The parsed values of Accept-Language headers are cached in order to
avoid repetitive parsing. This leads to a potential denial-of-service
vector via excessive memory usage if the raw value of Accept-Language
headers is very large.
Accept-Language headers are now limited to a maximum length in order
to avoid this issue.
Use FlexibleFieldLookupDict which is case-insensitive mapping because
SQLite 3.37+ returns some data type names upper-cased e.g. TEXT.
Backport of 974e3b8750fe96c16c9c0b115a72ee4a2171df34 from main
Thanks Splunk team: Preston Elder, Jacob Davis, Jacob Moore,
Matt Hanson, David Briggs, and a security researcher: Danylo Dmytriiev
(DDV_UA) for the report.
Backport of 93cae5cb2f9a4ef1514cf1a41f714fef08005200 from main.
Grouping by LOBs is not allowed on Oracle. This moves a binary field to
a separate model.
Backport of d3a64bea51676fcf8a0ae593cf7b103939e12c87 from main
This makes models.BinaryField pickleable on PostgreSQL.
Regression in 3cf80d3fcf7446afdde16a2be515c423f720e54d.
Thanks Adam Zimmerman for the report.
Backport of 2c7846d992ca512d36a73f518205015c88ed088c from main.
This adjusts Expressions.rename_table_references() to only update alias
when needed.
Regression in 83fcfc9ec8610540948815e127101f1206562ead.
Co-authored-by: Simon Charette <charettes@users.noreply.github.com>
Backport of 86971c40909430a798e4e55b140004c4b1fb02ff from main.
test_server_login() was a regression test for a crash when passing
Unicode strings to SMTP server using CRAM-MD5 method on Python 2.
Python 2 is no longer supported and test_server_login() passes even
without FakeSMTPChannel.smtp_AUTH() because
smtplib.SMTPAuthenticationError is raised when AUTH is not implemented.
Backport of cdad96e6330cd31185f7496aaf8eb316f2773d6d from main
Thanks Benjamin Locher for the report.
Regression in 30e59705fc3e3e9e8370b965af794ad6173bf92b.
Backport of b0ed619303d2fb723330ca9efa3acf23d49f1d19 from main
DecimalField must itself validate() values, such as NaN, which cannot be
passed to validators, such as MaxValueValidator, during the
run_validators() phase.
Regression in cc3d24d7d577f174937a0744d886c4c7123cfa85.
Backport of c542d0a07237033225c1d57337ca9474a00648f2 from main
Regression introduced in 513948735b799239f3ef8c89397592445e1a0cd5
by marking the raw SQL column reference feature for deprecation in
Django 4.0 while lifting the column format validation.
In retrospective the validation should have been kept around and the
user should have been pointed at using RawSQL expressions during the
deprecation period.
The main branch is not affected because the raw SQL column reference
support has been removed in 06eec3197009b88e3a633128bbcbd76eea0b46ff
per the 4.0 deprecation life cycle.
Thanks Joel Saunders for the report.
Regression in b5e12d490af3debca8c55ab3c1698189fdedbbdb.
Thanks Iuri de Silvio for the report.
Backport of 7a9745fed498f69c46a3ffa5dfaff872e0e1df89 from main
Regression in d4ac23bee1c84d8e4610350202ac068fc90f38c0.
Thanks Omkar Deshpande for the report.
Backport of fa0433d05f213afe4c67055006320f7aba4c8108 from main
MySQL 8.0.13+ supports defaults for BLOB/TEXT but not in the
ALTER COLUMN statement.
Regression in 6b16c91157512587017e9178d066ed1a683e7795.
Thanks Matt Westcott for the report.
Backport of 5e04e84d67da8163f365e9f5fcd169e2630e2873 from main
validate_ipv4_address() was affected only on Python < 3.9.5, see [1].
URLValidator() uses a regular expressions and it was affected on all
Python versions.
[1] https://bugs.python.org/issue36384
Regression in 1e38f1191de21b6e96736f58df57dfb851a28c1f.
Thanks Mohsen Tamiz for the report.
Backport of e703b152c6148ddda1b072a4353e9a41dca87f90 from main
Regression in ec6d2531c59466924b645f314ac33f54470d7ac3.
Thanks JonathanNickelson for the report.
Backport of 12b19a1d76e1a6f80923c8358290d605dacd65d4 from main
Thanks Alexander Ebral for the report.
Regression in 98e05ccde440cc9b768952cc10bc8285f4924e1f.
Backport of 958cdf65ae90d26236d1815bbba804729595ec7a from main
