django.git - django

Age	Commit message (Collapse)	Author
9 days	Fixed #36991 -- Raised BadRequest for invalid encodings in Content-Type headers.	Dinesh

2026-04-07	Fixed CVE-2026-33033 -- Mitigated potential DoS in MultiPartParser.	Natalia
	When a multipart file part used `Content-Transfer-Encoding: base64` and the non-whitespace base64 bytes did not align to a multiple of 4 within a chunk, the parser entered a loop calling `field_stream.read(1-3)` once per whitespace byte. Each such call fetched the entire internal buffer, sliced off 1-3 bytes, and pushed the remainder back via unget(), doing an O(n) memory copy per call. A 2.5 MB payload of mostly whitespace produced CPU amplification relative to a normal upload of the same size. The alignment loop now reads `self._chunk_size` bytes at a time, and accumulates stripped parts in a list joined once at the end. Thanks to Seokchan Yoon for the report and the fixing patch.
2026-02-24	Fixed #36931 -- Handled LookupError in multipart parser for invalid RFC 2231 ↵	sammiee5311
	encoding. Added LookupError to the except clause so invalid headers are silently skipped, consistent with other malformed header handling.
2026-02-10	Fixed #36841 -- Made multipart parser class pluggable on HttpRequest.	farhan

2025-08-28	Refs #36520 -- Ensured only the header value is passed to ↵	Jake Howard
	parse_header_parameters for multipart requests. Header parsing should apply only to the header value. The previous implementation happened to work but relied on unintended behavior.
2025-07-23	Refs #36500 -- Rewrapped long docstrings and block comments via a script.	django-bot
	Rewrapped long docstrings and block comments to 79 characters + newline using script from https://github.com/medmunds/autofix-w505.
2025-06-16	Fixed #36447 -- Selected preferred media type based on quality.	Jake Howard
	When matching which entry in the `Accept` header should be used for a given media type, the specificity matters. However once those are resolved, only the quality matters when selecting preference. Regression in c075508b4de8edf9db553b409f8a8ed2f26ecead. Thank you to Anders Kaseorg for the report.
2025-06-09	Fixed #36446 -- Restored "q" in internal MediaType.params property.	Natalia
	The "q" key was removed while addressing ticket #36411. Despite `MediaType.params` is undocumented and considered internal, it was used in third-party projects (Zulip reported breakage), so this work restored the `q` key in `params`. Thanks Anders Kaseorg for the report. Regression in c075508b4de8edf9db553b409f8a8ed2f26ecead.
2025-06-03	Fixed #36411 -- Made HttpRequest.get_preferred_type() consider media type ↵	Jake Howard
	parameters. HttpRequest.get_preferred_type() did not account for parameters in Accept header media types (e.g., "text/vcard; version=3.0"). This caused incorrect content negotiation when multiple types differed only by parameters, reducing specificity as per RFC 7231 section 5.3.2 (https://datatracker.ietf.org/doc/html/rfc7231.html#section-5.3.2). This fix updates get_preferred_type() to treat media types with parameters as distinct, allowing more precise and standards-compliant matching. Thanks to magicfelix for the report, and to David Sanders and Sarah Boyce for the reviews.
2025-05-13	Fixed #36332 -- Corrected HttpRequest.get_full_path() and ↵	Aleksandr Safonov
	HttpRequest.get_full_path_info() examples.
2024-09-09	Fixed #35631 -- Added HttpRequest.get_preferred_type().	Jake Howard

2024-01-26	Applied Black's 2024 stable style.	Mariusz Felisiak
	https://github.com/psf/black/releases/tag/24.1.0
2023-11-28	Refs #21442 -- Increased test coverage of requests.	David Smith

2023-11-24	Fixed #34968 -- Made multipart parsing of headers raise an error on too long ↵	Standa Opichal
	headers. This also allow customizing the maximum size of headers via MAX_TOTAL_HEADER_SIZE.
2023-08-25	Fixed #34709 -- Raised BadRequest for non-UTF-8 requests with the ↵	Mariusz Felisiak
	application/x-www-form-urlencoded content type. Thanks Eki Xu for the report.
2023-08-02	Added more tests for django.http.request.split_domain_port().	Nick Pope

2023-06-07	Added MultiPartParser tests for parsing base64-encoded fields.	benebsiny

2023-04-12	Fixed #34484, Refs #34482 -- Reverted "Fixed #29186 -- Fixed pickling ↵	Mariusz Felisiak
	HttpRequest and subclasses." This reverts commit 6220c445c40a6a7f4d442de8bde2628346153963. Thanks Adam Johnson and Márton Salomváry for reports.
2023-02-14	Fixed CVE-2023-24580 -- Prevented DoS with too many uploaded files.	Markus Holtermann
	Thanks to Jakob Ackermann for the report.
2023-01-07	Renamed 'requests' test package.	Tim Graham
	This avoids a collision when third-party database backends depend on the Requests HTTP library.