mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-07-19 09:09:13 +00:00
Code Issues 32 Releases Wiki Activity
27,581 Commits 29 Branches 451 Tags
Commit Graph

10482 Commits

Author SHA1 Message Date
Mariusz Felisiak
26a5cf8345 [3.0.x] Fixed CVE-2020-9402 -- Properly escaped tolerance parameter in GIS functions and aggregates on Oracle. 
Thanks to Norbert Szetei for the report.
 2020-03-04 09:16:03 +01:00
Mariusz Felisiak
c5cfaad2f1 [3.0.x] Fixed #31150 -- Included subqueries that reference related fields in GROUP BY clauses. 
Thanks Johannes Hoppe for the report.

Regression in fb3f034f1c63160c0ff13c609acd01c18be12f80.

Co-authored-by: Simon Charette <charette.s@gmail.com>

Backport of 7b8fa1653fde578ab3a496d9974ab1d4261b8b26 from master
 2020-03-03 11:26:36 +01:00
Mariusz Felisiak
94e192a580 [3.0.x] Refs #31312 -- Fixed FTimeDeltaTests.test_date_case_subtraction() test. 
Follow up to 16cacdcb3f7856df5454b648503374de150fa245.
 2020-02-27 20:18:53 +01:00
Simon Charette
16cacdcb3f [3.0.x] Fixed #31312 -- Properly ordered temporal subtraction params on MySQL. 
Regression in 9bcbcd599abac91ea853b2fe10b784ba32df043e.

Thanks rick2ricks for the report.

Backport of 41ebe60728a15aa273f4d70de92f5246a89c3d4e from master
 2020-02-27 09:20:30 +01:00
Mariusz Felisiak
2448b3182c [3.0.x] Fixed #31271 -- Preserved ordering when unifying query parameters on Oracle. 
This caused misplacing parameters in logged SQL queries.

Regression in 79065b55a70cd220820a260a1c54851b7be0615a.

Thanks Hans Aarne Liblik for the report.
Backport of 2a038521c4eabdc5f6d5026d3dd6d22868e329cd from master
 2020-02-18 11:46:01 +01:00
Abhijeet Viswa
8faaaf4e71 [3.0.x] Fixed #31246 -- Fixed locking models in QuerySet.select_for_update(of=()) for related fields and parent link fields with multi-table inheritance. 
Partly regression in 0107e3d1058f653f66032f7fd3a0bd61e96bf782.

Backport of 1712a76b9dfda1ef220395e62ea87079da8c9f6c from master
 2020-02-11 21:36:05 +01:00
Florian Apolloner
4e8d6a1baf [3.0.x] Fixed #31240 -- Properly closed FileResponse when wsgi.file_wrapper is used. 
Thanks to Oskar Persson for the report.

Backport of 41a3b3d18647b258331104520e76f977406c590d from master
 2020-02-11 20:40:24 +01:00
Florian Apolloner
22c25bea54 [3.0.x] Reverted "Fixed #30565 -- Closed HttpResponse when wsgi.file_wrapper closes file-like object." 
This reverts commit cce47ff65a4dd3786c049ec14ee889e128ca7de9.

Backport of 549445519ce90cc5c1e3f981853cc0c67725f3ed from master
 2020-02-11 20:40:17 +01:00
Jon Dufresne
7540b7eb31 [3.0.x] Fixed #31253 -- Fixed data loss possibility when using caching from async code. 
Case missed in a415ce70bef6d91036b00dd2c8544aed7aeeaaed.

Backport of e3f6e18513224c8ad081e5a19da641f49b0b43da from master
 2020-02-11 10:12:53 +01:00
Simon Charette
505826b469 [3.0.x] Fixed CVE-2020-7471 -- Properly escaped StringAgg(delimiter) parameter. 2020-02-03 08:32:54 +01:00
Mariusz Felisiak
673444da5e [3.0.x] Fixed #31217 -- Made QuerySet.values()/values_list() group by not selected annotations with aggregations used in order_by(). 
Regression in 59b4e99dd00b9c36d56055b889f96885995e4240.

Thanks Jon Dufresne for the report and Simon Charette for the review.
Backport of 6b178a3e930f72069f3cda2e6a09d1b320fc09ec from master
 2020-02-03 07:48:53 +01:00
Eugene Hatsko
a56e45a2bf [3.0.x] Fixed #31190 -- Fixed prefetch_related() crash for GenericForeignKey with custom ContentType foreign key. 
Regression in dffa3e1992562ba60512d96d1eb5859ffff2ceb5.

Backport of 0b013564ef0609d95b1d263626f2e15bccda1a50 from master
 2020-01-22 08:25:23 +01:00
Sergey Fedoseev
d7e4d6463c [3.0.x] Fixed #31195 -- Relaxed GeometryDistance test for PROJ 5.2+. 
Backport of 31e2ab345b272b309770262067710589ec433e79 from master
 2020-01-21 22:51:45 +01:00
Mariusz Felisiak
5b6778b8b9 [3.0.x] Refs #31097 -- Added django.db.models.Q import to contrib.postgres aggregates tests. 2020-01-17 09:13:11 +01:00
Carlton Gibson
57468eaff3 [3.0.x] Fixed #31124 -- Fixed setting of get_FOO_display() when overriding inherited choices. 
Regression in 2d38eb0ab9f78d68c083a5b78b1eca39027b279a

Backport of 29c126bb349526b5f1cd78facbe9f25906f18563 from master
 2020-01-15 15:36:28 +01:00
Mariusz Felisiak
a24686987f [3.0.x] Refs #31136 -- Made QuerySet.values()/values_list() group only by selected annotation. 
Regression in 0f843fdd5b9b2f2307148465cd60f4e1b2befbb4.
Backport of 59b4e99dd00b9c36d56055b889f96885995e4240 from master
 2020-01-15 09:33:36 +01:00
David Wobrock
0e6cf4393c [3.0.x] Fixed #31097 -- Fixed crash of ArrayAgg and StringAgg with filter when used in Subquery. 
Backport of 2f565f84aca136d9cc4e4d061f3196ddf9358ab8 from master
 2020-01-14 09:49:56 +01:00
Mariusz Felisiak
92866682c6 [3.0.x] Fixed #31155 -- Fixed a system check for the longest choice when a named group contains only non-string values. 
Regression in b6251956b69512bf230322bd7a49b629ca8455c6.

Thanks Murat Guchetl for the report.
Backport of 6f7998adc784032f4b8918ca2eea27537ea4cbbe from master
 2020-01-11 19:49:38 +01:00
Adam Johnson
16297e7d5e [3.0.x] Fixed #31154 -- Added support for using enumeration types in templates. 
Enumeration helpers are callables, so the template system tried to call
them with no arguments.

Thanks Rupert Baker for helping discover this.

Backport of 5166097d7c80cab757e44f2d02f3d148fbbc2ff6 from master
 2020-01-10 09:13:36 +01:00
Mariusz Felisiak
0379da59bd [3.0.x] Fixed #31141 -- Relaxed system check of translation settings for sublanguages. 
Regression in 4400d8296d268f5a8523cd02ddc33b12219b2535.

Thanks Enrique Matías Sánchez for the report.
Backport of 53d8646f799de7f92ab9defe9dc56c6125448102 from master
 2020-01-08 08:06:33 +01:00
Mariusz Felisiak
f9110a1b6d [3.0.x] Fixed timezones tests for PyYAML 5.3+. 
Backport of 8be477be5c1a4afc9ad00bb58a324f637e018c0f from master
 2020-01-07 09:55:15 +01:00
Mariusz Felisiak
4f81f6d236 [3.0.x] Fixed #31136 -- Disabled grouping by aliases on QuerySet.values()/values_list(). 
Regression in fb3f034f1c63160c0ff13c609acd01c18be12f80.

Thanks Sigurd Ljødal for the report.
Backport of 0f843fdd5b9b2f2307148465cd60f4e1b2befbb4 from master
 2020-01-04 20:49:43 +01:00
Simon Charette
02cda09b13 [3.0.x] Fixed #31133 -- Fixed crash when subtracting against a subquery annotation. 
The subtract_temporals() database operation was not handling expressions
returning SQL params in mixed database types.

Regression in 35431298226165986ad07e91f9d3aca721ff38ec.

Thanks Reupen Shah for the report.

Backport of 9bcbcd599abac91ea853b2fe10b784ba32df043e from master
 2020-01-03 10:35:44 +01:00
Mariusz Felisiak
09b4224e11 [3.0.x] Refs #31040 -- Fixed crypt.crypt() call in test_hashers.py. 
An empty string is invalid salt in Python 3 and raises exception since
Python 3.9, see https://bugs.python.org/issue38402.
Backport of 1960d55f8baa412b43546d15a8342554808fff57 from master
 2020-01-03 07:47:56 +01:00
Simon Charette
7db4ab8439 [3.0.x] Fixed #31071 -- Disabled insert optimization for primary keys with defaults when loading fixtures. 
Model.save_base() is called directly when loading fixtures and assumes
existing rows will be updated. Branching of "raw" allows to maintain
the optimization introduced in #29260 while supporting this edge case.

Regression in 85458e94e38c20e57939947ee515a1a53689659f.

Thanks Reupen Shah for the report.

Backport of 5779cc938a34eb96815c7a40ded2c8f6c8087c58 from master
 2019-12-30 08:30:44 +01:00
Mariusz Felisiak
0f8041abd5 [3.0.x] Fixed #31106 -- Fixed migrations crash on PostgreSQL 10+ when adding FK constraints inline and changing data. 
This allows adding foreign key constraints inline and changing data in
the same migration on PostgreSQL 10+.

Regression in 738faf9da2a5cd03148a36375db80746c99c9623.

Thanks Janne Rönkkö for the report and Simon Charette for the
implementation idea and review.
Backport of 22ce5d0031bd795ade081394043833e82046016c from master
 2019-12-23 23:30:30 +01:00
Mariusz Felisiak
1e45b06cfd [3.0.x] Refs #31115 -- Added test for nested subquery that references related fields. 
Thanks Dmitriy Gunchenko for the report and Simon Charette for the
analysis and tests.

Regression in 5a4d7285bd10bd40d9f7e574a7c421eb21094858.

Fixed in 5a4d7285bd10bd40d9f7e574a7c421eb21094858.
Backport of 45bcc6feac68165eb3642d3c308c74b4828e679e from master
 2019-12-23 12:18:52 +01:00
Simon Charette
7b065c41e4 [3.0.x] Fixed #31109 -- Disabled grouping by aliases on QuerySet.exists(). 
Clearing the SELECT clause in Query.has_results was orphaning GROUP BY
references to it.

Thanks Thierry Bastian for the report and Baptiste Mispelon for the
bisect.

Regression in fb3f034f1c63160c0ff13c609acd01c18be12f80.

Backport of 720de4d0441fcfdb543051389c70efbe66ed962a from master
 2019-12-23 09:24:37 +01:00
Simon Charette
fd9050589f [3.0.x] Fixed #31094 -- Included columns referenced by subqueries in GROUP BY on aggregations. 
Thanks Johannes Hoppe for the report.

Regression in fb3f034f1c63160c0ff13c609acd01c18be12f80.

Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>

Backport of 5a4d7285bd10bd40d9f7e574a7c421eb21094858 from master
 2019-12-19 11:10:33 +01:00
Simon Charette
302a4ff1e8 [3.0.x] Fixed CVE-2019-19844 -- Used verified user email for password reset requests. 
Backport of 5b1fbcef7a8bec991ebe7b2a18b5d5a95d72cb70 from master.

Co-Authored-By: Florian Apolloner <florian@apolloner.eu>
 2019-12-18 09:14:44 +01:00
Peter Andersen
74e1454113 [3.0.x] Fixed #31073 -- Prevented CheckboxInput.get_context() from mutating attrs. 
Backport of 02eff7ef60466da108b1a33f1e4dc01eec45c99d from master
 2019-12-11 09:37:34 +01:00
Alex Aktsipetrov
8af07712df [3.0.x] Fixed #31060 -- Reallowed window expressions to be used in conditions outside of queryset filters. 
Regression in 4edad1ddf6203326e0be4bdb105beecb0fe454c4.

Thanks utapyngo for the report.

Backport of bf12273db4e53779546e2ac7b65c0ce8e3c8a640 from master.
 2019-12-06 15:28:23 +01:00
Mariusz Felisiak
e986e49e66 [3.0.x] Fixed #31061 -- Ignored positional args in django.urls.resolve() when all optional named parameters are missing. 
Regression in 76b993a117b61c41584e95149a67d8a1e9f49dd1.

Thanks Claude Paroz for the report and Carlton Gibson for reviews.
Backport of 82a88d2f48e13ef5d472741d5ed1c183230cfe4c from master
 2019-12-06 09:33:45 +01:00
Andrew Godwin
9243435b5e [3.0.x] Fixed #31056 -- Allowed disabling async-unsafe check with an environment variable. 
Backport of c90ab30fa1305481024b9c3c50b5a6ed6cd9a2f5 from master
 2019-12-03 17:50:24 +01:00
Carlton Gibson
092cd66cf3 Fixed CVE-2019-19118 -- Required edit permissions on parent model for editable inlines in admin. 
Thank you to Shen Ying for reporting this issue.
 2019-12-02 08:57:44 +01:00
Mariusz Felisiak
f4ed6800bd [3.0.x] Fixed #30953 -- Made select_for_update() lock queryset's model when using "self" with multi-table inheritance. 
Thanks Abhijeet Viswa for the report and initial patch.
Backport of 0107e3d1058f653f66032f7fd3a0bd61e96bf782 from master
 2019-12-02 07:58:04 +01:00
Mariusz Felisiak
ca9144a4a8 [3.0.x] Fixed #31021 -- Fixed proxy model permissions data migration crash with a multiple databases setup. 
Regression in 98296f86b340c8c9c968375d59f1d3a3479e60c2.

Backport of e8fcdaad5c428878d0a5d6ba820d957013f75595 from master
 2019-11-29 11:10:36 +01:00
Baptiste Mispelon
3ed55606c4 [3.0.x] Fixed #31031 -- Fixed data loss in admin changelist view when formset's prefix contains regex special chars. 
Regression in b18650a2634890aa758abae2f33875daa13a9ba3.

Backport of 52936efacec4df05df2d9872c09c3332335bf21b from master
 2019-11-26 09:19:19 +01:00
John Bowen
b6cbc88f26 [3.0.x] Fixed #27914 -- Fixed serialization of nested classes in migrations. 
Backport of 29d8198841ea39af44f3bc835d646e642d498475 from master
 2019-11-25 11:27:15 +01:00
John Bowen
ba5760965e [3.0.x] Refs #23950 --- Moved test DeconstructibleInstances class to a module level. 
DeconstructibleInstances was not importable from the asserted path.

Backport of 8008795a3899d979d65832ca7c4946903de206f7 from master
 2019-11-25 11:27:09 +01:00
Carlton Gibson
947f8e3485 [3.0.x] Fixed #31012 -- Reverted "Fixed #29056 -- Fixed HTML5 validation of required SelectDateWidget." 
This reverts commit f038214d917c982613f5a15db8dfe325b1f7479b.

The initial issue was incorrect. Django 2.2, and before, did not
generate invalid HTML as reported. With f03821 in place invalid HTML
was generated.

Thanks to Kevin Brown for follow-up report and investigation.
Backport of ee4a19053a32d41cdd79e087b1968980804ce658 from master
 2019-11-21 21:06:07 +01:00
Carlton Gibson
0e58745716 [3.0.x] Pinned asgiref to 3.2 series. 
Backport of 36453526d3e1a5829864f106d6baa0ebdb20537e from master
 2019-11-20 15:13:28 +01:00
Mariusz Felisiak
b6be0699b9 [3.0.x] Fixed #30986 -- Fixed queryset crash when filtering against boolean RawSQL expressions on Oracle. 
Backport of 8685e764efd2957085762d9249e07794d9a58dcb from master
 2019-11-18 09:16:21 +01:00
George Marshall
fa6076daf4 [3.0.x] Fixed #30971 -- Prevented Query.resolve_lookup_value() from coercing list values to tuples. 
Regression in 8a281aa7fe76a9da2284f943964a9413697cff1f.

Backport of 8be79984dce7d819879a6e594ca69c5f95a08378 from master
 2019-11-13 09:20:50 +01:00
Hannes Ljungberg
8d3f43f7a9 [3.0.x] Fixed #30967 -- Fixed TrigramTest failures on PostgreSQL 12+. 
Backport of 6e2f05b2e33a6c80c7a411ce76af7b5a08acb835 from master
 2019-11-11 13:30:14 +01:00
Stephen Rauch
76d293f3e6 [3.0.x] Refs #30183 -- Doc'd dropping support for sqlparse < 0.2.2. 
Support for sqlparse < 0.2.2 was broken in
782d85b6dfa191e67c0f1d572641d8236c79174c because is_whitespace property
was added in sqlparse 0.2.2.

Backport of 4b6db766ba4b613d317c87f87d1d63865b7424a4 from master
 2019-11-06 09:01:48 +01:00
Carlton Gibson
dd2ca8b0ea [3.0.x] Fixed #30931 -- Restored ability to override Model.get_FIELD_display(). 
Thanks Sergey Fedoseev for the implementation idea.

Regression in a68ea231012434b522ce45c513d84add516afa60.

Backport of 2d38eb0ab9f78d68c083a5b78b1eca39027b279a from master
 2019-11-04 08:15:03 +01:00
Carlton Gibson
8740ff334a [3.0.x] Fixed #30902 -- Added __str__() for model choice enums. 
Allows expected behavior when cast to str, also matching behaviour of
created instances with those fetched from the DB.

Thanks to Simon Charette, Nick Pope, and Shai Berger for reviews.

Backport of dbcd7b064e7278614f29fc45468d461e263d4da7 from master
 2019-10-25 09:38:41 +02:00
Carlton Gibson
06e3c6db86 [3.0.x] Fixed #30900 -- Skipped async-related tests on Windows using Python 3.8.0. 
Refs https://bugs.python.org/issue38563.
Backport of e83c300a3312995d46315616f4361dfa110c741b from master
 2019-10-24 10:43:37 +02:00
Hannes Ljungberg
318d186d7e [3.0.x] Fixed #30903 -- Fixed migrations crash on PostgreSQL when adding Index with opclasses and ordering. 
Backport of fa5f3291e7f2611d53e64ab481ebe951b0161791 from master
 2019-10-24 09:51:33 +02:00