mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2024-12-25 10:35:48 +00:00
Code Issues 25 Releases Wiki Activity
31,747 Commits 28 Branches 426 Tags 667 MiB
39cf3c63f3
Commit Graph

31747 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Sarah Boyce
39cf3c63f3 [4.2.x] Cleaned up CVE-2024-53907 and CVE-2024-53908 security archive descriptions. 
Backport of eb665e076c from main.
 2024-12-04 17:03:55 +01:00
Sarah Boyce
0ff19d12e7 [4.2.x] Added CVE-2024-53907 and CVE-2024-53908 to security archive. 
Backport of 595cb4a7ae from main.
 2024-12-04 16:33:06 +01:00
Sarah Boyce
6c4fc7d620 [4.2.x] Post-release version bump. 2024-12-04 14:37:13 +01:00
Sarah Boyce
1f0356ff2a [4.2.x] Bumped version for 4.2.17 release. 2024-12-04 14:34:11 +01:00
Simon Charette
7376bcbf50 [4.2.x] Fixed CVE-2024-53908 -- Prevented SQL injections in direct HasKeyLookup usage on Oracle. 
Thanks Seokchan Yoon for the report, and Mariusz Felisiak and Sarah
Boyce for the reviews.
 2024-12-04 14:32:17 +01:00
Sarah Boyce
790eb058b0 [4.2.x] Fixed CVE-2024-53907 -- Mitigated potential DoS in strip_tags(). 
Thanks to jiangniao for the report, and Shai Berger and Natalia Bidart
for the reviews.
 2024-12-04 14:32:08 +01:00
Mariusz Felisiak
f663277a4c [4.2.x] Refs CVE-2024-11168 -- Updated vendored _urlsplit() to properly validate IPv6 and IPvFuture addresses. 
Refs Python CVE-2024-11168. Django should not affected, but others who
incorrectly use internal function _urlsplit() with unsanitized input
could be at risk.

https://github.com/python/cpython/pull/103849
 2024-12-03 09:50:11 +01:00
Sarah Boyce
0acff0fd1f [4.2.x] Added stub release notes and release date for 4.2.17. 
Backport of 2544c15854 from main.
 2024-11-27 15:48:50 +01:00
Mariusz Felisiak
b381b19854 [4.2.x] Fixed docs build on Sphinx 8.1+. 
Sphinx 8.1 added :cve: role, so there is no need to define it in Django:
- https://github.com/sphinx-doc/sphinx/pull/11781

This also changes used URL to the one used by Python and soonish to be
used by Sphinx itself:
- https://github.com/sphinx-doc/sphinx/pull/13006

Backport of 263f731919 from main.
 2024-11-26 10:09:37 -03:00
Tainara Palmeira
ea4a1fb61e [4.2.x] Refs #35844 -- Expanded compatibility for expected error messages in command tests on Python 3.12. 
Updated CommandTests.test_subparser_invalid_option and CommandDBOptionChoiceTests.test_invalid_choice_db_option to use assertRaisesRegex() for compatibility with modified error messages in Python 3.12, 3.13, and 3.14+..

Backport of fc22fdd34f from main.
 2024-10-30 11:32:52 +01:00
nessita
345a6652e6
[4.2.x] Added GitHub Action workflow to test all Python versions listed in the project config file. 
Backport of 470f4c2436 from main.
 2024-10-09 14:33:48 -03:00
Natalia
5211677454 [4.2.x] Added CVE-2024-45230 and CVE-2024-45231 to security archive. 
Backport of aa52930687 from main.
 2024-09-03 11:25:06 -03:00
Natalia
8f6c36234d [4.2.x] Post-release version bump. 2024-09-03 09:46:50 -03:00
Natalia
6f9fea3313 [4.2.x] Bumped version for 4.2.16 release. 2024-09-03 09:44:17 -03:00
Natalia
bf4888d317 [4.2.x] Fixed CVE-2024-45231 -- Avoided server error on password reset when email sending fails. 
On successful submission of a password reset request, an email is sent
to the accounts known to the system. If sending this email fails (due to
email backend misconfiguration, service provider outage, network issues,
etc.), an attacker might exploit this by detecting which password reset
requests succeed and which ones generate a 500 error response.

Thanks to Thibaut Spriet for the report, and to Mariusz Felisiak, Adam
Johnson, and Sarah Boyce for the reviews.
 2024-09-03 09:42:25 -03:00
Sarah Boyce
d147a8ebbd [4.2.x] Fixed CVE-2024-45230 -- Mitigated potential DoS in urlize and urlizetrunc template filters. 
Thanks MProgrammer (https://hackerone.com/mprogrammer) for the report.
 2024-09-03 09:42:15 -03:00
Natalia
705066d186 [4.2.x] Fixed grammatical error in stub release notes for upcoming security release. 
Backport of b941de340d from main.
 2024-08-27 09:52:50 -03:00
Natalia
b07d4f2dea [4.2.x] Added stub release notes and release date for 4.2.16. 
Backport of 67efd42517 from main.
 2024-08-27 09:37:37 -03:00
Sarah Boyce
e0579ce277 [4.2.x] Added CVE-2024-41989, CVE-2024-41990, CVE-2024-41991, and CVE-2024-42005 to security archive. 
Backport of fdc638bf4a from main.
 2024-08-06 17:33:37 +02:00
Sarah Boyce
ae0ca8345d [4.2.x] Post-release version bump. 2024-08-06 15:32:16 +02:00
Sarah Boyce
4d32ebcd57 [4.2.x] Bumped version for 4.2.15 release. 2024-08-06 14:56:30 +02:00
Simon Charette
f4af67b9b4 [4.2.x] Fixed CVE-2024-42005 -- Mitigated QuerySet.values() SQL injection attacks against JSON fields. 
Thanks Eyal (eyalgabay) for the report.
 2024-07-31 16:12:35 +02:00
Mariusz Felisiak
efea1ef7e2 [4.2.x] Fixed CVE-2024-41991 -- Prevented potential ReDoS in django.utils.html.urlize() and AdminURLFieldWidget. 
Thanks Seokchan Yoon for the report.

Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
 2024-07-31 16:12:23 +02:00
Sarah Boyce
d0a82e26a7 [4.2.x] Fixed CVE-2024-41990 -- Mitigated potential DoS in urlize and urlizetrunc template filters. 
Thanks to MProgrammer for the report.
 2024-07-31 16:12:11 +02:00
Sarah Boyce
fc76660f58 [4.2.x] Fixed CVE-2024-41989 -- Prevented excessive memory consumption in floatformat. 
Thanks Elias Myllymäki for the report.

Co-authored-by: Shai Berger <shai@platonix.com>
 2024-07-31 16:11:59 +02:00
Sarah Boyce
7b1a76f899 [4.2.x] Added stub release notes and release date for 4.2.15. 
Backport of 3f88089069 from main.
 2024-07-31 11:29:30 +02:00
Lorenzo Peña
96a3497400 [4.2.x] Fixed #35627 -- Raised a LookupError rather than an unhandled ValueError in get_supported_language_variant(). 
LocaleMiddleware didn't handle the ValueError raised by
get_supported_language_variant() when language codes were
over 500 characters.

Regression in 9e9792228a.

Backport of 0e94f292cd from main.
 2024-07-25 09:44:51 +02:00
Mariusz Felisiak
c5d196a652 [4.2.x] Fixed auth_tests and file_storage tests on Python 3.8. 2024-07-11 11:10:15 +02:00
Natalia
8e59e33400 [4.2.x] Added CVE-2024-38875, CVE-2024-39329, CVE-2024-39330, and CVE-2024-39614 to security archive. 
Backport of e095c7612d from main.
 2024-07-09 12:00:22 -03:00
Natalia
72f6c7d3a6 [4.2.x] Post-release version bump. 2024-07-09 11:08:49 -03:00
Natalia
98cf264c9c [4.2.x] Bumped version for 4.2.14 release. 2024-07-09 10:53:02 -03:00
Sarah Boyce
17358fb35f [4.2.x] Fixed CVE-2024-39614 -- Mitigated potential DoS in get_supported_language_variant(). 
Language codes are now parsed with a maximum length limit of 500 chars.

Thanks to MProgrammer for the report.
 2024-07-09 10:40:50 -03:00
Natalia
2b00edc015 [4.2.x] Fixed CVE-2024-39330 -- Added extra file name validation in Storage's save method. 
Thanks to Josh Schneier for the report, and to Carlton Gibson and Sarah
Boyce for the reviews.
 2024-07-09 10:40:48 -03:00
Michael Manfre
156d3186c9 [4.2.x] Fixed CVE-2024-39329 -- Standarized timing of verify_password() when checking unusuable passwords. 
Refs #20760.

Thanks Michael Manfre for the fix and to Adam Johnson for the review.
 2024-07-09 10:40:46 -03:00
Adam Johnson
79f3687642 [4.2.x] Fixed CVE-2024-38875 -- Mitigated potential DoS in urlize and urlizetrunc template filters. 
Thank you to Elias Myllymäki for the report.

Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
 2024-07-09 10:40:37 -03:00
Natalia
446cdab134 [4.2.x] Added stub release notes for 4.2.14. 2024-07-03 14:18:28 -03:00
Natalia
d26c8838d0 [4.2.x]Post-release version bump. 2024-05-07 14:44:42 -03:00
Sarah Boyce
3bf46e2e02 [4.2.x] Bumped version for 4.2.13 release. 2024-05-07 17:37:03 +02:00
Sarah Boyce
b46b94e66c [4.2.x] Added release notes for 4.2.13. 
Backport of 90175e110e from main.
 2024-05-07 17:35:16 +02:00
Natalia
1536833e93 [4.2.x] Post-release version bump. 2024-05-06 14:36:28 -03:00
Sarah Boyce
6193c720b5 [4.2.x] Bumped version for 4.2.12 release. 2024-05-06 17:24:48 +02:00
Sarah Boyce
3f9c8fc1f9 [4.2.x] Added release date for 4.2.12. 
Backport of 34a503162f from main.
 2024-05-06 14:44:17 +02:00
Sarah Boyce
256f719cb3 [4.2.x] Reverted "Fixed #34994, Fixed #35386 -- Applied checkbox-row CSS class unconditionally in Admin." 
This reverts commit 0fc832676c.
 2024-04-19 13:29:30 +02:00
Adam Johnson
0fc832676c [4.2.x] Fixed #34994, Fixed #35386 -- Applied checkbox-row CSS class unconditionally in Admin. 
Backport of bdd76c4c38 from main.
 2024-04-19 11:28:02 +02:00
Natalia
1d85b416aa [4.2.x] Refs #35361 -- Clarified release notes for 4.2.12. 
Backport of cd823778e6 from main.
 2024-04-12 15:07:36 +02:00
Natalia
27c32cc991 [4.2.x] Fixed #35361 -- Added release notes for 4.2.12 for backport of b231bcd19e. 
Backport of 42435fc55c from main.
 2024-04-10 18:29:33 +02:00
Mariusz Felisiak
0d3ddcaf2c [4.2.x] Refs #34900, Refs #35361 -- Fixed SafeMIMEText.set_payload() crash on Python 3.13. 
Payloads with surrogates are passed to the set_payload() since
f97f25ef5d

Backport of b231bcd19e from main.
 2024-04-10 18:18:52 +02:00
Mariusz Felisiak
a76c52b19a [4.2.x] Added CVE-2024-27351 to security archive. 
Backport of da39ae4b5f from main
 2024-03-04 10:12:58 +01:00
Mariusz Felisiak
721c566859 [4.2.x] Post-release version bump. 2024-03-04 08:47:11 +01:00
Mariusz Felisiak
61a986f53d [4.2.x] Bumped version for 4.2.11 release. 2024-03-04 08:43:32 +01:00