safest. Instead granting permissions simply by 'alive' parameter, which is simpler and more stable. Bug in 84db026228413dda4cd195464554d51c0b208e32.
3 daysFixed #36990 -- Bumped OpenLayers to 10.9.0.VIZZARD-X
3 daysFixed #35738 -- Deprecated double-dot variable lookups.David Smith
3 daysFixed #36912 -- Added connector validation to Q.create().Anna Makarudze
Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
4 daysRefs #35514 -- Added warn_about_external_use() deprecation utility.Mike Edmunds
Implemented a new `warn_about_external_use()` helper to conditionally issue warnings depending on whether a deprecated feature is used from within Django. Fixed `LazySettings._show_deprecation_warning()` (Refs #26029) to work correctly when called from anywhere in `LazySettings`. Previously, it assumed a specific code path through `LazyObject.__getattribute__()` and an `@property` getter on `LazySettings`.
4 daysFixed #36901 -- Centralized auth timing attack mitigations.afenoum
Thank you Mar Bartolome and Tim Schilling for reviews.
7 daysFixed #36542 -- Marked authenticate() with @sensitive_variables() decorator.KANIN KEARPIMY
Thanks Olivier Dalang, Tim McCurrach, Sarah Boyce, and Mar Bartolome for reviews.
9 daysFixed #10919 -- Added delete_confirmation_max_display to ModelAdmin.Rodrigo Vieira
The new ModelAdmin.delete_confirmation_max_display attribute allows limiting the number of related objects shown on the delete confirmation page. When the limit is reached, a "…and N more objects." message is shown. The feature relies on a new truncated_unordered_list template filter added to django.contrib.admin.templatetags.admin_filters. Thanks Jacob Tyler Walls for the review and guidance, Tobias McNulty for the report, and terminator14 for the solution suggested.
9 daysRefs #10919 -- Refactored walk_items as module-level _walk_items and added ↵Rodrigo Vieira
truncated_unordered_list filter.
9 daysFixed #37057 -- Adjusted UniqueConstraint handling of UNKNOWN condition.Simon Charette
When we adjusted UNKNOWN handling for CheckConstraint in refs #33996 we assumed that all usage of Q.check would benefit from this approach. However while CHECK constraints enforcement do ignore conditions involving NULL that resolve to UNKNOWN it's not the case for other type of constraints such as UNIQUE ones. Given how UNKNOWN should be treated depends on the callers context it appears that a better strategy for COALESCE wrapping is to force them to apply it if necessary. Thanks Drew Shapiro for the report.
9 daysFixed #35870 -- Made blank choice label in forms more accessible.Annabelle Wiegart
Added new constant django.db.models.fields.BLANK_CHOICE_LABEL for an accessible and translatable blank choice label in forms. Deprecated django.db.models.fields.BLANK_CHOICE_DASH constant. Added the immediately deprecated transitional setting USE_BLANK_CHOICE_DASH. Co-Authored-By: Marijke Luttekes <mail@marijkeluttekes.dev>
9 daysFixed #36991 -- Raised BadRequest for invalid encodings in Content-Type headers.Dinesh
9 daysFixed #35943 -- Replaced unload event listener with pagehide.Amar
Co-authored-by: Peter van der Does <peter@oneilinteractive.com> Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
9 daysFixed #15759 -- Excluded fields by per-object permissions for ↵Artyom Kotovskiy
ModelAdmin.list_editable. Instead of going over all objects in a queryset and filtering by user permissions, added skipping while saving the formset so there is no need to refetch objects again.
9 daysRefs #15759 -- Factored out _save_formset() in ModelAdmin.Artyom Kotovskiy
11 daysRefs #36005 -- Made OperationCategory subclass StrEnum.Clifford Gama
12 daysRefs #28586 -- Added DEFAULT_FETCH_MODE module constant.Jacob Walls
This is a more attractive target for alteration than all of QuerySet.__init__().
12 daysFormatted JavaScript files.Tom Carrick
12 daysAdded support for nested fields to XML deserializer.Tim Graham
Needed by Django MongoDB Backend's EmbeddedModelField.
12 daysFixed #37047 -- Fixed crash in Query.orderby_issubset_groupby for descending ↵Anže Pečar
and random order_by strings. Run this example: ```python User.objects.values("is_staff").annotate(latest=Max("date_joined")).order_by("-latest").count() ``` You should see the following exception: ``` django.core.exceptions.FieldError: Cannot resolve keyword '-latest' into field. ``` Regression in 2ce5cb0f7a4618dfdc5f5c10e53e2e9b9543d298.
13 daysRemoved OrderedDict representer from PyYAML serializer.Tim Graham
Added in 5bc3123479bd97dc9d8a36fa9a3421a71063d1da (refs #24558), it was obsoleted when OrderedDict usage was removed in 24b82cd201e21060fbc02117dc16d1702877a1f3 (refs #30159).
13 daysFixed #37024 -- Made SITE_ID system check validation use Site._meta.pk.Tim Graham
13 daysRefs #36986 -- Replaced yaml's Serializer._value_from_field() time handling ↵Tim Graham
with a representer.
13 daysReplaced yaml serializer workaround to preserve dict order with PyYAML's ↵Tim Graham
sort_keys=False. The sort_keys parameter was added in PyYAML 5.1 (released March 2019). The workaround was added in 24b82cd201e21060fbc02117dc16d1702877a1f3 (refs #30159).
13 daysFixed #37036 -- Added missing flat=True arg in DeferredAttribute.fetch_many().garybadwal
13 daysFormatted CSS files.Tom Carrick
14 daysFixed #37028 -- Added BitAnd(), BitOr(), and BitXor() aggregates.Mariusz Felisiak
2026-04-16Added DatabaseFeatures.disallowed_simple_test_case_connection_methods.Tim Graham
2026-04-14Fixed #27150 -- Made base File objects truthy by default.VIZZARD-X
2026-04-14Fixed #37029 -- Corrected placement of </div> in change_list.html's ↵Tim Graham
pagination block. Bug in 3f59711581bd22ebd0f13fb040b15b69c0eee21f.
2026-04-08Refs #35440 -- Optimized parse_header_parameters() for the simplest case.Pravin Kamble
Added a fast-path to parse_header_parameters Benchmark results (50,000 iterations): - Simple headers: ~73% improvement Thanks Nick Pope (@ngnpope) for the review.
2026-04-08Removed PY38 and PY39 version constants.Jacob Walls
As the oldest supported version is Django 5.2, we only need constants for PY310+.
2026-04-07Fixed #37021 -- Added Permission.user_perm_str property.mariatta
For use in checking user permissions via has_perm(). Co-authored-by: 사재혁 <jaehyuck.sa.dev@gmail.com>
2026-04-07Fixed #36816 -- Allowed **kwargs in @task decorator.Nilesh Kumar Pahari
The decorator was updated to accept **kwargs and forward them to task_class, allowing additional parameters to be passed to custom Task subclasses.
2026-04-07Fixed CVE-2026-33034 -- Enforced DATA_UPLOAD_MAX_MEMORY_SIZE on body size in ↵Natalia
ASGI requests. The `body` property in `HttpRequest` checks DATA_UPLOAD_MAX_MEMORY_SIZE against the declared `Content-Length` header before reading. On the ASGI path, chunked requests carry no `Content-Length`, so the check evaluated to 0 and always passed regardless of the actual body size. This work adds a new check on the actual number of bytes consumed. Thanks to Superior for the report, and to Jake Howard and Jacob Walls for reviews.
2026-04-07Fixed CVE-2026-33033 -- Mitigated potential DoS in MultiPartParser.Natalia
When a multipart file part used `Content-Transfer-Encoding: base64` and the non-whitespace base64 bytes did not align to a multiple of 4 within a chunk, the parser entered a loop calling `field_stream.read(1-3)` once per whitespace byte. Each such call fetched the entire internal buffer, sliced off 1-3 bytes, and pushed the remainder back via unget(), doing an O(n) memory copy per call. A 2.5 MB payload of mostly whitespace produced CPU amplification relative to a normal upload of the same size. The alignment loop now reads `self._chunk_size` bytes at a time, and accumulates stripped parts in a list joined once at the end. Thanks to Seokchan Yoon for the report and the fixing patch.
2026-04-07Fixed CVE-2026-4292 -- Disallowed instance creation via ↵Jacob Walls
ModelAdmin.list_editable. Thanks Natalia Bidart, Jake Howard, and Markus Holtermann for reviews.
2026-04-07Fixed CVE-2026-4277 -- Checked add permissions in GenericInlineModelAdmin.Jacob Walls
Edit permissions were still checked as part of ordinary form validation, but because GenericInlineModelAdmin overrides get_formset(), it lacked InlineModelAdmin's dynamic DeleteProtectedModelForm.has_changed() logic for checking permissions server-side, leaving the add case unaddressed. This change reimplements the relevant part of InlineModelAdmin.get_formset(). Thanks N05ec@LZU-DSLab for the report, and Natalia Bidart, Markus Holtermann, and Simon Charette for reviews.
2026-04-07Fixed CVE-2026-3902 -- Ignored headers with underscores in ASGIRequest.Jacob Walls
Thanks Tarek Nakkouch for the report and Jake Howard and Natalia Bidart for reviews.
2026-04-06Fixed #37023 -- Made XML serializer put each ManyToManyField object on its ↵Tim Graham
own line.
2026-04-06Refs #37023 -- Removed hardcoded indent levels from XML serializer.Tim Graham
This facilitates nested fields and objects.
2026-04-06Fixed #37009 -- Fixed alignment of "Show/Hide counts" icons in admin changelist.kyb
2026-04-03Fixed #37016 -- Avoided propagating invalid arguments from When() to Q().varunkasyap
2026-04-02Fixed #36973 -- Made fields.E348 check detect further clashes between ↵Clifford Gama
managers and related_names. Clashes were only detected for self-referential relationships, i.e. ForeignKey("self"). Refs #22977. Bug in 6888375c53476011754f778deabc6cdbfa327011. Thanks JaeHyuckSa for the thorough review!
2026-04-02Fixed #20024 -- Fixed handling of __in lookups with None in exclude().Eddy Adegnandjou
Thanks Simon Charette and Tim Graham for reviews, and Jason Hall for a prior iteration.
generated by cgit v1.3 (git 2.53.0) at 2026-05-01 19:00:26 +0000