Florian Apolloner
cf694e6852
[2.2.x] Fixed CVE-2019-14235 -- Fixed potential memory exhaustion in django.utils.encoding.uri_to_iri().
...
Thanks to Guido Vranken for initial report.
2019-07-29 11:06:54 +02:00
Mariusz Felisiak
4f5b58f5cd
[2.2.x] Fixed CVE-2019-14234 -- Protected JSONField/HStoreField key and index lookups against SQL injection.
...
Thanks to Sage M. Abdullah for the report and initial patch.
Thanks Florian Apolloner for reviews.
2019-07-29 11:06:54 +02:00
Florian Apolloner
e34f3c0e9e
[2.2.x] Fixed CVE-2019-14233 -- Prevented excessive HTMLParser recursion in strip_tags() when handling incomplete HTML entities.
...
Thanks to Guido Vranken for initial report.
2019-07-29 11:06:54 +02:00
Florian Apolloner
c3289717c6
[2.2.X] Fixed CVE-2019-14232 -- Adjusted regex to avoid backtracking issues when truncating HTML.
...
Thanks to Guido Vranken for initial report.
2019-07-29 11:00:01 +02:00
Carlton Gibson
ea57c8a345
[2.2.x] Added stub release notes for security releases.
...
Backport of f13147c8de725eed7038941758469aeb9bd66503 from master
2019-07-25 10:50:18 +02:00
Tom Forbes
4d6449e125
[2.2.x] Fixed #30647 -- Fixed crash of autoreloader when extra directory cannot be resolved.
...
Backport of fc75694257b5bceab82713f84fe5a1b23d641c3f from master.
2019-07-24 14:38:24 +02:00
Tom Forbes
2d2859bec2
[2.2.x] Fixed #30506 -- Fixed crash of autoreloader when path contains null characters.
...
Backport of 2ff517ccb6116c1be6338e6bdcf08a313defc5c7 from master.
2019-07-23 10:41:50 +02:00
Mariusz Felisiak
1088a9777d
[2.2.x] Fixed #30621 -- Fixed crash of __contains lookup for Date/DateTimeRangeField when the right hand side is the same type.
...
Thanks Tilman Koschnick for the report and initial patch.
Thanks Carlton Gibson for the review.
Regression in 6b048b364ca1e0e56a0d3815bf2be33ac9998355.
Backport of 7991111af12056ec9a856f35935d273526338c1f from master
2019-07-10 10:34:49 +02:00
Simon Charette
9dee8515d6
[2.2.x] Fixed #30628 -- Adjusted expression identity to differentiate bound fields.
...
Expressions referring to different bound fields should not be
considered equal.
Thanks Julien Enselme for the detailed report.
Regression in bc7e288ca9554ac1a0a19941302dea19df1acd21.
Backport of ee6e93ec8727d0f5ed33190a3c354867669ed72f from master
2019-07-10 08:04:45 +02:00
Mariusz Felisiak
b593c39d7f
[2.2.x] Added stub release notes for 2.2.4.
...
Backport of 08e69cad9ccb18738b66388b0d0ee4660470710e from master
2019-07-09 07:45:27 +02:00
