1
0
mirror of https://github.com/django/django.git synced 2025-10-10 07:19:11 +00:00

336 Commits

Author SHA1 Message Date
Carlton Gibson
704192e478 Removed unneeded hyphens in "counterintuitive".
Follow-up to 65ad4ade74dc9208b9d686a451cd6045df0c9c3a which added
counterintuitive to the wordlist. Removes unneeded (antiquated)
hyphenated usages.

See e.g. https://www.merriam-webster.com/dictionary/counterintuitive
2024-07-04 08:30:19 +02:00
Jake Howard
ff308a0604
Fixed 35467 -- Replaced urlparse with urlsplit where appropriate.
This work should not generate any change of functionality, and
`urlsplit` is approximately 6x faster.

Most use cases of `urlparse` didn't touch the path, so they can be
converted to `urlsplit` without any issue. Most of those which do use
`.path`, simply parse the URL, mutate the querystring, then put them
back together, which is also fine (so long as urlunsplit is used).
2024-05-29 10:48:27 -03:00
Rinat Khabibiev
3580b47ed3 Fixed #27225 -- Added "Age" header when fetching cached responses.
Co-Authored-By: Author: Alexander Lazarević <laza@e11bits.com>
2024-02-05 13:27:51 +01:00
Mariusz Felisiak
305757aec1
Applied Black's 2024 stable style.
https://github.com/psf/black/releases/tag/24.1.0
2024-01-26 12:45:07 +01:00
Avaneesh Kumar
705b1702bd Fixed #34742 -- Made CommonMiddleware raise APPEND_SLASH RuntimeError on DELETE requests. 2023-12-08 05:56:36 +01:00
Mariusz Felisiak
0e444e84f8 Fixed #34515 -- Made LocaleMiddleware prefer language from paths when i18n patterns are used.
Regression in 94e7f471c4edef845a4fe5e3160132997b4cca81.

This reverts commit 94e7f471c4edef845a4fe5e3160132997b4cca81
(refs #34069) and
partly reverts commit 3b4728310a7a64f8fcc548163b0aa5f98a5c78f5.

Thanks Anthony Baillard for the report.

Co-Authored-By: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
2023-05-02 06:04:18 +02:00
Mariusz Felisiak
e01970e9d2 Refs #32800 -- Removed CSRF_COOKIE_MASKED transitional setting per deprecation timeline. 2023-01-17 11:49:15 +01:00
Carlton Gibson
0bd2c0c901 Fixed #33735 -- Added async support to StreamingHttpResponse.
Thanks to Florian Vazelle for initial exploratory work, and to Nick
Pope and Mariusz Felisiak for review.
2022-12-22 10:41:12 +01:00
Andreas Pelme
ab7a85ac29 Fixed #34170 -- Implemented Heal The Breach (HTB) in GzipMiddleware. 2022-12-17 08:46:37 +01:00
David Wobrock
67da22f08e Fixed #34074 -- Added headers argument to RequestFactory and Client classes. 2022-11-14 10:21:51 +01:00
Nick Pope
9bd174b9a7 Updated documentation and comments for RFC updates.
- Updated references to RFC 1123 to RFC 5322
  - Only partial as RFC 5322 sort of sub-references RFC 1123.
- Updated references to RFC 2388 to RFC 7578
  - Except RFC 2388 Section 5.3 which has no equivalent.
- Updated references to RFC 2396 to RFC 3986
- Updated references to RFC 2616 to RFC 9110
- Updated references to RFC 3066 to RFC 5646
- Updated references to RFC 7230 to RFC 9112
- Updated references to RFC 7231 to RFC 9110
- Updated references to RFC 7232 to RFC 9110
- Updated references to RFC 7234 to RFC 9111
- Tidied up style of text when referring to RFC documents
2022-11-10 13:52:17 +01:00
Nick Pope
d3cb91db87 Used more augmented assignment statements.
Identified using the following command:

$ git grep -I '\(\<[_a-zA-Z0-9]\+\>\) *= *\1 *[-+/*^%&|<>@]'
2022-10-31 12:30:13 +01:00
Sergio
94e7f471c4 Fixed #34069 -- Made LocaleMiddleware respect language from requests when i18n patterns are used. 2022-10-13 10:38:26 +02:00
Anders Kaseorg
fbac2a4dd8 Fixed #33700 -- Skipped extra resolution for successful requests not ending with /.
By moving a should_redirect_with_slash call out of an if block, commit
9390da7fb6e251eaa9a785692f987296cb14523f negated the performance fix
of commit 434d309ef6dbecbfd2b322d3a1da78aa5cb05fa8 (#24720).
Meanwhile, the logging issue #26293 that it targeted was subsequently
fixed more fully by commit 40b69607c751c4afa453edfd41d2ed155e58187e
(#26504), so it is no longer needed.  This effectively reverts it.

This speeds up successful requests not ending with / when APPEND_SLASH
is enabled (the default, and still useful in projects with a mix of
URLs with and without trailing /).  The amount of speedup varies from
about 5% in a typical project to nearly 50% on a benchmark with many
routes.

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
2022-06-02 15:15:04 +02:00
Clemens Wolff
f0ba799edf
Refs #30426 -- Updated XFrameOptionsMiddleware docstring.
Follow up to 05d0eca635853564c57e639ac5590674a7de2ed6.
2022-04-29 21:17:27 +02:00
django-bot
9c19aff7c7 Refs #33476 -- Reformatted code with Black. 2022-02-07 20:37:05 +01:00
Chris Jerdonek
3ff7f6cf07 Refs #32800 -- Renamed _sanitize_token() to _check_token_format(). 2021-11-29 10:48:31 +01:00
Chris Jerdonek
5d80843ebc Fixed #32800 -- Changed CsrfViewMiddleware not to mask the CSRF secret.
This also adds CSRF_COOKIE_MASKED transitional setting helpful in
migrating multiple instance of the same project to Django 4.1+.

Thanks Florian Apolloner and Shai Berger for reviews.

Co-Authored-By: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2021-11-29 10:47:39 +01:00
Iuri de Silvio
3ff7b15bb7 Fixed #33252 -- Made cache middlewares thread-safe. 2021-11-03 09:39:27 +01:00
Alex Hayward
eeed488a34 Fixed #32768 -- Added Vary header when redirecting to prefixed i18n pattern.
get_language_from_request() uses Accept-Language and/or Cookie to determine the
correct redirect. Upstream caches need the matching Vary header to cache the
result.
2021-09-01 14:02:37 +02:00
Chris Jerdonek
231de683d8 Refs #32800 -- Added _add_new_csrf_cookie() helper function.
This centralizes the logic to use when setting a new cookie. It also
eliminates the need for the _get_new_csrf_token() function, which is now
removed.
2021-08-17 12:23:54 +02:00
Chris Jerdonek
f10553ec93 Refs #32800 -- Renamed _set_token() to _set_csrf_cookie(). 2021-08-17 12:23:54 +02:00
Chris Jerdonek
7132341255 Refs #32800 -- Renamed _compare_masked_tokens() to _does_token_match(). 2021-08-03 07:10:31 +02:00
Chris Jerdonek
7c30bdbdb1 Refs #32916 -- Replaced request.csrf_cookie_needs_reset with request.META['CSRF_COOKIE_NEEDS_UPDATE']. 2021-07-29 11:55:36 +02:00
Chris Jerdonek
6ebf931de8 Fixed #32916 -- Combined request.META['CSRF_COOKIE_USED'] and request.csrf_cookie_needs_reset. 2021-07-29 11:55:36 +02:00
Virtosu Bogdan
00ea883ef5 Fixed #32329 -- Made CsrfViewMiddleware catch more specific UnreadablePostError.
Thanks Chris Jerdonek for the review.
2021-07-23 13:10:41 +02:00
Chris Jerdonek
a2e1f1e295 Fixed #32902 -- Fixed CsrfViewMiddleware.process_response()'s cookie reset logic.
Thanks Florian Apolloner and Shai Berger for reviews.
2021-07-23 07:08:45 +02:00
Chris Jerdonek
fcb75651f9 Fixed #32817 -- Added the token source to CsrfViewMiddleware's bad token error messages. 2021-06-23 16:07:15 +02:00
Chris Jerdonek
ee408309d2
Fixed #32842 -- Refactored out CsrfViewMiddleware._check_token(). 2021-06-22 07:42:28 +02:00
Chris Jerdonek
316cc34d04 Fixed comment in CsrfViewMiddleware to say _reject instead of reject. 2021-06-12 16:46:42 +02:00
Chris Jerdonek
cd19db10df Fixed #32796 -- Changed CsrfViewMiddleware to fail earlier on badly formatted cookie tokens. 2021-06-01 09:02:27 +02:00
Chris Jerdonek
55775891fb Fixed #32795 -- Changed CsrfViewMiddleware to fail earlier on badly formatted tokens. 2021-05-31 21:12:21 +02:00
Chris Jerdonek
d270dd584e
Refs #32778 -- Improved the name of the regex object detecting invalid CSRF token characters.
This also improves the comments near where the variable is used.
2021-05-29 12:53:50 +02:00
Chris Jerdonek
214b36f50a Refs #32596 -- Added early return on safe methods in CsrfViewMiddleware.process_view(). 2021-05-28 07:32:01 +02:00
Chris Jerdonek
cfd8c91839 Refs #32596 -- Optimized CsrfViewMiddleware._check_referer() to delay computing good_referer. 2021-05-28 07:32:01 +02:00
Chris Jerdonek
71179a6124 Fixed #32596 -- Added CsrfViewMiddleware._check_referer().
This encapsulates CsrfViewMiddleware's referer logic into a method and
updates existing tests to check the "seam" introduced by the refactor,
when doing so would improve the test.
2021-05-28 07:31:56 +02:00
abhiabhi94
866dccb650 Fixed #32778 -- Avoided unnecessary recompilation of token regex in _sanitize_token(). 2021-05-25 09:56:09 +02:00
Tim Graham
54da6e2ac2 Fixed #32678 -- Removed SECURE_BROWSER_XSS_FILTER setting. 2021-04-30 12:32:52 +02:00
bankc
db5b75f10f Fixed #31840 -- Added support for Cross-Origin Opener Policy header.
Thanks Adam Johnson and Tim Graham for the reviews.

Co-authored-by: Tim Graham <timograham@gmail.com>
2021-03-30 19:59:24 +02:00
Chris Jerdonek
ff514309e1 Fixed #32578 -- Fixed crash in CsrfViewMiddleware when a request with Origin header has an invalid host. 2021-03-25 10:34:58 +01:00
Chris Jerdonek
f3825248a2 Refs #32579 -- Fixed cookie domain comment in CsrfViewMiddleware.process_view(). 2021-03-25 06:48:36 +01:00
Chris Jerdonek
70332e6c43 Refs #32579 -- Optimized good_hosts creation in CsrfViewMiddleware.process_view(). 2021-03-25 06:39:35 +01:00
Adam Donaghy
e49fdfa405 Fixed #32571 -- Made CsrfViewMiddleware handle invalid URLs in Referer header. 2021-03-19 11:19:19 +01:00
Tim Graham
2411b8b5eb Fixed #16010 -- Added Origin header checking to CSRF middleware.
Thanks David Benjamin for the original patch, and Florian
Apolloner, Chris Jerdonek, and Adam Johnson for reviews.
2021-03-18 20:25:20 +01:00
Tim Graham
dba44a7a7a Refs #16010 -- Required CSRF_TRUSTED_ORIGINS setting to include the scheme. 2021-03-18 20:00:22 +01:00
Mariusz Felisiak
4bb30fe5d5 Refs #26601 -- Made get_response argument required and don't accept None in middleware classes.
Per deprecation timeline.
2021-01-14 17:50:04 +01:00
Martin Thoma
302caa40e4 Made small readability improvements. 2020-10-28 20:20:20 +01:00
Carlton Gibson
ad11f5b8c9 Fixed #32124 -- Added per-view opt-out for APPEND_SLASH behavior. 2020-10-22 14:15:19 +02:00
Tom Carrick
bcc2befd0e Fixed #31789 -- Added a new headers interface to HttpResponse. 2020-09-14 08:41:59 +02:00
Kevin Michel
825ce75fae Fixed #31928 -- Fixed detecting an async get_response in various middlewares.
SecurityMiddleware and the three cache middlewares were not calling
super().__init__() during their initialization or calling the required
MiddlewareMixin._async_check() method.

This made the middlewares not properly present as coroutine and
confused the middleware chain when used in a fully async context.

Thanks Kordian Kowalski for the report.
2020-08-28 12:33:15 +02:00