summaryrefslogtreecommitdiff
path: root/tests
AgeCommit message (Collapse)Author
19 hoursFixed #37075 -- Allowed overriding the PostgreSQL pool's "check" callable.HEADmainRaoni Timo
Setting "check" in OPTIONS["pool"] previously raised TypeError because the PostgreSQL backend always passed check= to ConnectionPool() and unpacked **pool_options on top, regardless of CONN_HEALTH_CHECKS. The user's callable now takes precedence via setdefault(); pool_options is copied first to avoid mutating the user's settings dict.
31 hoursFixed #36919 -- Allowed Task and TaskResult to be pickled.varunkasyap
2 daysFixed #16429 -- Extracted set_choices() method from FilePathField.__init__().TildaDares
2 daysFixed #37067 -- Added trailing slash in django_file_prefixes().Fashad Ahmed
Ensure skip_file_prefixes does not match sibling packages like django*. Bug in f42b89f1bf49a5b89ed852b60f79342320a81c5e and 34bd3ed944bf38792c631b55e581963d44d52284.
3 daysRefs #15759 -- Fixed ModelAdmin.list_editable form submission for ↵Artyom Kotovskiy
non-editable instances. Added formset that excludes objects for which user has no permission for POST formset as well. Fixed regression test: the test was not simulating real behaviour properly. By providing full form data for the post request we skipped the part where the user was actually limited in permissions and only modified some of the rows. Improved tests by getting rid of obj.id % 2 approach for granting permissions per object for users, since it is not the safest. Instead granting permissions simply by 'alive' parameter, which is simpler and more stable. Bug in 84db026228413dda4cd195464554d51c0b208e32.
3 daysFixed #35738 -- Deprecated double-dot variable lookups.David Smith
3 daysFixed #36912 -- Added connector validation to Q.create().Anna Makarudze
Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
4 daysRefs #35514 -- Added warn_about_external_use() deprecation utility.Mike Edmunds
Implemented a new `warn_about_external_use()` helper to conditionally issue warnings depending on whether a deprecated feature is used from within Django. Fixed `LazySettings._show_deprecation_warning()` (Refs #26029) to work correctly when called from anywhere in `LazySettings`. Previously, it assumed a specific code path through `LazyObject.__getattribute__()` and an `@property` getter on `LazySettings`.
4 daysMoved QuerySet.extra() assertions to a separate test.Tim Graham
This allows backends that don't support extra() to skip it.
7 daysFixed #36542 -- Marked authenticate() with @sensitive_variables() decorator.KANIN KEARPIMY
Thanks Olivier Dalang, Tim McCurrach, Sarah Boyce, and Mar Bartolome for reviews.
7 daysReverted inadvertent changes to PK formatting in tests.Tim Graham
Bad conflict resolution in 63c56cda133a85a158502891c40465bc0331d3d9 reverted bits of d007fcf7291cc3c24d4545e23c759bde22b6a8a6.
9 daysRefs #35943 -- Fixed admin_views.test_related_object_lookups crash when ↵Mariusz Felisiak
selenium is not installed.
9 daysFixed #10919 -- Added delete_confirmation_max_display to ModelAdmin.Rodrigo Vieira
The new ModelAdmin.delete_confirmation_max_display attribute allows limiting the number of related objects shown on the delete confirmation page. When the limit is reached, a "…and N more objects." message is shown. The feature relies on a new truncated_unordered_list template filter added to django.contrib.admin.templatetags.admin_filters. Thanks Jacob Tyler Walls for the review and guidance, Tobias McNulty for the report, and terminator14 for the solution suggested.
9 daysRefs #10919 -- Refactored walk_items as module-level _walk_items and added ↵Rodrigo Vieira
truncated_unordered_list filter.
9 daysFixed #37057 -- Adjusted UniqueConstraint handling of UNKNOWN condition.Simon Charette
When we adjusted UNKNOWN handling for CheckConstraint in refs #33996 we assumed that all usage of Q.check would benefit from this approach. However while CHECK constraints enforcement do ignore conditions involving NULL that resolve to UNKNOWN it's not the case for other type of constraints such as UNIQUE ones. Given how UNKNOWN should be treated depends on the callers context it appears that a better strategy for COALESCE wrapping is to force them to apply it if necessary. Thanks Drew Shapiro for the report.
9 daysFixed #35870 -- Made blank choice label in forms more accessible.Annabelle Wiegart
Added new constant django.db.models.fields.BLANK_CHOICE_LABEL for an accessible and translatable blank choice label in forms. Deprecated django.db.models.fields.BLANK_CHOICE_DASH constant. Added the immediately deprecated transitional setting USE_BLANK_CHOICE_DASH. Co-Authored-By: Marijke Luttekes <mail@marijkeluttekes.dev>
9 daysFixed #36991 -- Raised BadRequest for invalid encodings in Content-Type headers.Dinesh
9 daysFixed #35943 -- Replaced unload event listener with pagehide.Amar
Co-authored-by: Peter van der Does <peter@oneilinteractive.com> Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
9 daysFixed #15759 -- Excluded fields by per-object permissions for ↵Artyom Kotovskiy
ModelAdmin.list_editable. Instead of going over all objects in a queryset and filtering by user permissions, added skipping while saving the formset so there is no need to refetch objects again.
12 daysFixed #37047 -- Fixed crash in Query.orderby_issubset_groupby for descending ↵Anže Pečar
and random order_by strings. Run this example: ```python User.objects.values("is_staff").annotate(latest=Max("date_joined")).order_by("-latest").count() ``` You should see the following exception: ``` django.core.exceptions.FieldError: Cannot resolve keyword '-latest' into field. ``` Regression in 2ce5cb0f7a4618dfdc5f5c10e53e2e9b9543d298.
13 daysFixed #37024 -- Made SITE_ID system check validation use Site._meta.pk.Tim Graham
13 daysFixed #37036 -- Added missing flat=True arg in DeferredAttribute.fetch_many().garybadwal
14 daysFixed #37028 -- Added BitAnd(), BitOr(), and BitXor() aggregates.Mariusz Felisiak
2026-04-14Fixed #27150 -- Made base File objects truthy by default.VIZZARD-X
2026-04-11Fixed #36953 -- Split EmailBackend tests to separate file.Mike Edmunds
Moved tests for specific email backends from tests/mail/tests.py to test_backends.py to reduce file size and discourage adding non-backend-specific tests to BaseEmailBackendTests.
2026-04-11Refs #36953 -- Moved non-backend-dependent BaseEmailBackendTests.Mike Edmunds
Relocated BaseEmailBackendTests that are _not_ dependent on the email backend. - In general, moved test cases to EmailMessageTests or SendMailTests as appropriate, and changed them to work with the testing outbox. - Replaced BaseEmailBackendTests.test_send_verbose_name() with EmailMessageTests.test_unicode_display_name_in_from_email(). (EmailMessageTests.test_address_header_handling() also partly covers the behavior, as well as Python's own message serialization tests.) - Removed BaseEmailBackendTests.test_message_cc_header(), which was already covered by EmailMessageTests.test_cc*() (and Python's own message serialization tests). - Replaced BaseEmailBackendTests.test_idn_send() with EmailMessageTests.test_idn_addresses() to cover from_email and cc. (EmailMessageTests.test_address_header_handling() already covered to.) - Removed BaseEmailBackendTests.test_recipient_without_domain(), which was partly covered by EmailMessageTests.test_localpart_only_address(). Updated the latter to cover a localpart-only from_email. - Updated docstrings and comments to clarify a few tests that _do_ depend on the email backend.
2026-04-11Refs #36953 -- Split apart catchall MailTests.Mike Edmunds
Replaced large MailTests class with smaller classes focused on specific django.core.mail APIs: - EmailMessageTests: covering EmailMessage and EmailMultiAlternatives classes (the bulk of the former MailTests cases). - SendMailTests, SendMassMailTests, MailAdminsAndManagersTests: covering the function-based mail APIs. - GetConnectionTests: covering get_connection(). - DeprecatedInternalsTests: covering deprecated internal methods used in deprecated functionality. - DummyBackendTests: covering the dummy EmailBackend. In the process, moved the two cases from MailTimeZoneTests into the new EmailMessageTests, as they related to EmailMessage Date headers.
2026-04-11Refs #36953 -- Split compound mail tests.Mike Edmunds
Broke apart independent cases in mail tests using subTest() or separate methods.
2026-04-11Refs #36953 -- Removed unnecessary overrides from mail tests.Mike Edmunds
Django automatically substitutes the locmem EmailBackend during tests, and SimpleTestCase empties mail.outbox before each test.
2026-04-08Refs CVE-2026-4292 -- Isolated new test in AdminViewListEditable.Jacob Walls
As originally written, this test interfered with admin_views.tests.SeleniumTests.test_inline_uuid_pk_add_with_popup. To fix this, register the new ModelAdmin with a different AdminSite.
2026-04-07Fixed #37021 -- Added Permission.user_perm_str property.mariatta
For use in checking user permissions via has_perm(). Co-authored-by: 사재혁 <jaehyuck.sa.dev@gmail.com>
2026-04-07Fixed #36816 -- Allowed **kwargs in @task decorator.Nilesh Kumar Pahari
The decorator was updated to accept **kwargs and forward them to task_class, allowing additional parameters to be passed to custom Task subclasses.
2026-04-07Fixed CVE-2026-33034 -- Enforced DATA_UPLOAD_MAX_MEMORY_SIZE on body size in ↵Natalia
ASGI requests. The `body` property in `HttpRequest` checks DATA_UPLOAD_MAX_MEMORY_SIZE against the declared `Content-Length` header before reading. On the ASGI path, chunked requests carry no `Content-Length`, so the check evaluated to 0 and always passed regardless of the actual body size. This work adds a new check on the actual number of bytes consumed. Thanks to Superior for the report, and to Jake Howard and Jacob Walls for reviews.
2026-04-07Fixed CVE-2026-33033 -- Mitigated potential DoS in MultiPartParser.Natalia
When a multipart file part used `Content-Transfer-Encoding: base64` and the non-whitespace base64 bytes did not align to a multiple of 4 within a chunk, the parser entered a loop calling `field_stream.read(1-3)` once per whitespace byte. Each such call fetched the entire internal buffer, sliced off 1-3 bytes, and pushed the remainder back via unget(), doing an O(n) memory copy per call. A 2.5 MB payload of mostly whitespace produced CPU amplification relative to a normal upload of the same size. The alignment loop now reads `self._chunk_size` bytes at a time, and accumulates stripped parts in a list joined once at the end. Thanks to Seokchan Yoon for the report and the fixing patch.
2026-04-07Fixed CVE-2026-4292 -- Disallowed instance creation via ↵Jacob Walls
ModelAdmin.list_editable. Thanks Natalia Bidart, Jake Howard, and Markus Holtermann for reviews.
2026-04-07Fixed CVE-2026-4277 -- Checked add permissions in GenericInlineModelAdmin.Jacob Walls
Edit permissions were still checked as part of ordinary form validation, but because GenericInlineModelAdmin overrides get_formset(), it lacked InlineModelAdmin's dynamic DeleteProtectedModelForm.has_changed() logic for checking permissions server-side, leaving the add case unaddressed. This change reimplements the relevant part of InlineModelAdmin.get_formset(). Thanks N05ec@LZU-DSLab for the report, and Natalia Bidart, Markus Holtermann, and Simon Charette for reviews.
2026-04-07Fixed CVE-2026-3902 -- Ignored headers with underscores in ASGIRequest.Jacob Walls
Thanks Tarek Nakkouch for the report and Jake Howard and Natalia Bidart for reviews.
2026-04-06Fixed #37023 -- Made XML serializer put each ManyToManyField object on its ↵Tim Graham
own line.
2026-04-03Fixed #37016 -- Avoided propagating invalid arguments from When() to Q().varunkasyap
2026-04-03Refs #36949 -- Removed hardcoded pks in modeladmin tests.Tim Graham
2026-04-02Fixed #36973 -- Made fields.E348 check detect further clashes between ↵Clifford Gama
managers and related_names. Clashes were only detected for self-referential relationships, i.e. ForeignKey("self"). Refs #22977. Bug in 6888375c53476011754f778deabc6cdbfa327011. Thanks JaeHyuckSa for the thorough review!
2026-04-02Fixed #20024 -- Fixed handling of __in lookups with None in exclude().Eddy Adegnandjou
Thanks Simon Charette and Tim Graham for reviews, and Jason Hall for a prior iteration.
2026-04-02Refs #20024 -- Tested __in lookups with None against composite pk fields.Eddy Adegnandjou
2026-04-02Fixed #36949 -- Improved RelatedFieldWidgetWrapper <label>s.David Smith
Regression in 4187da258fe212d494cb578a0bc2b52c4979ab95.
2026-04-02Fixed #37017 -- Fixed setting or clearing of request.user after ↵Jacob Walls
alogin/alogout(). Regression in 31a43c571f4d036827d4fd7a5f615591637dc1be.
2026-04-01Fixed #37004 -- Used QuerySet.totally_ordered in ↵Rodrigo Vieira
BaseModelFormSet.get_queryset() for stable ordering.
2026-04-01Refs #37004 -- Added coverage for BaseModelFormSet.get_queryset() fallback ↵Rodrigo Vieira
ordering.
2026-03-30Refs #36770 -- Skipped test_in_memory_database_lock().Jacob Walls
Skip pending some investigation.
2026-03-30Refs #36770 -- Preferred addCleanup() in live server tests.Jacob Walls
2026-03-26Refs #36913 -- Maintained error message determinism in ↵afenoum
MultipleChoiceField.validate(). Used Django's OrderedSet datastructure instead of set() in MultipleChoiceField.validate() to prevent submission ordering from being discarded during validation. Thanks to Jacob Walls, JaeHyuck Sa, Jake Howard and Simon Charette for the reviews.