1
0
mirror of https://github.com/django/django.git synced 2025-07-10 04:39:13 +00:00

21 Commits

Author SHA1 Message Date
Mariusz Felisiak
dc7b495dae [3.2.x] Refs #32718 -- Corrected CVE-2021-31542 release notes.
Backport of d1f1417caed648db2f81a1ec28c47bf958c01958 from main
2021-05-12 10:42:32 +02:00
Florian Apolloner
c98f446c18 [3.2.x] Fixed CVE-2021-31542 -- Tightened path & file name sanitation in file uploads. 2021-05-04 08:43:52 +02:00
Simon Charette
d5add5d3a2 [3.2.x] Fixed #32632, Fixed #32657 -- Removed flawed support for Subquery deconstruction.
Subquery deconstruction support required implementing complex and
expensive equality rules for sql.Query objects for little benefit as
the latter cannot themselves be made deconstructible to their reference
to model classes.

Making Expression @deconstructible and not BaseExpression allows
interested parties to conform to the "expression" API even if they are
not deconstructible as it's only a requirement for expressions allowed
in Model fields and meta options (e.g. constraints, indexes).

Thanks Phillip Cutter for the report.

This also fixes a performance regression in bbf141bcdc31f1324048af9233583a523ac54c94.

Backport of c8b659430556dca0b2fe27cf2ea0f8290dbafecd from main
2021-04-28 20:27:42 +02:00
Konstantin Alekseev
55cb3c8ac1 [3.2.x] Fixed #32687 -- Restored passing process’ environment to underlying tool in dbshell on PostgreSQL.
Regression in bbe6fbb8768e8fb1aecb96d51c049d7ceaf802d3.

Backport of 6e742dabc95b00ba896434293556adeb4dbaee8a from main.
2021-04-27 12:02:06 +02:00
Mariusz Felisiak
34981f399a [3.2.x] Fixed #32682 -- Made admin changelist use Exists() instead of distinct() for preventing duplicates.
Thanks Zain Patel for the report and Simon Charette for reviews.

The exception introduced in 6307c3f1a123f5975c73b231e8ac4f115fd72c0d
revealed a possible data loss issue in the admin.

Backport of 187118203197801c6cb72dc8b06b714b23b6dd3d from main
2021-04-27 10:39:55 +02:00
Zain Patel
0dfe88eaba [3.2.x] Fixed #32681 -- Fixed VariableDoesNotExist when rendering some admin template.
Regression in 84609b3205905097d7d3038d32e6101f012c0619.

Backport of 4e5bbb6ef2287126badd32842b239f4a8a7394ca from main.
2021-04-26 12:52:33 +02:00
Simon Charette
48e19bae49 [3.2.x] Fixed #32650 -- Fixed handling subquery aliasing on queryset combination.
This issue started manifesting itself when nesting a combined subquery
relying on exclude() since 8593e162c9cb63a6c0b06daf045bc1c21eb4d7c1 but
sql.Query.combine never properly handled subqueries outer refs in the
first place, see QuerySetBitwiseOperationTests.test_subquery_aliases()
(refs #27149).

Thanks Raffaele Salmaso for the report.

Backport of 6d0cbe42c3d382e5393d4af48185c546bb0ada1f from main
2021-04-21 10:32:39 +02:00
Mariusz Felisiak
1cc2eaf02d [3.2.x] Fixed #32665 -- Fixed caches system check crash when STATICFILES_DIRS is a list of 2-tuples.
Thanks Jared Lockhart for the report.

Regression in c36075ac1dddfa986340b1a5e15fe48833322372.
Backport of 34d1905712d33e72c76b3a55a4fc24abbd11be6c from main
2021-04-21 09:42:43 +02:00
Carlton Gibson
54d5bfa9c5 [3.2.x] Fixed #32647 -- Restored multi-row select with shift-modifier in admin changelist.
Regression in 30e59705fc3e3e9e8370b965af794ad6173bf92b.

Backport of 5c73fbb6a93ee214678f02ba4027f18dff49337b from main
2021-04-21 09:08:34 +02:00
Florian Apolloner
539d005aa5 [3.2.x] Fixed #32643 -- Fixed decoding of messages in the pre-Django 3.2 format.
Thanks Jan Pieter Waagmeester for the report.

Regression in 2d6179c819010f6a9d00835d5893c4593c0b85a0.

Backport of 4511d1459810037b91faa5b506e4f75c77aa72be from main.
2021-04-15 07:58:48 +02:00
Mariusz Felisiak
208e72276a [3.2.x] Fixed #32645 -- Fixed QuerySet.update() crash when ordered by joined fields on MySQL/MariaDB.
Thanks Matt Westcott for the report.

Regression in 779e615e362108862f1681f965ee9e4f1d0ae6d2.
Backport of ca9872905559026af82000e46cde6f7dedc897b6 from main
2021-04-14 21:13:27 +02:00
Jonathan Richards
d0267690f8 [3.2.x] Fixed #32548 -- Fixed crash when combining Q() objects with boolean expressions.
Backport of 00b0786de533dbb3f6208d8d5eaddbf765b4e5b8 from main.

Regression in 466920f6d726eee90d5566e0a9948e92b33a122e.
2021-04-14 19:46:45 +02:00
Arthur Jovart
65dfb06a1a [3.2.x] Fixed #32648 -- Fixed VariableDoesNotExist rendering sitemaps template.
Backport of 08c60cce3b13f6e60d7588206da2d3c71228f378 from main
2021-04-14 19:44:10 +02:00
Mariusz Felisiak
59cce8237c [3.2.x] Fixed #32649 -- Fixed ModelAdmin.search_fields crash when searching against phrases with unbalanced quotes.
Thanks Dlis for the report.

Regression in 26a413507abb38f7eee4cf62f2ee9727fdc7bf8d.
Backport of 23fa29f6a6659e0f600d216de6bcb79e7f6818c9 from main
2021-04-14 12:24:11 +02:00
Hasan Ramezani
700356f93b [3.2.x] Fixed #32635 -- Fixed system check crash for reverse o2o relations in CheckConstraint.check and UniqueConstraint.condition.
Regression in b7b7df5fbcf44e6598396905136cab5a19e9faff.

Thanks Szymon Zmilczak for the report.

Backport of a77c9a4229cfef790ec18001b2cd18bd9c4aedbc from main
2021-04-14 10:32:07 +02:00
Mariusz Felisiak
d6314c4c2e [3.2.x] Fixed #32637 -- Restored exception message on technical 404 debug page.
Thanks Atul Varma for the report.
Backport of 3b8527e32b665df91622649550813bb1ec9a9251 from main
2021-04-13 09:15:25 +02:00
Iuri de Silvio
b245845575 [3.2.x] Fixed #32627 -- Fixed QuerySet.values()/values_list() crash on combined querysets ordered by unannotated columns.
Backport of 9760e262f85ae57df39abe2799eff48a82b14474 from main
2021-04-13 06:16:19 +02:00
Adam Johnson
49e618f4af [3.2.x] Fixed #32620 -- Allowed subclasses of Big/SmallAutoField for DEFAULT_AUTO_FIELD.
Backport of 45a58c31e64dbfdecab1178b1d00a3803a90ea2d from main
2021-04-08 13:44:21 +02:00
Carlton Gibson
55da04488e [3.2.x] Corrected release number format in 3.2.1 release notes.
Backport of 3f2920ae1d91e67ebf677d407da528c04188384e from main
2021-04-07 19:45:29 +02:00
Claude Paroz
5eb17d31c3 [3.2.x] Fixed #32544 -- Confirmed support for GDAL 3.2 and GEOS 3.9.
Backport of e3cfba0029516aafe40f963378e234df2c0d33bb from main.
2021-04-07 17:04:10 +02:00
Carlton Gibson
2e8ff5f902 [3.2.x] Added stub release notes for Django 3.2.1.
Backport of df0a9e6d5ce00fc7890545d854dbea876bd07d9b from main
2021-04-06 11:50:23 +02:00