mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-07-07 19:29:12 +00:00
Code Issues 32 Releases Wiki Activity
31,788 Commits 29 Branches 451 Tags
Commit Graph

13413 Commits

Author SHA1 Message Date
Natalia
ac03c5e7df [4.2.x] Fixed CVE-2025-48432 -- Escaped formatting arguments in log_response(). 
Suitably crafted requests containing a CRLF sequence in the request
path may have allowed log injection, potentially corrupting log files,
obscuring other attacks, misleading log post-processing tools, or
forging log entries.

To mitigate this, all positional formatting arguments passed to the
logger are now escaped using "unicode_escape" encoding.

Thanks to Seokchan Yoon (https://ch4n3.kr/) for the report.

Co-authored-by: Carlton Gibson <carlton@noumenal.es>
Co-authored-by: Jake Howard <git@theorangeone.net>

Backport of a07ebec5591e233d8bbb38b7d63f35c5479eef0e from main.
 2025-06-04 08:50:05 -03:00
Natalia
c62f4eeda7 [4.2.x] Added stub release notes and release date for 4.2.22. 
Backport of 1a744343999c9646912cee76ba0a2fa6ef5e6240 from main.
 2025-05-28 10:21:44 -03:00
Jason Judkins
c5b42632c9 [4.2.x] Fixed #36402, Refs #35980 -- Updated built package name in reusable apps tutorial for PEP 625. 
Backport of 1307b8a1cb05762147736d0f347792b33f645390 from main.
 2025-05-26 12:38:29 -03:00
Natalia
dc365cac9b [4.2.x] Refs #35980 -- Added release note about changes in release artifacts filenames. 
Backport of 42ab99309d347f617d60751c2e8d627fb2963049 from main.
 2025-05-09 13:33:55 -03:00
Natalia
c454afbf4c [4.2.x] Removed "Expected" from release date for 4.2.21. 
Backport of c86156378db09e68db3a9ae1c108f661a67e3abe from main.
 2025-05-09 13:33:08 -03:00
Natalia
5b29315848 [4.2.x] Cleaned up CVE-2025-32873 security archive description. 
Backport of 37f2a77c729ccb71059c8e66c49b07499d2edf60 from main.
 2025-05-07 11:38:00 -03:00
Natalia
0d5495850a [4.2.x] Added CVE-2025-32873 to security archive. 
Backport of fdabda4e05587347aeb3382a442d7e77c1a0c3e5 from main.
 2025-05-07 11:25:04 -03:00
Sarah Boyce
9cd8028f3e [4.2.x] Fixed CVE-2025-32873 -- Mitigated potential DoS in strip_tags(). 
Thanks to Elias Myllymäki for the report, and Shai Berger and Jake
Howard for the reviews.

Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>

Backport of 9f3419b519799d69f2aba70b9d25abe2e70d03e0 from main.
 2025-05-06 22:36:15 -03:00
Claude Paroz
ca31ca09f7 [4.2.x] Changed packing recommendation to use pyproject.toml in reusable apps docs. 
Backport of f71bcc001bb3324020cfd756e84d4e9c6bb98cce from main.
 2025-05-05 11:46:49 -03:00
Claude Paroz
afe52d89c4 [4.2.x] Migrated setuptools configuration to pyproject.toml. 
This branch migrates setuptools configuration from setup.py/setup.cfg to
pyproject.toml. In order to ensure that the generated binary files have
consistent casing (both the tarball and the wheel), setuptools version
is limited to ">=61.0.0,<69.3.0".

Configuration for flake8 was moved to a dedicated .flake8 file since
it cannot be configured via pyproject.toml.

Also, __pycache__ exclusion was removed from MANIFEST and the
extras/Makefile was replaced with a simpler build command.

Co-authored-by: Nick Pope <nick@nickpope.me.uk>

Backport of 4686541691dbe986f58ac87630c3b7a04db4ff93 from main.
 2025-05-05 11:46:49 -03:00
Natalia
93973d4f88 [4.2.x] Added upcoming security release to release notes. 
Backport of 0f5dd0dff3049189a3fe71a62670b746543335d5 from main.
 2025-04-30 14:58:52 -03:00
nessita
b3df753399 [4.2.x] Refs #36341 -- Added release note for 4.2.21 for fix in wordwrap template filter. 
Revision 1e9db35836d42a3c72f3d1015c2f302eb6fee046 fixed a regression in
55d89e25f4115c5674cdd9b9bcba2bb2bb6d820b, which also needs to be
backported to the stable branches in extended support.

Backport of c86242d61ff81bddbead115c458c1eb532d43b43 from main.
 2025-04-23 17:35:28 -03:00
Sarah Boyce
318c16d2b8 [4.2.x] Fixed #36298 -- Truncated the overwritten file content in file_move_safe(). 
Regression in 58cd4902a71a3695dd6c21dc957f59c333db364c.

Thanks Baptiste Mispelon for the report.

Backport of 8ad3e80e88201f4c557f6fa79fcfc0f8a0961830 from main.
 2025-04-07 16:17:50 +02:00
Sarah Boyce
506cf74b0a [4.2.x] Added CVE-2025-26699 to security archive. 
Backport of bad1a18ff28a671f2fdfd447bdf8f43602f882c2 from main.
 2025-03-06 14:09:31 +01:00
Sarah Boyce
e88f7376fe [4.2.x] Fixed CVE-2025-26699 -- Mitigated potential DoS in wordwrap template filter. 
Thanks sw0rd1ight for the report.

Backport of 55d89e25f4115c5674cdd9b9bcba2bb2bb6d820b from main.
 2025-03-06 10:01:44 +01:00
Sarah Boyce
348e46a3e0 [4.2.x] Added stub release notes and release date for 4.2.20. 
Backport of ea1e3703bee28bfbe4f32ceb39ad31763353b143 from main.
 2025-02-27 16:14:34 +01:00
Natalia
83231cca9c [4.2.x] Added release date for 4.2.19. 
Backport of 294cc965efe0dfc8457aa5a8e78cb6d53abfcf92 from main.
 2025-02-05 10:52:55 -03:00
Mariusz Felisiak
043dfadbce [4.2.x] Fixed #36098 -- Fixed validate_ipv6_address()/validate_ipv46_address() crash for non-string values. 
Regression in ca2be7724e1244a4cb723de40a070f873c6e94bf.

Backport of b3c5830769d8a5dbf2f974da7116fe503c9454d9 from main.
 2025-01-15 13:54:57 -03:00
Natalia
8769b44fda [4.2.x] Added CVE-2024-56374 to security archive. 
Backport of f2a1dcaa53626ff11b921ef142b780a8fd746d32 from main.
 2025-01-14 11:39:32 -03:00
Natalia
ad866a1ca3 [4.2.x] Fixed CVE-2024-56374 -- Mitigated potential DoS in IPv6 validation. 
Thanks Saravana Kumar for the report, and Sarah Boyce and Mariusz
Felisiak for the reviews.

Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
 2025-01-14 09:08:01 -03:00
Natalia
b0d309c9eb [4.2.x] Added stub release notes and release date for 4.2.18. 
Backport of 53e21eebf22bc05c7fa30820b453b7f345b7af40 from main.
 2025-01-07 12:37:42 -03:00
Sarah Boyce
39cf3c63f3 [4.2.x] Cleaned up CVE-2024-53907 and CVE-2024-53908 security archive descriptions. 
Backport of eb665e076ca3417eb0ac654aed9e9c1853c5af84 from main.
 2024-12-04 17:03:55 +01:00
Sarah Boyce
0ff19d12e7 [4.2.x] Added CVE-2024-53907 and CVE-2024-53908 to security archive. 
Backport of 595cb4a7aeb1ba1770d10d601ce9a2b4e487c46e from main.
 2024-12-04 16:33:06 +01:00
Simon Charette
7376bcbf50 [4.2.x] Fixed CVE-2024-53908 -- Prevented SQL injections in direct HasKeyLookup usage on Oracle. 
Thanks Seokchan Yoon for the report, and Mariusz Felisiak and Sarah
Boyce for the reviews.
 2024-12-04 14:32:17 +01:00
Sarah Boyce
790eb058b0 [4.2.x] Fixed CVE-2024-53907 -- Mitigated potential DoS in strip_tags(). 
Thanks to jiangniao for the report, and Shai Berger and Natalia Bidart
for the reviews.
 2024-12-04 14:32:08 +01:00
Sarah Boyce
0acff0fd1f [4.2.x] Added stub release notes and release date for 4.2.17. 
Backport of 2544c1585473c1e82dab1274b52052744f97ca72 from main.
 2024-11-27 15:48:50 +01:00
Mariusz Felisiak
b381b19854 [4.2.x] Fixed docs build on Sphinx 8.1+. 
Sphinx 8.1 added :cve: role, so there is no need to define it in Django:
- https://github.com/sphinx-doc/sphinx/pull/11781

This also changes used URL to the one used by Python and soonish to be
used by Sphinx itself:
- https://github.com/sphinx-doc/sphinx/pull/13006

Backport of 263f7319192b217c4e3b1eea0ea7809836392bbc from main.
 2024-11-26 10:09:37 -03:00
Natalia
5211677454 [4.2.x] Added CVE-2024-45230 and CVE-2024-45231 to security archive. 
Backport of aa5293068782dfa2d2173c75c8477f58a9989942 from main.
 2024-09-03 11:25:06 -03:00
Natalia
bf4888d317 [4.2.x] Fixed CVE-2024-45231 -- Avoided server error on password reset when email sending fails. 
On successful submission of a password reset request, an email is sent
to the accounts known to the system. If sending this email fails (due to
email backend misconfiguration, service provider outage, network issues,
etc.), an attacker might exploit this by detecting which password reset
requests succeed and which ones generate a 500 error response.

Thanks to Thibaut Spriet for the report, and to Mariusz Felisiak, Adam
Johnson, and Sarah Boyce for the reviews.
 2024-09-03 09:42:25 -03:00
Sarah Boyce
d147a8ebbd [4.2.x] Fixed CVE-2024-45230 -- Mitigated potential DoS in urlize and urlizetrunc template filters. 
Thanks MProgrammer (https://hackerone.com/mprogrammer) for the report.
 2024-09-03 09:42:15 -03:00
Natalia
705066d186 [4.2.x] Fixed grammatical error in stub release notes for upcoming security release. 
Backport of b941de340daed4ce88f04a8012b9dba00ccb1359 from main.
 2024-08-27 09:52:50 -03:00
Natalia
b07d4f2dea [4.2.x] Added stub release notes and release date for 4.2.16. 
Backport of 67efd42517af0faf24872df4295b39e98ce826af from main.
 2024-08-27 09:37:37 -03:00
Sarah Boyce
e0579ce277 [4.2.x] Added CVE-2024-41989, CVE-2024-41990, CVE-2024-41991, and CVE-2024-42005 to security archive. 
Backport of fdc638bf4a35b5497d0b3b4faedaf552da792f99 from main.
 2024-08-06 17:33:37 +02:00
Simon Charette
f4af67b9b4 [4.2.x] Fixed CVE-2024-42005 -- Mitigated QuerySet.values() SQL injection attacks against JSON fields. 
Thanks Eyal (eyalgabay) for the report.
 2024-07-31 16:12:35 +02:00
Mariusz Felisiak
efea1ef7e2 [4.2.x] Fixed CVE-2024-41991 -- Prevented potential ReDoS in django.utils.html.urlize() and AdminURLFieldWidget. 
Thanks Seokchan Yoon for the report.

Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
 2024-07-31 16:12:23 +02:00
Sarah Boyce
d0a82e26a7 [4.2.x] Fixed CVE-2024-41990 -- Mitigated potential DoS in urlize and urlizetrunc template filters. 
Thanks to MProgrammer for the report.
 2024-07-31 16:12:11 +02:00
Sarah Boyce
fc76660f58 [4.2.x] Fixed CVE-2024-41989 -- Prevented excessive memory consumption in floatformat. 
Thanks Elias Myllymäki for the report.

Co-authored-by: Shai Berger <shai@platonix.com>
 2024-07-31 16:11:59 +02:00
Sarah Boyce
7b1a76f899 [4.2.x] Added stub release notes and release date for 4.2.15. 
Backport of 3f880890699d4412cf23b59dba425111f62afb3a from main.
 2024-07-31 11:29:30 +02:00
Lorenzo Peña
96a3497400 [4.2.x] Fixed #35627 -- Raised a LookupError rather than an unhandled ValueError in get_supported_language_variant(). 
LocaleMiddleware didn't handle the ValueError raised by
get_supported_language_variant() when language codes were
over 500 characters.

Regression in 9e9792228a6bb5d6402a5d645bc3be4cf364aefb.

Backport of 0e94f292cda632153f2b3d9a9037eb0141ae9c2e from main.
 2024-07-25 09:44:51 +02:00
Natalia
8e59e33400 [4.2.x] Added CVE-2024-38875, CVE-2024-39329, CVE-2024-39330, and CVE-2024-39614 to security archive. 
Backport of e095c7612d49dbe371e9c7edd76ba99b6bc4f9f6 from main.
 2024-07-09 12:00:22 -03:00
Sarah Boyce
17358fb35f [4.2.x] Fixed CVE-2024-39614 -- Mitigated potential DoS in get_supported_language_variant(). 
Language codes are now parsed with a maximum length limit of 500 chars.

Thanks to MProgrammer for the report.
 2024-07-09 10:40:50 -03:00
Natalia
2b00edc015 [4.2.x] Fixed CVE-2024-39330 -- Added extra file name validation in Storage's save method. 
Thanks to Josh Schneier for the report, and to Carlton Gibson and Sarah
Boyce for the reviews.
 2024-07-09 10:40:48 -03:00
Michael Manfre
156d3186c9 [4.2.x] Fixed CVE-2024-39329 -- Standarized timing of verify_password() when checking unusuable passwords. 
Refs #20760.

Thanks Michael Manfre for the fix and to Adam Johnson for the review.
 2024-07-09 10:40:46 -03:00
Adam Johnson
79f3687642 [4.2.x] Fixed CVE-2024-38875 -- Mitigated potential DoS in urlize and urlizetrunc template filters. 
Thank you to Elias Myllymäki for the report.

Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
 2024-07-09 10:40:37 -03:00
Natalia
446cdab134 [4.2.x] Added stub release notes for 4.2.14. 2024-07-03 14:18:28 -03:00
Sarah Boyce
b46b94e66c [4.2.x] Added release notes for 4.2.13. 
Backport of 90175e110e7cfcf07f4ccdaadc45d7ed6302ce00 from main.
 2024-05-07 17:35:16 +02:00
Sarah Boyce
3f9c8fc1f9 [4.2.x] Added release date for 4.2.12. 
Backport of 34a503162fe222033a1cd3249bccad014fcd1d20 from main.
 2024-05-06 14:44:17 +02:00
Sarah Boyce
256f719cb3 [4.2.x] Reverted "Fixed #34994, Fixed #35386 -- Applied checkbox-row CSS class unconditionally in Admin." 
This reverts commit 0fc832676cd585fa420d583937b5b2318bc2c629.
 2024-04-19 13:29:30 +02:00
Adam Johnson
0fc832676c [4.2.x] Fixed #34994, Fixed #35386 -- Applied checkbox-row CSS class unconditionally in Admin. 
Backport of bdd76c4c3817d8e3ed5b0450d5e18e4eae096f16 from main.
 2024-04-19 11:28:02 +02:00
Natalia
1d85b416aa [4.2.x] Refs #35361 -- Clarified release notes for 4.2.12. 
Backport of cd823778e66307b82469858cfd8d1aa75613b49a from main.
 2024-04-12 15:07:36 +02:00