1
0
mirror of https://github.com/django/django.git synced 2025-03-06 15:32:33 +00:00

33239 Commits

Author SHA1 Message Date
Mariusz Felisiak
0cabed9efa Simplified GeoIP2._query() when passing IPv4Address()/IPv6Address() instances.
There is no need to call validate_ipv46_address() for
ipaddress.IPv4Address()/ipaddress.IPv6Address() instances since this
relies on trying to create these kind objects from strings, so they will
always be valid.
2025-01-15 13:46:06 -03:00
Mariusz Felisiak
b3c5830769 Fixed #36098 -- Fixed validate_ipv6_address()/validate_ipv46_address() crash for non-string values.
Regression in ca2be7724e1244a4cb723de40a070f873c6e94bf.
2025-01-15 13:46:06 -03:00
Jacob Walls
1602666b79 Fixed #36100 -- Checked if composite pk is set in get_next/get_previous. 2025-01-15 17:23:46 +01:00
Simon Charette
6cfe00ee43 Refs #29499 -- Fixed race condition in update_or_create() test.
The usage of time.sleep() could result in the update_or_create() thread winning
the race to create the row if the backend takes a while to create a new
connection in the main thread.

Relying on threading.Event ensures that the flow of execution is systematically
yield back and forth between the main thread and the thread in charge of
performing the background update_or_create().
2025-01-15 15:36:57 +01:00
Jacob Walls
de9f46d707 Fixed #36070 -- Clarified model validation behavior for composite pks. 2025-01-15 13:44:23 +01:00
Jacob Walls
f054045973 Refs #36070 -- Referred to pk as an attribute when a composite primary key is defined.
This is to avoid confusion that a field is often associated with having
a single associated database column.
2025-01-15 13:44:23 +01:00
Sarah Boyce
b721f12760 Fixed #35998 -- Added caching to django.utils.html.urlize(). 2025-01-14 17:59:32 +01:00
Jacob Walls
d206d4c200 Fixed #36051 -- Declared arity on aggregate functions.
Follow-up to 4a66a69239c493c05b322815b18c605cd4c96e7c.
2025-01-14 16:47:07 +01:00
Simon Charette
f07360e808 Refs #36075 -- Adjusted MTI handling of _non_pk_concrete_field_names.
Regression in bf7b17d16d3978b2e1cee4a0f7ce8840bd1a8dc4.

Thanks Sage Abdullah for the report.
2025-01-14 16:21:19 +01:00
Simon Charette
161e79d277 Refs #36075 -- Adjusted pk_fields usage in bulk_update eligibility checks.
Regression in bf7b17d16d3978b2e1cee4a0f7ce8840bd1a8dc4.

Thanks Sage Abdullah for the report.
2025-01-14 16:21:19 +01:00
Simon Charette
4bfec242b4 Fixed #36093 -- Adjusted unique checks to account for inherited primary keys.
Regression in bf7b17d16d3978b2e1cee4a0f7ce8840bd1a8dc4 refs #36075.

Thanks Sage Abdullah for the report and tests.
2025-01-14 16:21:19 +01:00
Simon Charette
e580926d74 Fixed #36075 -- Documented how to introspect composite primary keys.
Document _meta.pk_fields and interactions between Field.primary_key and
CompositePrimaryKey.

Thanks Mariusz for the review.
2025-01-14 16:20:17 +01:00
Natalia
f2a1dcaa53 Added CVE-2024-56374 to security archive. 2025-01-14 11:37:50 -03:00
Natalia
3b46bea909 Added stub release notes for 5.1.6. 2025-01-14 11:33:28 -03:00
Michael Manfre
ca2be7724e Fixed CVE-2024-56374 -- Mitigated potential DoS in IPv6 validation.
Thanks Saravana Kumar for the report, and Sarah Boyce and Mariusz
Felisiak for the reviews.

Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2025-01-14 08:42:24 -03:00
Natalia
9a2dd9789a Made cosmetic edits to 5.1.5 release notes. 2025-01-14 08:33:03 -03:00
Mariusz Felisiak
0a341125d1
Refs #35844 -- Removed unnecessary ArgumentParser.add_argument_group()'s prefix_chars argument.
The `prefix_chars` argument is deprecated since 7b04496e5c.
2025-01-13 12:53:48 -03:00
Sarah Boyce
23c6effac0 Fixed #36087 -- Supported password reset on a custom user model with a composite primary key. 2025-01-13 15:51:21 +01:00
Bendeguz Csirmaz
d83fb782d3 Fixed #36092 -- Disallowed non-local fields in composite primary keys. 2025-01-13 14:21:41 +01:00
Sarah Boyce
bf7b17d16d Refs #36075 -- Used field in pk_fields over field.primary_key. 2025-01-13 12:04:59 +01:00
Jacob Walls
d66137b39b Fixed #36077 -- Corrected docs on pk value where Model.save() executes an UPDATE.
The empty string is no longer special-cased since
c2ba59fc1da5287d6286e2c2aca4083d5bafe056.
2025-01-13 11:18:02 +01:00
Simon Charette
76a0b6aa3a Refs #36050 -- Fixed OuterRef support for CompositePrimaryKey on Oracle.
Oracle doesn't support native tuple comparison so each as_oracle implementation
of tuple lookups must also perform right-hand-side sanitization.
2025-01-13 11:14:01 +01:00
Simon Charette
9e55201555 Fixed #36086 -- Fixed crash when using GeneratedField with non-AutoField pk.
The previous logic was systematically attempting to retrieve last_insert_id
even for models without an AutoField primary key when they had a GeneratedField
on backends that can't return columns from INSERT.

The issue affected MySQL, SQLite < 3.35, and Oracle when the use_returning_into
option was disabled and could result in either crashes when the non-auto
primary key wasn't an IntegerField subclass or silent misassignment of bogus
insert ids (0 or the previous auto primary key insert value) to the first
defined generated field value.
2025-01-13 11:13:29 +01:00
Simon Charette
20eb4bca7d Refs #373 -- Adjusted test allowing AutoField in composite primary keys.
This is not a properly supported feature yet and should be revisited by
refs #35957.
2025-01-13 11:13:29 +01:00
Simon Charette
bfcb34076e Refs #373 -- Removed unused composite pk code in SQLInsertCompiler.
This logic could only be exercised if the composite primary key included an
AutoField but it's not allowed yet (refs #35957).

It was also slightly broken as it expected the AutoField to always be the first
member of returning_fields.
2025-01-13 11:13:29 +01:00
Bendeguz Csirmaz
8bee7fa45c Fixed #36050 -- Added OuterRef support to CompositePrimaryKey. 2025-01-10 14:38:09 +01:00
antoliny0919
97ee8b82c2 Fixed #36032 -- Rendered URLField values as links in the admin. 2025-01-10 12:57:53 +01:00
Bendeguz Csirmaz
5851605863 Fixed #36064 -- Skipped an UPDATE when adding a model instance with a composite primary key with default values. 2025-01-10 11:43:38 +01:00
Bendeguz Csirmaz
8287fd4915 Refs #36064 -- Added test that falsey primary key default/db_default value skips an update query on save.
This adds test coverage for logic change in 9fa4d07ce0729850661a31a6b37c6b48f13d2266.
2025-01-10 11:43:38 +01:00
Simon Charette
9fa4d07ce0 Refs #36064 -- Added Model.has_db_default() to encapsulate NOT_PROVIDED checks.
This avoids many awkward checks against NOT_PROVIDED and provides symmetry
with Field.has_default() which is also the reason why it wasn't made a
property.
2025-01-10 08:31:15 +01:00
Jacob Walls
0fb51ec5a0 Fixed #36068 -- Raised ValueError when providing a composite PK field to bulk_create() update_fields. 2025-01-10 08:23:39 +01:00
Simon Charette
af6336f2c8 Fixed #36074 -- Excluded composite primary key fields on save() updates. 2025-01-09 17:38:42 +01:00
Salvo Polizzi
fc28550fe4
Fixed #35515 -- Added automatic model imports to shell management command.
Thanks to Bhuvnesh Sharma and Adam Johnson for mentoring this Google
Summer of Code 2024 project. Thanks to Sarah Boyce, David Smith, Jacob
Walls and Natalia Bidart for reviews.
2025-01-09 13:00:29 -03:00
Brock
8c118c0e00 Fixed #35940 -- Disabled SelectFilter add/remove buttons when appropriate. 2025-01-09 08:18:29 +01:00
antoliny0919
a9c79b4629 Fixed #36063 -- Made a FileField navigate to the object admin change page when in list_display_links. 2025-01-08 16:32:40 +01:00
Sarah Boyce
6a1a9c0ead Fixed #36062 -- Handled serialization of CompositePrimaryKeys. 2025-01-08 14:52:59 +01:00
Sarah Boyce
15e207ce80 Fixed #35999 -- Removed #django IRC channel references where appropriate.
Some references are replaced with links to the Django Discord server.
2025-01-08 10:24:52 +01:00
Carlton Gibson
007f143659 Strengthened wording on supported Python versions in FAQ. 2025-01-08 10:21:55 +01:00
Simon Charette
42e8f264ce Fixed #36065 -- Fixed ordering by expression referencing composite primary key.
Thanks Jacob Walls for the report and test and Csirmaz Bendegúz for the review.
2025-01-08 10:20:48 +01:00
Simon Charette
7617d5be94 Refs #36065 -- Extracted composite primary key order by tests. 2025-01-08 10:20:48 +01:00
Chaitanya Rahalkar
c068f000be Fixed #36014 -- Supported international domains in EmailValidator. 2025-01-08 10:20:11 +01:00
Natalia
53e21eebf2 Added stub release notes and release date for 5.1.5, 5.0.11, and 4.2.18. 2025-01-07 12:28:39 -03:00
Clifford Gama
095f5db060
Fixed typo in tutorial 5. 2025-01-07 10:47:56 -03:00
Jacob Walls
470e5545e5 Refs #36042 -- Raised ValueError when providing composite expressions to aggregates. 2025-01-07 11:42:06 +01:00
Jacob Walls
6eec703667 Fixed #36042 -- Raised ValueError when using CompositePrimaryKey as rhs. 2025-01-07 11:42:06 +01:00
Alex Vandiver
8914b571eb Fixed #36023 -- Handled controls chars in content_disposition_header.
To use the simple `filename="..."` form, the value must conform to the
official grammar from RFC6266[^1]:

    filename-parm       = "filename" "=" value
    value               = <value, defined in [RFC2616], Section 3.6>
                        ; token | quoted-string

The `quoted-string` definition comes from RFC 9110[^2]:

```
    quoted-string  = DQUOTE *( qdtext / quoted-pair ) DQUOTE
    qdtext         = HTAB / SP / %x21 / %x23-5B / %x5D-7E / obs-text

The backslash octet ("\") can be used as a single-octet quoting
mechanism within quoted-string and comment constructs. Recipients that
process the value of a quoted-string MUST handle a quoted-pair as if
it were replaced by the octet following the backslash.

    quoted-pair    = "\" ( HTAB / SP / VCHAR / obs-text )

A sender SHOULD NOT generate a quoted-pair in a quoted-string except
where necessary to quote DQUOTE and backslash octets occurring within
that string.
```

That is, quoted strings are able to express horizontal tabs, space
characters, and everything in the range from 0x21 to 0x7e, expect for
0x22 (`"`) and 0x5C (`\`), which can still be expressed but must be
escaped with their own `\`.

We ignore the case of `obs-text`, which is defined as the range
0x80-0xFF, since its presence is there for permissive parsing of
accidental high-bit characters, and it should not be generated by
conforming implementations.

Transform this character range into a regex and apply it in addition
to the "is ASCII" check.  This ensures that all simple filenames are
expressed in the simple format, and that all filenames with newlines
and other control characters are properly expressed with the
percent-encoded `filename*=...`form.

[^1]: https://datatracker.ietf.org/doc/html/rfc6266#section-4.1
[^2]: https://datatracker.ietf.org/doc/html/rfc9110#name-quoted-strings
2025-01-07 09:22:09 +01:00
John Parton
40d5516385 Fixed #35718 -- Add JSONArray to django.db.models.functions.
Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2025-01-06 10:08:32 +01:00
Chris Muthig
d734f1651c Refs #35444 -- Deprecated contrib.postgres aggregates ordering for order_by.
Aligns the argument with SQL standards already used in Window.order_by and
sets up for adding support to Aggregate.
2025-01-06 09:39:21 +01:00
Jacob Walls
46b3e7dd8c Fixed #36048 -- Preferred ValueError to NotSupportedError for composite pk sanity checks.
These checks are not backend-dependent.
2025-01-06 09:33:27 +01:00
Adam Johnson
51df0dff3c
Fixed #36057 -- Enabled test runner to debug chained exceptions with --pdb on Python 3.13+. 2025-01-04 00:30:40 -03:00