mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-07-18 16:49:13 +00:00
Code Issues 32 Releases Wiki Activity
27,773 Commits 29 Branches 451 Tags
Commit Graph

10519 Commits

Author SHA1 Message Date
Nick Pope
326a926bee [3.0.x] Fixed CVE-2021-23336 -- Fixed web cache poisoning via django.utils.http.limited_parse_qsl(). 2021-02-18 10:21:04 +01:00
Mariusz Felisiak
52e409ed17 [3.0.x] Fixed CVE-2021-3281 -- Fixed potential directory-traversal via archive.extract(). 
Thanks Florian Apolloner, Shai Berger, and Simon Charette for reviews.

Thanks Wang Baohua for the report.

Backport of 05413afa8c18cdb978fcdf470e09f7a12b234a23 from master.
 2021-02-01 09:14:22 +01:00
Mariusz Felisiak
74ca3cac32 [3.0.x] Fixed GeoIPTest.test04_city() failure with the latest GeoIP2 database. 
Backport of 135c800fe6138d7818501a384c0ebbdc5442762c from master
 2021-01-29 11:03:35 +01:00
Max Smolens
c506639b42 [3.0.x] Fixed #31850 -- Fixed BasicExtractorTests.test_extraction_warning with xgettext 0.21+. 
"format string with unnamed arguments cannot be properly localized"
warning is not raised in xgettext 0.21+.

This patch uses a message that causes an xgettext warning regardless of
the version.

Backport of 07a30f561661efae1691ff45d10ec6014b395b58 from master
 2020-11-02 10:29:51 +01:00
Christian Klus
b0a6798de5 [3.0.x] Fixed #32152 -- Fixed grouping by subquery aliases. 
Regression in 42c08ee46539ef44f8658ebb1cbefb408e0d03fe.

Thanks Simon Charette for the review.

Backport of 4ac2d4fa42e1659f328c35b6b8d4761b3419c11a from master
 2020-10-29 11:33:52 +01:00
Claude Paroz
72a17c919b [3.0.x] Fixed #32110 -- Doc'd and tested enumerations for ChoiceField.choices. 
Backport of 7f85498eef1d8fcc52e4fb70df8041f5452d405a from master
 2020-10-17 21:06:57 +02:00
Mariusz Felisiak
9deb850e23 [3.0.x] Skipped GetImageDimensionsTests.test_webp when WEBP is not installed. 
Bumped minimum Pillow version to 4.2.0 in test requirements.

Backport of fce389af7cf95151118c9fc7cafd777a31f94946 from master
 2020-10-06 11:30:21 +02:00
Mariusz Felisiak
cdb367c92a [3.0.x] Fixed CVE-2020-24584 -- Fixed permission escalation in intermediate-level directories of the file system cache on Python 3.7+. 
Backport of f56b57976133129b0b351a38bba4ac882badabf0 from master.
 2020-08-25 10:45:33 +02:00
Mariusz Felisiak
08892bffd2 [3.0.x] Fixed CVE-2020-24583, #31921 -- Fixed permissions on intermediate-level static and storage directories on Python 3.7+. 
Thanks WhiteSage for the report.

Backport of ea0febbba531a3ecc8c77b570efbfb68ca7155db from master.
 2020-08-25 10:43:50 +02:00
Gert Burger
c33b6ceff4 [3.0.x] Fixed #31863 -- Prevented mutating model state by copies of model instances. 
Regression in bfb746f983aa741afa3709794e70f1e0ab6040b5.

Backport of 94ea79be137f3cb30949bf82198e96e094f2650d from master
 2020-08-13 15:27:52 +02:00
Daniel Hillier
784ed4ada1 [3.0.x] Fixed #31866 -- Fixed locking proxy models in QuerySet.select_for_update(of=()). 
Backport of 60626162f76f26d32a38d18151700cb041201fb3 from master
 2020-08-11 12:31:50 +02:00
Mariusz Felisiak
dcb27ead84 [3.0.x] Fixed #31805 -- Fixed SchemaTests.tearDown() when table names are case-insensitive. 
Backport of fd53db842c35c994dbd54196dd38a908f3676b1a from master
 2020-07-22 12:51:43 +02:00
Mariusz Felisiak
1a81d34e70 [3.0.x] Fixed #31797 -- Skipped schema tests on specific MariaDB versions. 
test_alter_not_unique_field_to_primary_key() test is affected by
https://jira.mariadb.org/browse/MDEV-19598 on MariaDB 10.4.4 to 10.5.1.

test_alter_pk_with_self_referential_field() test is affected by
https://jira.mariadb.org/browse/MDEV-22775 on MariaDB 10.4 series
from 10.4.13.
Backport of c071c408d72330b422c124a6bdd85a68acae9566 from master
 2020-07-22 10:58:47 +02:00
Florian Apolloner
ccc088f8ce [3.0.x] Fixed #31784 -- Fixed crash when sending emails on Python 3.6.11+, 3.7.8+, and 3.8.4+. 
Fixed sending emails crash on email addresses with display names longer
then 75 chars on Python 3.6.11+, 3.7.8+, and 3.8.4+.

Wrapped display names were passed to email.headerregistry.Address()
what caused raising an exception because address parts cannot contain
CR or LF.

See https://bugs.python.org/issue39073

Co-Authored-By: Mariusz Felisiak <felisiak.mariusz@gmail.com>

Backport of 96a3ea39ef0790dbc413dde0a3e19f6a769356a2 from master
 2020-07-20 07:15:14 +02:00
Mariusz Felisiak
331324ecce
[3.0.x] Fixed #31790 -- Fixed setting SameSite cookies flag in HttpResponse.delete_cookie(). 
Cookies with the "SameSite" flag set to None and without the "secure"
flag will be soon rejected by latest browser versions.

This affects sessions and messages cookies.

Backport of 240cbb63bf9965c63d7a3cc9032f91410f414d46 from master.
 2020-07-16 09:30:15 +02:00
Ad Timmering
d1ff7c50e3 [3.0.x] Fixed #30807 -- Fixed TestArchive.test_extract_file_permissions() when umask is 0o000. 
Fixed test that checks permissions on files extracted from archives
with no permissions set, to not assume a default umask of 0o002.

Test regression in c95d063e776e849cf1a0bf616c654165cb89c706.
Backport of ec5aa2161d8015a3fe57dcbbfe14200cd18f0a16 from master
 2020-06-29 07:52:47 +02:00
Simon Charette
453a5bf302 [3.0.x] Fixed #31735 -- Fixed migrations crash on namespaced inline FK addition on PostgreSQL. 
The namespace of the constraint must be included when making the
constraint immediate.

Regression in 22ce5d0031bd795ade081394043833e82046016c.

Thanks Rodrigo Estevao for the report.

Backport of 2e8941b6f90e65ffad3f07083b8de59e8ed29767 from master
 2020-06-24 09:00:22 +02:00
Mariusz Felisiak
e2cdbc585a
[3.0.x] Refs #31660 -- Fixed annotations.tests crash on MySQL. 
Follow up to be7a295141337189b9eceea506489bdfe07f199e.
 2020-06-11 10:36:24 +02:00
Nicolas Baccelli
2b2500021b [3.0.x] Fixed #31664 -- Reallowed using non-expressions having filterable attribute as rhs in queryset filters. 
Regression in 4edad1ddf6203326e0be4bdb105beecb0fe454c4.

Backport of b38d44229ff185ad156bcb443d6db0db7ae3eb98 from master
 2020-06-08 09:20:08 +02:00
Mariusz Felisiak
be7a295141 [3.0.x] Fixed #31660 -- Fixed queryset crash when grouping by m2o relation. 
Regression in 3a941230c85b2702a5e1cd97e17251ce21057efa.

Thanks Tomasz Szymański for the report.
Backport of 78ad4b4b0201003792bfdbf1a7781cbc9ee03539 from master
 2020-06-08 07:23:33 +02:00
Mariusz Felisiak
e8723af44b [3.0.x] Fixed #31654 -- Fixed cache key validation messages. 
Backport of 926148ef019abcac3a9988c78734d9336d69f24e from master
 2020-06-05 07:22:52 +02:00
Mariusz Felisiak
88dc69fcec [3.0.x] Refs CVE-2020-13254 -- Fixed cache.tests when KEY_PREFIX is defined. 
Follow up to 2c82414914ae6476be5a166be9ff49c24d0d9069.

Backport of 229c9c6653356a0bc23846d83b2d4b5d0438a145 from master
 2020-06-03 13:01:21 +02:00
Dan Palmer
84b2da5552 [3.0.x] Fixed CVE-2020-13254 -- Enforced cache key validation in memcached backends. 2020-06-03 09:33:20 +02:00
Jon Dufresne
1f2dd37f6f [3.0.x] Fixed CVE-2020-13596 -- Fixed potential XSS in admin ForeignKeyRawIdWidget. 2020-06-03 09:32:35 +02:00
Carlton Gibson
2638627db4 [3.0.x] Fixed #31570 -- Corrected translation loading for apps providing territorial language variants with different plural equations. 
Regression in e3e48b00127c09eafe6439d980a82fc5c591b673.

Thanks to Shai Berger for report, reproduce and suggested fix.

Backport of dd1ca50b096bf0351819aabc862e91a9797ddaca from master
 2020-06-01 09:27:53 +02:00
Mariusz Felisiak
0ba5aadb33 [3.0.x] Fixed #31607 -- Fixed evaluated Subquery equality. 
Regression in 691def10a0197d83d2d108bd9043b0916d0f09b4.

Backport of a125da6a7c79b1d4c55677d0bed6f9b1d7d77353 from master
 2020-05-19 22:51:01 +02:00
Mariusz Felisiak
92acf1022f [3.0.x] Fixed #31584 -- Fixed crash when chaining values()/values_list() after Exists() annotation and aggregation on Oracle. 
Oracle requires the EXISTS expression to be wrapped in a CASE WHEN in
the GROUP BY clause.

Regression in efa1908f662c19038a944129c81462485c4a9fe8.
Backport of 3a941230c85b2702a5e1cd97e17251ce21057efa from master
 2020-05-14 15:11:18 +02:00
Simon Charette
49bbf6570d [3.0.x] Fixed #31568 -- Fixed alias reference when aggregating over multiple subqueries. 
691def10a0197d83d2d108bd9043b0916d0f09b4 made all Subquery() instances
equal to each other which broke aggregation subquery pushdown which
relied on object equality to determine which alias it should select.

Subquery.__eq__() will be fixed in an another commit but
Query.rewrite_cols() should haved used object identity from the start.

Refs #30727, #30188.

Thanks Makina Corpus for the report.

Backport of adfbf653dc1c1d0e0dacc4ed46602d22ba28b004 from master
 2020-05-14 10:26:16 +02:00
Simon Charette
afceb2241b [3.0.x] Fixed #31566 -- Fixed aliases crash when chaining values()/values_list() after annotate() with aggregations and subqueries. 
Subquery annotation references must be resolved if they are excluded
from the GROUP BY clause by a following .values() call.

Regression in fb3f034f1c63160c0ff13c609acd01c18be12f80.

Thanks Makina Corpus for the report.

Backport of 42c08ee46539ef44f8658ebb1cbefb408e0d03fe from master
 2020-05-14 08:40:40 +02:00
Mariusz Felisiak
48ed73fb74 [3.0.x] Fixed E128, E741 flake8 warnings. 
Backport of 0668164b4ac93a5be79f5b87fae83c657124d9ab from master.
 2020-05-12 08:55:06 +02:00
Adam Johnson
cdf320dfb2 [3.0.x] Fixed a/an typos in "SQL" usage. 
Backport of 1c2c6f1b51a540bddc7ae95f4d1213688411ca44 from master
 2020-05-06 06:36:16 +02:00
Mariusz Felisiak
fdd5eb4309 [3.0.x] Fixed #31538 -- Fixed Meta.ordering validation lookups that are not transforms. 
Regression in 440505cb2cadbe1a5b9fba246bcde6c04f51d07e.

Thanks Simon Meers for the report.
Backport of b73e66e75802f10cc34d4880714554cea54dbf49 from master
 2020-05-05 09:09:17 +02:00
Hasan Ramezani
8e23b89ffd [3.0.x] Fixed #31521 -- Skipped test_parsing_rfc850 test on 32-bit systems. 
Backport of f12162107327b88a2f1faaab15d048e2535ec642 from master
 2020-04-30 07:13:25 +02:00
Hasan Ramezani
22a2e97fc3 [3.0.x] Fixed #31420 -- Fixed crash when filtering subquery annotation against a SimpleLazyObject. 
Thanks Simon Charette for the solution and analysis.

Backport of 4237050684427db45ea834fe89d9e11c0520201e from master
 2020-04-06 08:15:51 +02:00
Hasan Ramezani
72652bcb1b [3.0.x] Fixed #31377 -- Disabled grouping by aliases on QuerySet.values()/values_list() when they collide with field names. 
Regression in fb3f034f1c63160c0ff13c609acd01c18be12f80.

Thanks Holovashchenko Vadym for the report.

Backport of 10866a10fe9f0ad3ffdf6f93823aaf4716e6f27c from master
 2020-03-25 09:49:51 +01:00
Claude Paroz
d9f1792c76 [3.0.x] Fixed #30439 -- Added support for different plural forms for a language. 
Thanks to Michal Čihař for review.
Backport of e3e48b00127c09eafe6439d980a82fc5c591b673 from master
 2020-03-10 15:57:36 +01:00
Mariusz Felisiak
8e30512e7a [3.0.x] Fixed GeoQuerySetTest.test_unionagg_tolerance() test on Oracle 18c. 
Backport of 5ca76baa729bbbe62f5c4a0fc4f89747dc999029 from master
 2020-03-05 08:56:09 +01:00
Mariusz Felisiak
26a5cf8345 [3.0.x] Fixed CVE-2020-9402 -- Properly escaped tolerance parameter in GIS functions and aggregates on Oracle. 
Thanks to Norbert Szetei for the report.
 2020-03-04 09:16:03 +01:00
Mariusz Felisiak
c5cfaad2f1 [3.0.x] Fixed #31150 -- Included subqueries that reference related fields in GROUP BY clauses. 
Thanks Johannes Hoppe for the report.

Regression in fb3f034f1c63160c0ff13c609acd01c18be12f80.

Co-authored-by: Simon Charette <charette.s@gmail.com>

Backport of 7b8fa1653fde578ab3a496d9974ab1d4261b8b26 from master
 2020-03-03 11:26:36 +01:00
Mariusz Felisiak
94e192a580 [3.0.x] Refs #31312 -- Fixed FTimeDeltaTests.test_date_case_subtraction() test. 
Follow up to 16cacdcb3f7856df5454b648503374de150fa245.
 2020-02-27 20:18:53 +01:00
Simon Charette
16cacdcb3f [3.0.x] Fixed #31312 -- Properly ordered temporal subtraction params on MySQL. 
Regression in 9bcbcd599abac91ea853b2fe10b784ba32df043e.

Thanks rick2ricks for the report.

Backport of 41ebe60728a15aa273f4d70de92f5246a89c3d4e from master
 2020-02-27 09:20:30 +01:00
Mariusz Felisiak
2448b3182c [3.0.x] Fixed #31271 -- Preserved ordering when unifying query parameters on Oracle. 
This caused misplacing parameters in logged SQL queries.

Regression in 79065b55a70cd220820a260a1c54851b7be0615a.

Thanks Hans Aarne Liblik for the report.
Backport of 2a038521c4eabdc5f6d5026d3dd6d22868e329cd from master
 2020-02-18 11:46:01 +01:00
Abhijeet Viswa
8faaaf4e71 [3.0.x] Fixed #31246 -- Fixed locking models in QuerySet.select_for_update(of=()) for related fields and parent link fields with multi-table inheritance. 
Partly regression in 0107e3d1058f653f66032f7fd3a0bd61e96bf782.

Backport of 1712a76b9dfda1ef220395e62ea87079da8c9f6c from master
 2020-02-11 21:36:05 +01:00
Florian Apolloner
4e8d6a1baf [3.0.x] Fixed #31240 -- Properly closed FileResponse when wsgi.file_wrapper is used. 
Thanks to Oskar Persson for the report.

Backport of 41a3b3d18647b258331104520e76f977406c590d from master
 2020-02-11 20:40:24 +01:00
Florian Apolloner
22c25bea54 [3.0.x] Reverted "Fixed #30565 -- Closed HttpResponse when wsgi.file_wrapper closes file-like object." 
This reverts commit cce47ff65a4dd3786c049ec14ee889e128ca7de9.

Backport of 549445519ce90cc5c1e3f981853cc0c67725f3ed from master
 2020-02-11 20:40:17 +01:00
Jon Dufresne
7540b7eb31 [3.0.x] Fixed #31253 -- Fixed data loss possibility when using caching from async code. 
Case missed in a415ce70bef6d91036b00dd2c8544aed7aeeaaed.

Backport of e3f6e18513224c8ad081e5a19da641f49b0b43da from master
 2020-02-11 10:12:53 +01:00
Simon Charette
505826b469 [3.0.x] Fixed CVE-2020-7471 -- Properly escaped StringAgg(delimiter) parameter. 2020-02-03 08:32:54 +01:00
Mariusz Felisiak
673444da5e [3.0.x] Fixed #31217 -- Made QuerySet.values()/values_list() group by not selected annotations with aggregations used in order_by(). 
Regression in 59b4e99dd00b9c36d56055b889f96885995e4240.

Thanks Jon Dufresne for the report and Simon Charette for the review.
Backport of 6b178a3e930f72069f3cda2e6a09d1b320fc09ec from master
 2020-02-03 07:48:53 +01:00
Eugene Hatsko
a56e45a2bf [3.0.x] Fixed #31190 -- Fixed prefetch_related() crash for GenericForeignKey with custom ContentType foreign key. 
Regression in dffa3e1992562ba60512d96d1eb5859ffff2ceb5.

Backport of 0b013564ef0609d95b1d263626f2e15bccda1a50 from master
 2020-01-22 08:25:23 +01:00
Sergey Fedoseev
d7e4d6463c [3.0.x] Fixed #31195 -- Relaxed GeometryDistance test for PROJ 5.2+. 
Backport of 31e2ab345b272b309770262067710589ec433e79 from master
 2020-01-21 22:51:45 +01:00