1
0
mirror of https://github.com/django/django.git synced 2025-07-07 11:19:12 +00:00

3934 Commits

Author SHA1 Message Date
Carlton Gibson
70840232f9 [3.2.x] Confirmed release date for Django 3.2.6.
Backport of 74a86e9b5eaf4f0d2bb5bf6b7948000c75cdd4a6 from main
2021-08-02 06:56:33 +02:00
Tom Wojcik
b2f7b53fac [3.2.x] Fixed #32947 -- Fixed hash() crash on reverse M2M relation when through_fields is a list.
Regression in c32d8f33d8e988a376e44997b8f3606d821f305e.

Backport of 20226fcd461670334646f78a0c4d133e439b12b2 from main
2021-07-26 06:41:31 +02:00
Carlton Gibson
f4cf86f870 [3.2.x] Refs #32949 -- Adjusted release note wording.
Backport of 012f38f9594b35743e9ab231757b7b62db638323 from main
2021-07-21 12:32:23 +02:00
yakimka
1346381760 [3.2.x] Fixed #32949 -- Restored invalid number handling in DecimalField.validate().
DecimalField must itself validate() values, such as NaN, which cannot be
passed to validators, such as MaxValueValidator, during the
run_validators() phase.

Regression in cc3d24d7d577f174937a0744d886c4c7123cfa85.

Backport of c542d0a07237033225c1d57337ca9474a00648f2 from main
2021-07-21 11:23:43 +02:00
Jacob Walls
9a65e62c93 [3.2.x] Fixed typo in docs/releases/3.1.13.txt.
Backport of 00c724f2f255bd3c28a73cc51db8a052644ff949 from main
2021-07-16 20:30:48 +02:00
Mariusz Felisiak
9fadb97583 [3.2.x] Added CVE-2021-35042 to security archive.
Backport of 8feb2a49fa37528823cc900bbd9609319738193e from main
2021-07-01 10:01:23 +02:00
Mariusz Felisiak
92efd69107 [3.2.x] Added stub release notes for Django 3.2.6.
Backport of bcea1a3193d44d8c587173c00abb2eaf61fb9cf7 from main
2021-07-01 09:44:18 +02:00
Simon Charette
a34a5f724c [3.2.x] Fixed CVE-2021-35042 -- Prevented SQL injection in QuerySet.order_by().
Regression introduced in 513948735b799239f3ef8c89397592445e1a0cd5
by marking the raw SQL column reference feature for deprecation in
Django 4.0 while lifting the column format validation.

In retrospective the validation should have been kept around and the
user should have been pointed at using RawSQL expressions during the
deprecation period.

The main branch is not affected because the raw SQL column reference
support has been removed in 06eec3197009b88e3a633128bbcbd76eea0b46ff
per the 4.0 deprecation life cycle.

Thanks Joel Saunders for the report.
2021-07-01 08:29:23 +02:00
Mariusz Felisiak
da2269dc6f [3.2.x] Added stub release notes for 3.1.13 and release date for 3.2.5.
Backport of 8e97698d7b537cd298438a8d7b55916d275ff851 from main
2021-07-01 06:57:41 +02:00
Claude Paroz
04b744050f
[3.2.x] Updated translations from Transifex. 2021-06-28 07:06:24 +02:00
Hasan Ramezani
8b2b627f34 [3.2.x] Fixed #32863 -- Skipped system check for specifying type of auto-created primary keys on models with invalid app_label.
Regression in b5e12d490af3debca8c55ab3c1698189fdedbbdb.

Thanks Iuri de Silvio for the report.

Backport of 7a9745fed498f69c46a3ffa5dfaff872e0e1df89 from main
2021-06-22 21:19:47 +02:00
Mariusz Felisiak
826a1659ee [3.2.x] Fixed #32832 -- Fixed adding BLOB/TEXT nullable field with default on MySQL 8.0.13+.
Regression in d4ac23bee1c84d8e4610350202ac068fc90f38c0.

Thanks Omkar Deshpande for the report.

Backport of fa0433d05f213afe4c67055006320f7aba4c8108 from main
2021-06-10 20:05:55 +02:00
Mariusz Felisiak
bb29174f94 [3.2.x] Refs #32503 -- Added release notes for 5e04e84d67da8163f365e9f5fcd169e2630e2873.
Backport of 57bc16b38ec75fc96829f912d57a58d8c6358e8f from main
2021-06-10 20:05:48 +02:00
Takayuki Hirayama
8ec5b7403d [3.2.x] Fixed #32812 -- Restored immutability of named values from QuerySet.values_list().
Regression in 981a072dd4dec586f8fc606712ed9a2ef116eeee.

Thanks pirelle for the report.

Backport of 0393b9262dcf1b8302d35a8a470e14837ca1300b from main
2021-06-04 08:27:25 +02:00
Mariusz Felisiak
0b5a66b0d9 [3.2.x] Fixed docs header underlines in security archive.
Backport of d9cee3f5f2f90938d2c2c0230be40c7d50aef53d from main
2021-06-02 12:24:26 +02:00
Carlton Gibson
66cc97c6b3 [3.2.x] Added stub release notes for Django 3.2.5.
Backport of ba10772bf659a9507075d713c416882ce2c8df28 from main
2021-06-02 11:26:00 +02:00
Carlton Gibson
1aa7bcf482 [3.2.x] Added CVE-2021-33203 and CVE-2021-33571 to security archive.
Backport of a39f235ca4cb7370dba3a3dedeaab0106d27792f from main
2021-06-02 11:16:43 +02:00
Mariusz Felisiak
9f75e2e562 [3.2.x] Fixed CVE-2021-33571 -- Prevented leading zeros in IPv4 addresses.
validate_ipv4_address() was affected only on Python < 3.9.5, see [1].
URLValidator() uses a regular expressions and it was affected on all
Python versions.

[1] https://bugs.python.org/issue36384
2021-06-02 10:44:39 +02:00
Florian Apolloner
dfaba12cda [3.2.x] Fixed CVE-2021-33203 -- Fixed potential path-traversal via admindocs' TemplateDetailView. 2021-06-02 10:44:39 +02:00
Carlton Gibson
aed1409558 [3.2.x] Confirmed release date for Django 3.2.4, 3.1.12, and 2.2.24.
Backport of f66ae7a2d5558fe88ddfe639a610573872be6628 from main
2021-06-02 10:20:17 +02:00
Mariusz Felisiak
94675a7633 [3.2.x] Fixed #32793 -- Fixed loss of precision for temporal operations with DecimalFields on MySQL.
Regression in 1e38f1191de21b6e96736f58df57dfb851a28c1f.

Thanks Mohsen Tamiz for the report.
Backport of e703b152c6148ddda1b072a4353e9a41dca87f90 from main
2021-06-01 15:13:10 +02:00
Mariusz Felisiak
246a31a843 [3.2.x] Fixed #32783 -- Fixed crash of autoreloader when __main__ module doesn't have __spec__ attribute.
Regression in ec6d2531c59466924b645f314ac33f54470d7ac3.

Thanks JonathanNickelson for the report.
Backport of 12b19a1d76e1a6f80923c8358290d605dacd65d4 from main
2021-05-26 11:20:05 +02:00
Carlton Gibson
4ba4c07e4e [3.2.x] Added stub release notes and date for Django 3.2.4, 3.1.12, and 2.2.24.
Backport of b46dbd4e3e255223078ae0028934ea986e19ebc1 from main
2021-05-26 10:17:27 +02:00
Hasan Ramezani
c0d506f5ef [3.2.x] Fixed #32744 -- Normalized to pathlib.Path in autoreloader check for template changes.
Backport of 68357b2ca9e88c40fc00d848799813241be39129 from main
2021-05-26 10:08:58 +02:00
Mariusz Felisiak
143d2a4bbf [3.2.x] Changed IRC references to Libera.Chat.
Backport of 66491f08fe86629fa25977bb3dddda06959f65e7 from main.
2021-05-20 12:25:07 +02:00
Carlton Gibson
a173202dd4 [3.2.x] Fixed #32740 -- Caught possible exception when initializing colorama.
Backport of c2e6047c725e26987c87e2be59f2ab4bf9828fa5 from main
2021-05-19 11:16:13 +02:00
Mariusz Felisiak
41e2aa7eb2 [3.2.x] Fixed #32747 -- Prevented initialization of unused caches.
Thanks Alexander Ebral for the report.

Regression in 98e05ccde440cc9b768952cc10bc8285f4924e1f.

Backport of 958cdf65ae90d26236d1815bbba804729595ec7a from main
2021-05-18 20:23:26 +02:00
Rust Saiargaliev
349bb58b8a [3.2.x] Fixed #32733 -- Skipped system check for specifying type of auto-created primary keys on abstract models.
Regression in b5e12d490af3debca8c55ab3c1698189fdedbbdb.

Backport of a24fed399ced6be2e9dce4cf28db00c3ee21a21c from main
2021-05-18 13:20:55 +02:00
Slava Skvortsov
ce78bc9808 [3.2.x] Fixed #32754 -- Made AdminSite.catch_all_view() respect SCRIPT_NAME.
Regression in ba31b0103442ac891fb3cb98f316781254e366c3.

Backport of f7691d4812c578e696635718e67639d2e08eac40 from main
2021-05-18 09:58:49 +02:00
Nick Pope
cb91b2d9e3 [3.2.x] Refs #32720 -- Updated various links in docs to avoid redirects and use HTTPS.
Backport of c156e369553c75a30c78b8ed54a57b1101865105 from main
2021-05-17 12:16:09 +02:00
Nick Pope
55b89e8cac [3.2.x] Refs #32720 -- Fixed some broken links in docs.
Backport of 7c4ee487c7392a3a394caf62efad355fad639655 from main
2021-05-17 12:14:20 +02:00
Nick Pope
0c19b075b2 [3.2.x] Refs #32720 -- Used full hashes in security archive.
Backport of 1c3bbcf802e661fc599365a097532ed3b362d16b from main
2021-05-17 12:13:57 +02:00
Mariusz Felisiak
f844c0c33a [3.2.x] Corrected commit hashes for security patches.
Backport of df5c96299ae30dcf8f152cc43c331fb34d39080e from main
2021-05-17 12:13:44 +02:00
Nick Pope
80cf193d32 [3.2.x] Refs #32720 -- Used :commit: and :source: role in old release notes.
Backport of 8c4caee76a5571c6c8050660a6a9fc30ece6678d from main
2021-05-17 12:13:31 +02:00
Mariusz Felisiak
1037825eed [3.2.x] Added stub release notes for Django 3.2.4.
Backport of 820408d842a07202a80e6ef7f7a57ec6258d88e6 from main
2021-05-13 09:45:39 +02:00
Mariusz Felisiak
224b8e5a5a [3.2.x] Fixed #32718 -- Relaxed file name validation in FileField.
- Validate filename returned by FileField.upload_to() not a filename
  passed to the FileField.generate_filename() (upload_to() may
  completely ignored passed filename).
- Allow relative paths (without dot segments) in the generated filename.

Thanks to Jakub Kleň for the report and review.
Thanks to all folks for checking this patch on existing projects.
Thanks Florian Apolloner and Markus Holtermann for the discussion and
implementation idea.

Regression in 0b79eb36915d178aef5c6a7bbce71b1e76d376d3.
Backport of b55699968fc9ee985384c64e37f6cc74a0a23683 from main
2021-05-13 08:55:00 +02:00
Simon Charette
386caa5445 [3.2.x] Fixed #32717 -- Fixed filtering of querysets combined with the | operator.
Address a long standing bug in a Where.add optimization to discard
equal nodes that was surfaced by implementing equality for Lookup
instances in bbf141bcdc31f1324048af9233583a523ac54c94.

Thanks Shaheed Haque for the report.

Backport of b81c7562fc33f50166d5120138d6398dc42b13c3 from main
2021-05-13 07:53:56 +02:00
Nick Pope
4318e60a80 [3.2.x] Fixed #32732 -- Removed usage of deprecated 'db' and 'passwd' connection options in MySQL backend.
The 'db' and 'passwd' connection options have been deprecated, use
'database' and 'password' instead (available since mysqlclient >= 1.3.8).

This also allows the 'database' option in DATABASES['OPTIONS'] on MySQL.

Backport of 1061f5243646b4c9b8a758f8a36c9e2ccdded1cf from main
2021-05-12 13:35:13 +02:00
Mariusz Felisiak
dc7b495dae [3.2.x] Refs #32718 -- Corrected CVE-2021-31542 release notes.
Backport of d1f1417caed648db2f81a1ec28c47bf958c01958 from main
2021-05-12 10:42:32 +02:00
Mariusz Felisiak
8afb677ce7 [3.2.x] Added stub release notes for Django 3.2.3.
Backport of 29779075d7f5e1a8cfe0933661d5255e2d7d3cbd from main
2021-05-06 10:11:32 +02:00
Mariusz Felisiak
0262579f2e [3.2.x] Added CVE-2021-32052 to security archive.
Backport of efebcc429f048493d6bc710399e65d98081eafd5 from main
2021-05-06 10:03:45 +02:00
Mariusz Felisiak
2d2c1d0c97 [3.2.x] Fixed #32713, Fixed CVE-2021-32052 -- Prevented newlines and tabs from being accepted in URLValidator on Python 3.9.5+.
In Python 3.9.5+ urllib.parse() automatically removes ASCII newlines
and tabs from URLs [1, 2]. Unfortunately it created an issue in
the URLValidator. URLValidator uses urllib.urlsplit() and
urllib.urlunsplit() for creating a URL variant with Punycode which no
longer contains newlines and tabs in Python 3.9.5+. As a consequence,
the regular expression matched the URL (without unsafe characters) and
the source value (with unsafe characters) was considered valid.

[1] https://bugs.python.org/issue43882 and
[2] 76cd81d603

Backport of e1e81aa1c4427411e3c68facdd761229ffea6f6f from main.
2021-05-06 08:48:22 +02:00
Simon Charette
364098fdac [3.2.x] Fixed #32714 -- Prevented recreation of migration for Meta.ordering with OrderBy expressions.
Regression in c8b659430556dca0b2fe27cf2ea0f8290dbafecd.

Thanks Kevin Marsh for the report.

Backport of 96f55ccf798c7592a1203f798a4dffaf173a9263 from main
2021-05-05 08:44:37 +02:00
Carlton Gibson
df801dde33 [3.2.x] Added CVE-2021-31542 to security archive.
Backport of 607ebbfba915de2d84eb943aa93654f31817a709 and
62b2e8b37e37a313c63be40e3223ca4e830ebde3 from main
2021-05-04 11:10:50 +02:00
Carlton Gibson
04d8ed3660 [3.2.x] Added stub release notes for Django 3.2.2.
Backport of 5a43cfe24533591a020ba4e730440bad81c478db from main
2021-05-04 11:02:11 +02:00
Florian Apolloner
c98f446c18 [3.2.x] Fixed CVE-2021-31542 -- Tightened path & file name sanitation in file uploads. 2021-05-04 08:43:52 +02:00
Carlton Gibson
bac416972d [3.2.x] Refs #32674 -- Noted that auto-created through table PKs cannot be automatically migrated.
Backport of 907d3a7ff4e12ad4ccc86af26a728007fe4d6fa2 from main
2021-04-29 15:14:15 +02:00
Simon Charette
d5add5d3a2 [3.2.x] Fixed #32632, Fixed #32657 -- Removed flawed support for Subquery deconstruction.
Subquery deconstruction support required implementing complex and
expensive equality rules for sql.Query objects for little benefit as
the latter cannot themselves be made deconstructible to their reference
to model classes.

Making Expression @deconstructible and not BaseExpression allows
interested parties to conform to the "expression" API even if they are
not deconstructible as it's only a requirement for expressions allowed
in Model fields and meta options (e.g. constraints, indexes).

Thanks Phillip Cutter for the report.

This also fixes a performance regression in bbf141bcdc31f1324048af9233583a523ac54c94.

Backport of c8b659430556dca0b2fe27cf2ea0f8290dbafecd from main
2021-04-28 20:27:42 +02:00
Konstantin Alekseev
55cb3c8ac1 [3.2.x] Fixed #32687 -- Restored passing process’ environment to underlying tool in dbshell on PostgreSQL.
Regression in bbe6fbb8768e8fb1aecb96d51c049d7ceaf802d3.

Backport of 6e742dabc95b00ba896434293556adeb4dbaee8a from main.
2021-04-27 12:02:06 +02:00
Mariusz Felisiak
34981f399a [3.2.x] Fixed #32682 -- Made admin changelist use Exists() instead of distinct() for preventing duplicates.
Thanks Zain Patel for the report and Simon Charette for reviews.

The exception introduced in 6307c3f1a123f5975c73b231e8ac4f115fd72c0d
revealed a possible data loss issue in the admin.

Backport of 187118203197801c6cb72dc8b06b714b23b6dd3d from main
2021-04-27 10:39:55 +02:00