1
0
mirror of https://github.com/django/django.git synced 2025-06-02 10:09:12 +00:00

33539 Commits

Author SHA1 Message Date
Sarah Boyce
9f3419b519 Fixed CVE-2025-32873 -- Mitigated potential DoS in strip_tags().
Thanks to Elias Myllymäki for the report, and Shai Berger and Jake
Howard for the reviews.

Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2025-05-06 22:21:42 -03:00
Natalia
f7d97dd118 Simplified artifact building steps in docs/internals/howto-release-django.txt.
With the recent merge of artifact build updates from
https://github.com/django/django/pull/19436, there is no need to have
different build instructions for 4.2.
2025-05-06 11:11:40 -03:00
Mariusz Felisiak
dd133054cb
Refs #36052, #32234 -- Fixed inspectdb tests for CompositePrimaryKey on Oracle.
Tests regression in 4c75858135589f3a00e32eb4d476074536371a32.
2025-05-06 08:20:56 +02:00
신우진
1fb3f57e81 Fixed #36281 -- Used async-safe write in ASGIHandler.read_body().
Thanks Carlton Gibson for reviews.
2025-05-04 14:53:08 +02:00
Clifford Gama
9d93e35c20 Fixed #17461 -- Doc'd the presumed order of foreign keys on the intermediary model of a self-referential m2m.
Thanks Giannis Terzopoulos and Sarah Boyce for the reviews.
2025-05-02 07:56:56 +01:00
Natalia
0f5dd0dff3 Made cosmetic edits and added upcoming security release to release notes. 2025-04-30 14:55:12 -03:00
Baptiste Mispelon
66f9eb0ff1 Fixed #36357 -- Skipped unique_together in inspectdb output for composite primary keys.
Thanks to Baptiste Mispelon for the report and quick fix, and to Simon
Charette and Jacob Walls for the reviews.

Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2025-04-30 11:55:25 -03:00
Simon Charette
07100db6f4 Fixed #36358 -- Corrected introspection of composite primary keys on SQLite.
Previously, any first field of a composite primary key with type
`INTEGER` was incorrectly introspected as an `AutoField` due to SQLite
treating `INTEGER PRIMARY KEY` as an alias for the `ROWID`.

This change ensures that integer fields in composite PKs are not
mistaken for auto-incrementing fields.

Thanks Jacob Walls and Sarah Boyce for the reviews.
2025-04-30 10:51:48 -03:00
Simon Charette
4c75858135 Refs #36052, #32234 -- Removed create_test_table_with_composite_primary_key flag in favor of using CompositePrimaryKey.
Now that Django properly supports creating models with composite primary
keys, the tests should use a `CompositePrimaryKey` field instead of a
feature flag to inline backend specific SQL for creating a composite PK.

Specifcially, the inspectdb's test_composite_primary_key was adjusted to
use schema editor instead of per-backend raw SQL.
2025-04-30 10:51:48 -03:00
Simon Charette
8ef4e0bd42 Fixed #36360 -- Fixed QuerySet.update() crash when referring annotations through values().
The issue was only manifesting itself when also filtering againt a related
model as that forces the usage of a subquery because SQLUpdateCompiler doesn't
support the UPDATE FROM syntax yet.

Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a.

Refs #28900.

Thanks Gav O'Connor for the detailed report.
2025-04-30 10:38:19 +01:00
Simon Charette
27ffccc96b Used bulk_create where possible in update tests.
This shaves off 21 INSERT queries.

Thanks Clifford for the review.
2025-04-30 10:38:19 +01:00
Baptiste Mispelon
2722cb61cc Used addCleanup() instead of try-finally blocks in inspectdb tests. 2025-04-29 13:45:05 -03:00
Fabian Braun
65bbdbd10b Fixed #36354 -- Removed JavaScript workaround for browsers lacking :has() CSS support.
This branch removes the JavaScript fallback added in the admin for the
add user and change password templates/flows (Refs #34429).

Django documents suport for "modern, web standards compliant browsers".
See https://caniuse.com/css-has for info on browser support per version.
2025-04-28 17:48:19 -03:00
koresi
0ee06c04e0 Fixed #35931 -- Documented fields and methods of the FlatPage model.
Co-authored-by: Clifford Gama <53076065+cliff688@users.noreply.github.com>
2025-04-27 15:10:33 +01:00
Bruno Alla
bc21bc4282 Fixed #18296 -- Created missing custom target directory for startproject and startapp. 2025-04-27 14:41:27 +01:00
9r0k
3babda775d
Fixed #36346 -- Removed outdated section about the threaded option in Oracle driver. 2025-04-27 14:16:50 +02:00
Ahmed Nassar
fbdbccf27a Fixed #36312 -- Removed invalid size units for svg in Safari. 2025-04-27 11:08:43 +01:00
sag​e
fb427e467c
Fixed aggregation tests crash on databases that don't support JSONFields. 2025-04-27 09:03:35 +02:00
dbogar89
7b394b9988
Fixed #36335 -- Fixed typo in docs/topics/db/managers.txt. 2025-04-27 08:40:14 +02:00
Mariusz Felisiak
045110ff30 Refs #36326 -- Fixed QuerySet.raw() crash on models with CompositePrimaryKey on Oracle.
Virtual CompositePrimaryKey fields should be ignored.

Regression in 1831f7733d3ef03d1ca7fac3e8d9f4c5e3e3375e.
2025-04-26 12:12:08 +01:00
nessita
0596263c31
Fixed #36309 -- Made email alternatives and attachments pickleable.
Regression in aba0e541caaa086f183197eaaca0ac20a730bbe4 and in
d5bebc1c26d4c0ec9eaa057aefc5b38649c0ba3b.

Thanks Florent Messa for the report, and Jake Howard and Claude
Paroz for the review.
2025-04-24 10:11:16 -03:00
nessita
c86242d61f
Refs #36341 -- Added release notes for 5.1.9 and 4.2.21 for fix in wordwrap template filter.
Revision 1e9db35836d42a3c72f3d1015c2f302eb6fee046 fixed a regression in
55d89e25f4115c5674cdd9b9bcba2bb2bb6d820b, which also needs to be
backported to the stable branches in extended support (5.1.x and 4.2.x).
2025-04-23 17:26:48 -03:00
Matti Pohjanvirta
1e9db35836 Fixed #36341 -- Preserved whitespaces in wordwrap template filter.
Regression in 55d89e25f4115c5674cdd9b9bcba2bb2bb6d820b.

This work improves the django.utils.text.wrap() function to ensure that
empty lines and lines with whitespace only are kept instead of being
dropped.

Thanks Matti Pohjanvirta for the report and fix.

Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2025-04-23 16:14:03 -03:00
Sarah Boyce
18fa74fc88 Skipped "Labels" Github action when not targeting the main django/django repo. 2025-04-23 11:40:17 -03:00
Simon Charette
760121dcb1 Fixed #35801 -- Prevented collision of senders with non-overlapping lifetimes.
As documented, the id() function can return the same value for distinct
objects with non-overlapping lifetimes which can result in signals being
sent to the wrong receivers if two distinct senders happen to have a
colliding id() value.

Since reproduction of the issue requires memory constrained
circumstances where the same exact id() is reused for two senders of the
same signal the test opt to simulate the collision by systematically
making the same id for Sender instances.

Note that we explicitly avoid keeping a strong reference to senders that
cannot be weakly referenced as that would unexpectedly prevent them from
being garbage collected. This means that id(sender) collisions could
still occur for such objects but Django itself doesn't make use of them.

Thanks Sjoerd Job Postmus for the reduced test case and Mariusz for the
review.

Co-authored-by: And Clover <and@doxdesk.com>
2025-04-23 13:09:46 +01:00
Bona Fide IT GmbH
19067fe85a
Simplified UserManager.with_perm() by using get_backends(). 2025-04-23 13:01:19 +01:00
antoliny0919
1bc805e23b Fixed #36331 -- Reverted "Fixed #36055 -- Prevented overlap of object-tools buttons and page header in the admin."
This reverts commits b1324a680add78de24c763911d0eefa19b9263bc and
02a5cbfe76382da2a0414df17017185be5bd47f9. The former caused a regression
in admin sites that relied on the `object-tools` block being inside the
`content` block.

Thank you to Fabian Braun for the report.
2025-04-22 22:13:38 -03:00
SaJH
1831f7733d Fixed #36326 -- Added CompositePrimaryKey support in QuerySet.raw().
Signed-off-by: SaJH <wogur981208@gmail.com>
2025-04-17 17:23:06 +02:00
Sarah Boyce
d755a98b84 Fixed #35959 -- Displayed password reset button in admin only when user has sufficient permissions.
This change ensures that the "Reset password" button in the admin is
shown only when the user has the necessary permission to perform a
password change operation. It reuses the password hashing rendering
logic in `display_for_field` to show the appropriate read-only widget
for users with view-only access.
2025-04-17 12:00:20 -03:00
Sarah Boyce
8a0ad1ebe3 Refs #35959 -- Added render_password_as_hash auth template tag for password rendering. 2025-04-17 12:00:20 -03:00
Ahmed Nassar
d469db978e Fixed #36314 -- Fixed MinimumLengthValidator error message translation.
Regression in ec7d69035a408b357f1803ca05a7c991cc358cfa.

Thank you Gabriel Trouvé for the report and Claude Paroz for the review.
2025-04-17 12:30:20 +02:00
farhan
4a293eff6f Fixed #28050 -- Added template name to TemplateSyntaxError. 2025-04-17 08:56:53 +02:00
Sarah Boyce
098c8bc99c
Disabled Chrome browser pop-ups that were interfering with selenium tests. 2025-04-16 15:00:48 -03:00
Adam Johnson
6ef0f5bc27 Americanized some spellings. 2025-04-16 10:21:38 +02:00
Mikuláš Poul
494d2dc316 Fixed #36274 -- Added support for run_before and atomic in MigrationWriter. 2025-04-16 10:20:49 +02:00
Natalia
5020a9d43a Replaced '' with * for consistent emphasis styling in docs/howto/custom-template-tags.txt. 2025-04-15 14:48:55 -03:00
Ahmed Nassar
be402891cd Fixed #36311 -- Unified spelling of "hardcode" and its variants in docs.
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2025-04-15 14:48:55 -03:00
Ahmed Nassar
abbcef5280 Refs #36311 -- Unified spelling of "flatpage" in docs/ref/contrib/flatpages.txt. 2025-04-15 14:48:55 -03:00
Ahmed Nassar
8bca33f68a Fixed #36269 -- Documented how to test callable storage in FileField. 2025-04-15 10:05:59 +02:00
Ahmed Nassar
2c2f090555 Fixed #35993 -- Documented gettext f-string support limitations.
Thank you to Claude Paroz and Athena Wolfskämpf for the review.
2025-04-15 10:02:25 +02:00
Sarah Boyce
ab1b9cc1b3
Bumped versions in pre-commit and npm configurations. 2025-04-12 19:42:00 +02:00
Baptiste Mispelon
ac16d2876d
Fixed #36320 -- Ignored "duplicated_toc_entry" for ePub docs build. 2025-04-12 19:39:07 +02:00
Simon Charette
21f8be76d4 Fixed #36288 -- Addressed improper handling of duplicates in values_list().
Now that selected aliases are stored in sql.Query.selected: dict[str, Any]
the values_list() method must ensures that duplicate field name references are
assigned unique aliases.

Refs #28900.

Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a.

Thanks Claude for the report.
2025-04-11 09:04:49 +02:00
Andrew
2d1ac1dce8
Refs #36036 -- Removed unsupported 4D GEOS tests. 2025-04-09 22:40:55 -03:00
Sarah Boyce
1429e722f2 Sorted imports in django/templatetags/tz.py per isort. 2025-04-09 11:10:08 +02:00
Ahmed Nassar
522dd021b2 Fixed #35986 -- Fixed test classes with @translation.override decorator.
Co-authored-by: Simon Charette <charette.s@gmail.com>
2025-04-09 09:49:14 +02:00
Mike Edmunds
a627829e7b Refs #35581 -- Updated mail tests to include trailing newlines.
Python's modern email API will force a trailing newline onto all text/*
bodies and attachments. Updated mail tests to include (and check for)
the newline while still using the legacy email API.

See https://github.com/python/cpython/issues/121515 which reasons that,
apart from artificial test cases, most text content already ends in a
newline. If it doesn't, adding one won't change the meaning.
2025-04-09 09:46:10 +02:00
Clifford Gama
a2f7b3a6a0 Clarified url and name arguments in flatpages URLconf ref docs. 2025-04-08 22:02:10 -03:00
Natalia
f9f0a18327 Added missing closing parenthesis in docs/ref/contrib/flatpages.txt. 2025-04-08 22:02:10 -03:00
Simon Charette
71a19a0e47 Fixed #36301 -- Fixed select_for_update(of) crash when using values()/values_list().
Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a which allowed for
annotations to be SELECT'ed before model field references through
values()/values_list() and broke assumptions the select_for_update(of)
table infererence logic had about model fields always being first.

Refs #28900.

Thanks OutOfFocus4 for the report and Sarah for the test.
2025-04-07 22:56:40 +02:00