On successful submission of a password reset request, an email is sent
to the accounts known to the system. If sending this email fails (due to
email backend misconfiguration, service provider outage, network issues,
etc.), an attacker might exploit this by detecting which password reset
requests succeed and which ones generate a 500 error response.
Thanks to Thibaut Spriet for the report, and to Mariusz Felisiak, Adam
Johnson, and Sarah Boyce for the reviews.
Regression in 01ed59f753139afb514170ee7f7384c155ecbc2d.
Thank you to Fábio Domingues and Marijke Luttekes for the report,
and thank you to Natalia Bidart for the review.
Backport of fd1dd767783b5a7ec1a594fcc5885e7e4178dd26 from main.
Following the addition of PostgreSQL connection pool support in
Refs #33497, the methods for configuring the database role and timezone
were moved to module-level functions. This change prevented subclasses
of DatabaseWrapper from overriding these methods as needed, for example,
when creating wrappers for other PostgreSQL-based backends.
Thank you Christian Hardenberg for the report and to
Florian Apolloner and Natalia Bidart for the review.
Regression in fad334e1a9b54ea1acb8cce02a25934c5acfe99f.
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
Backport of 7380ac57340653854bc2cfe0ed80298cdac6061d from main.
Over the years we've had multiple instances of hit and misses when
emitting warnings: either setting the wrong stacklevel or not setting
it at all.
This work adds assertions for the existing warnings that were declaring
the correct stacklevel, but were lacking tests for it.
Backport of 57307bbc7d88927989cf5b314f16d6e13ade04e6 from main.
Refs #34429: Following the implementation allowing the setting of
unusable passwords via the admin site, the `BaseUserCreationForm` and
`UserCreationForm` were extended to include a new field for choosing
whether password-based authentication for the new user should be enabled
or disabled at creation time.
Given that these forms are designed to be extended when implementing
custom user models, this branch ensures that this new field is moved to
a new, admin-dedicated, user creation form `AdminUserCreationForm`.
Regression in e626716c28b6286f8cf0f8174077f3d2244f3eb3.
Thanks Simon Willison for the report, Fabian Braun and Sarah Boyce for
the review.
Backport of 0ebed5fa95f53b87383901bbd9341ef3c974344f from main.
This work also allows to subclass BaseUserCreationFormTest to reuse the
tests and assertions for testing forms that extend BaseUserCreationForm,
which is now used for UserCreationFormTest, increasing its coverage.
Backport of b60fd8722f305ec29c87f34d3fea262e56394ebd from main.
This also caused un-ordered sliced prefetches to crash as they rely on Window.
Regression in e16d0c176e9b89628cdec5e58c418378c4a2436a that made OrderByList
piggy-back ExpressionList without porting the empty handling that the latter
provided.
Supporting explicit empty ordering on Window functions and slicing is arguably
a foot-gun design due to how backends will return undeterministic results but
this is a problem that requires a larger discussion.
Refs #35064.
Thanks Andrew Backer for the report and Mariusz for the review.
Backport of 602fe961e6834d665f2359087a1272e9f9806b71 from main.
The system check "admin.E410" was already checking for this, but the
requirement was not listed in docs/ref/contrib/admin/index.txt.
Backport of f8ef4579ea710f93ec7edc93c6f3f216bd55d6be from main.
This reverts commit 175b04942afaff978013db61495f3b39ea12989b due to a crash when Oracle > 23.3.
Backport of 5424151f96252e1289e9a6f7eb842cd1dc87850a from main.
Regression in b0ad41198b3e333f57351e3fce5a1fb47f23f376.
Refs #34013. The initial logic did not consider that annotation aliases
can include lookup or transform separators.
Thanks Gert Van Gool for the report and Mariusz Felisiak for the review.
Backport of a16f13a8661297eda12c4177bb01fa2e5b5ccc56 from main.
