1
0
mirror of https://github.com/django/django.git synced 2025-04-08 23:46:43 +00:00

11516 Commits

Author SHA1 Message Date
Hasan Ramezani
8b2b627f34 [3.2.x] Fixed #32863 -- Skipped system check for specifying type of auto-created primary keys on models with invalid app_label.
Regression in b5e12d490af3debca8c55ab3c1698189fdedbbdb.

Thanks Iuri de Silvio for the report.

Backport of 7a9745fed498f69c46a3ffa5dfaff872e0e1df89 from main
2021-06-22 21:19:47 +02:00
Mariusz Felisiak
826a1659ee [3.2.x] Fixed #32832 -- Fixed adding BLOB/TEXT nullable field with default on MySQL 8.0.13+.
Regression in d4ac23bee1c84d8e4610350202ac068fc90f38c0.

Thanks Omkar Deshpande for the report.

Backport of fa0433d05f213afe4c67055006320f7aba4c8108 from main
2021-06-10 20:05:55 +02:00
Yuekui Li
57146ba388 [3.2.x] Fixed #32503 -- Fixed altering BLOB/TEXT field to non-nullable with default on MySQL 8.0.13+.
MySQL 8.0.13+ supports defaults for BLOB/TEXT but not in the
ALTER COLUMN statement.

Regression in 6b16c91157512587017e9178d066ed1a683e7795.

Thanks Matt Westcott for the report.

Backport of 5e04e84d67da8163f365e9f5fcd169e2630e2873 from main
2021-06-10 20:01:38 +02:00
Takayuki Hirayama
8ec5b7403d [3.2.x] Fixed #32812 -- Restored immutability of named values from QuerySet.values_list().
Regression in 981a072dd4dec586f8fc606712ed9a2ef116eeee.

Thanks pirelle for the report.

Backport of 0393b9262dcf1b8302d35a8a470e14837ca1300b from main
2021-06-04 08:27:25 +02:00
Mariusz Felisiak
9f75e2e562 [3.2.x] Fixed CVE-2021-33571 -- Prevented leading zeros in IPv4 addresses.
validate_ipv4_address() was affected only on Python < 3.9.5, see [1].
URLValidator() uses a regular expressions and it was affected on all
Python versions.

[1] https://bugs.python.org/issue36384
2021-06-02 10:44:39 +02:00
Florian Apolloner
dfaba12cda [3.2.x] Fixed CVE-2021-33203 -- Fixed potential path-traversal via admindocs' TemplateDetailView. 2021-06-02 10:44:39 +02:00
Mariusz Felisiak
94675a7633 [3.2.x] Fixed #32793 -- Fixed loss of precision for temporal operations with DecimalFields on MySQL.
Regression in 1e38f1191de21b6e96736f58df57dfb851a28c1f.

Thanks Mohsen Tamiz for the report.
Backport of e703b152c6148ddda1b072a4353e9a41dca87f90 from main
2021-06-01 15:13:10 +02:00
Mariusz Felisiak
246a31a843 [3.2.x] Fixed #32783 -- Fixed crash of autoreloader when __main__ module doesn't have __spec__ attribute.
Regression in ec6d2531c59466924b645f314ac33f54470d7ac3.

Thanks JonathanNickelson for the report.
Backport of 12b19a1d76e1a6f80923c8358290d605dacd65d4 from main
2021-05-26 11:20:05 +02:00
Hasan Ramezani
c0d506f5ef [3.2.x] Fixed #32744 -- Normalized to pathlib.Path in autoreloader check for template changes.
Backport of 68357b2ca9e88c40fc00d848799813241be39129 from main
2021-05-26 10:08:58 +02:00
Mariusz Felisiak
41e2aa7eb2 [3.2.x] Fixed #32747 -- Prevented initialization of unused caches.
Thanks Alexander Ebral for the report.

Regression in 98e05ccde440cc9b768952cc10bc8285f4924e1f.

Backport of 958cdf65ae90d26236d1815bbba804729595ec7a from main
2021-05-18 20:23:26 +02:00
Rust Saiargaliev
349bb58b8a [3.2.x] Fixed #32733 -- Skipped system check for specifying type of auto-created primary keys on abstract models.
Regression in b5e12d490af3debca8c55ab3c1698189fdedbbdb.

Backport of a24fed399ced6be2e9dce4cf28db00c3ee21a21c from main
2021-05-18 13:20:55 +02:00
Slava Skvortsov
ce78bc9808 [3.2.x] Fixed #32754 -- Made AdminSite.catch_all_view() respect SCRIPT_NAME.
Regression in ba31b0103442ac891fb3cb98f316781254e366c3.

Backport of f7691d4812c578e696635718e67639d2e08eac40 from main
2021-05-18 09:58:49 +02:00
Mariusz Felisiak
224b8e5a5a [3.2.x] Fixed #32718 -- Relaxed file name validation in FileField.
- Validate filename returned by FileField.upload_to() not a filename
  passed to the FileField.generate_filename() (upload_to() may
  completely ignored passed filename).
- Allow relative paths (without dot segments) in the generated filename.

Thanks to Jakub Kleň for the report and review.
Thanks to all folks for checking this patch on existing projects.
Thanks Florian Apolloner and Markus Holtermann for the discussion and
implementation idea.

Regression in 0b79eb36915d178aef5c6a7bbce71b1e76d376d3.
Backport of b55699968fc9ee985384c64e37f6cc74a0a23683 from main
2021-05-13 08:55:00 +02:00
Simon Charette
386caa5445 [3.2.x] Fixed #32717 -- Fixed filtering of querysets combined with the | operator.
Address a long standing bug in a Where.add optimization to discard
equal nodes that was surfaced by implementing equality for Lookup
instances in bbf141bcdc31f1324048af9233583a523ac54c94.

Thanks Shaheed Haque for the report.

Backport of b81c7562fc33f50166d5120138d6398dc42b13c3 from main
2021-05-13 07:53:56 +02:00
Nick Pope
4318e60a80 [3.2.x] Fixed #32732 -- Removed usage of deprecated 'db' and 'passwd' connection options in MySQL backend.
The 'db' and 'passwd' connection options have been deprecated, use
'database' and 'password' instead (available since mysqlclient >= 1.3.8).

This also allows the 'database' option in DATABASES['OPTIONS'] on MySQL.

Backport of 1061f5243646b4c9b8a758f8a36c9e2ccdded1cf from main
2021-05-12 13:35:13 +02:00
Mariusz Felisiak
2d2c1d0c97 [3.2.x] Fixed #32713, Fixed CVE-2021-32052 -- Prevented newlines and tabs from being accepted in URLValidator on Python 3.9.5+.
In Python 3.9.5+ urllib.parse() automatically removes ASCII newlines
and tabs from URLs [1, 2]. Unfortunately it created an issue in
the URLValidator. URLValidator uses urllib.urlsplit() and
urllib.urlunsplit() for creating a URL variant with Punycode which no
longer contains newlines and tabs in Python 3.9.5+. As a consequence,
the regular expression matched the URL (without unsafe characters) and
the source value (with unsafe characters) was considered valid.

[1] https://bugs.python.org/issue43882 and
[2] 76cd81d603

Backport of e1e81aa1c4427411e3c68facdd761229ffea6f6f from main.
2021-05-06 08:48:22 +02:00
Carlton Gibson
a937d7f214 [3.2.x] Refs CVE-2021-31542 -- Skipped mock AWS storage test on Windows.
The validate_file_name() sanitation introduced in
0b79eb36915d178aef5c6a7bbce71b1e76d376d3 correctly rejects the example
file name as containing path elements on Windows. This breaks the test
introduced in 914c72be2abb1c6dd860cb9279beaa66409ae1b2 to allow path
components for storages that may allow them.

Test is skipped pending a discussed storage refactoring to support this
use-case.

Backport of a708f39ce67af174df90c5b5e50ad1976cec7cb8 from main
2021-05-06 07:42:21 +02:00
Simon Charette
364098fdac [3.2.x] Fixed #32714 -- Prevented recreation of migration for Meta.ordering with OrderBy expressions.
Regression in c8b659430556dca0b2fe27cf2ea0f8290dbafecd.

Thanks Kevin Marsh for the report.

Backport of 96f55ccf798c7592a1203f798a4dffaf173a9263 from main
2021-05-05 08:44:37 +02:00
Florian Apolloner
c98f446c18 [3.2.x] Fixed CVE-2021-31542 -- Tightened path & file name sanitation in file uploads. 2021-05-04 08:43:52 +02:00
Simon Charette
d5add5d3a2 [3.2.x] Fixed #32632, Fixed #32657 -- Removed flawed support for Subquery deconstruction.
Subquery deconstruction support required implementing complex and
expensive equality rules for sql.Query objects for little benefit as
the latter cannot themselves be made deconstructible to their reference
to model classes.

Making Expression @deconstructible and not BaseExpression allows
interested parties to conform to the "expression" API even if they are
not deconstructible as it's only a requirement for expressions allowed
in Model fields and meta options (e.g. constraints, indexes).

Thanks Phillip Cutter for the report.

This also fixes a performance regression in bbf141bcdc31f1324048af9233583a523ac54c94.

Backport of c8b659430556dca0b2fe27cf2ea0f8290dbafecd from main
2021-04-28 20:27:42 +02:00
Konstantin Alekseev
55cb3c8ac1 [3.2.x] Fixed #32687 -- Restored passing process’ environment to underlying tool in dbshell on PostgreSQL.
Regression in bbe6fbb8768e8fb1aecb96d51c049d7ceaf802d3.

Backport of 6e742dabc95b00ba896434293556adeb4dbaee8a from main.
2021-04-27 12:02:06 +02:00
Mariusz Felisiak
34981f399a [3.2.x] Fixed #32682 -- Made admin changelist use Exists() instead of distinct() for preventing duplicates.
Thanks Zain Patel for the report and Simon Charette for reviews.

The exception introduced in 6307c3f1a123f5975c73b231e8ac4f115fd72c0d
revealed a possible data loss issue in the admin.

Backport of 187118203197801c6cb72dc8b06b714b23b6dd3d from main
2021-04-27 10:39:55 +02:00
Mariusz Felisiak
fbea64b8ce [3.2.x] Refs #32682 -- Renamed use_distinct variable to may_have_duplicates.
QuerySet.distinct() is not the only way to avoid duplicate, it's also
not preferred.

Backport of cd74aad90e09865ae6cd8ca0377ef0a5008d14e9 from main
2021-04-27 10:37:13 +02:00
Mariusz Felisiak
7ad7034054 [3.2.x] Refs #32682 -- Fixed QuerySet.delete() crash on querysets with self-referential subqueries on MySQL.
Backport of 4074f38e1dcc93b859bbbfd6abd8441c3bca36b3 from main
2021-04-27 10:35:42 +02:00
Mariusz Felisiak
727a154094 [3.2.x] Refs 32637 -- Made technical 404 debug page display exception message when URL is resolved.
Follow up to 3b8527e32b665df91622649550813bb1ec9a9251.
Backport of d68be0494be8b82365f2a5410c9335e539d8efd6 from main
2021-04-27 08:41:11 +02:00
Zain Patel
0dfe88eaba [3.2.x] Fixed #32681 -- Fixed VariableDoesNotExist when rendering some admin template.
Regression in 84609b3205905097d7d3038d32e6101f012c0619.

Backport of 4e5bbb6ef2287126badd32842b239f4a8a7394ca from main.
2021-04-26 12:52:33 +02:00
Mariusz Felisiak
1cf0989b06 [3.2.x] Used assertCountEqual() in ExcludeTests.test_exclude_subquery().
Backport of c3278bb71fe03132704525abcdf29bb4f1b3f143 from main
2021-04-22 14:42:47 +02:00
Simon Charette
48e19bae49 [3.2.x] Fixed #32650 -- Fixed handling subquery aliasing on queryset combination.
This issue started manifesting itself when nesting a combined subquery
relying on exclude() since 8593e162c9cb63a6c0b06daf045bc1c21eb4d7c1 but
sql.Query.combine never properly handled subqueries outer refs in the
first place, see QuerySetBitwiseOperationTests.test_subquery_aliases()
(refs #27149).

Thanks Raffaele Salmaso for the report.

Backport of 6d0cbe42c3d382e5393d4af48185c546bb0ada1f from main
2021-04-21 10:32:39 +02:00
Mariusz Felisiak
1cc2eaf02d [3.2.x] Fixed #32665 -- Fixed caches system check crash when STATICFILES_DIRS is a list of 2-tuples.
Thanks Jared Lockhart for the report.

Regression in c36075ac1dddfa986340b1a5e15fe48833322372.
Backport of 34d1905712d33e72c76b3a55a4fc24abbd11be6c from main
2021-04-21 09:42:43 +02:00
Carlton Gibson
54d5bfa9c5 [3.2.x] Fixed #32647 -- Restored multi-row select with shift-modifier in admin changelist.
Regression in 30e59705fc3e3e9e8370b965af794ad6173bf92b.

Backport of 5c73fbb6a93ee214678f02ba4027f18dff49337b from main
2021-04-21 09:08:34 +02:00
Florian Apolloner
539d005aa5 [3.2.x] Fixed #32643 -- Fixed decoding of messages in the pre-Django 3.2 format.
Thanks Jan Pieter Waagmeester for the report.

Regression in 2d6179c819010f6a9d00835d5893c4593c0b85a0.

Backport of 4511d1459810037b91faa5b506e4f75c77aa72be from main.
2021-04-15 07:58:48 +02:00
Mariusz Felisiak
208e72276a [3.2.x] Fixed #32645 -- Fixed QuerySet.update() crash when ordered by joined fields on MySQL/MariaDB.
Thanks Matt Westcott for the report.

Regression in 779e615e362108862f1681f965ee9e4f1d0ae6d2.
Backport of ca9872905559026af82000e46cde6f7dedc897b6 from main
2021-04-14 21:13:27 +02:00
Jonathan Richards
d0267690f8 [3.2.x] Fixed #32548 -- Fixed crash when combining Q() objects with boolean expressions.
Backport of 00b0786de533dbb3f6208d8d5eaddbf765b4e5b8 from main.

Regression in 466920f6d726eee90d5566e0a9948e92b33a122e.
2021-04-14 19:46:45 +02:00
Arthur Jovart
65dfb06a1a [3.2.x] Fixed #32648 -- Fixed VariableDoesNotExist rendering sitemaps template.
Backport of 08c60cce3b13f6e60d7588206da2d3c71228f378 from main
2021-04-14 19:44:10 +02:00
Mariusz Felisiak
59cce8237c [3.2.x] Fixed #32649 -- Fixed ModelAdmin.search_fields crash when searching against phrases with unbalanced quotes.
Thanks Dlis for the report.

Regression in 26a413507abb38f7eee4cf62f2ee9727fdc7bf8d.
Backport of 23fa29f6a6659e0f600d216de6bcb79e7f6818c9 from main
2021-04-14 12:24:11 +02:00
Hasan Ramezani
700356f93b [3.2.x] Fixed #32635 -- Fixed system check crash for reverse o2o relations in CheckConstraint.check and UniqueConstraint.condition.
Regression in b7b7df5fbcf44e6598396905136cab5a19e9faff.

Thanks Szymon Zmilczak for the report.

Backport of a77c9a4229cfef790ec18001b2cd18bd9c4aedbc from main
2021-04-14 10:32:07 +02:00
Mariusz Felisiak
d6314c4c2e [3.2.x] Fixed #32637 -- Restored exception message on technical 404 debug page.
Thanks Atul Varma for the report.
Backport of 3b8527e32b665df91622649550813bb1ec9a9251 from main
2021-04-13 09:15:25 +02:00
Iuri de Silvio
b245845575 [3.2.x] Fixed #32627 -- Fixed QuerySet.values()/values_list() crash on combined querysets ordered by unannotated columns.
Backport of 9760e262f85ae57df39abe2799eff48a82b14474 from main
2021-04-13 06:16:19 +02:00
Adam Johnson
49e618f4af [3.2.x] Fixed #32620 -- Allowed subclasses of Big/SmallAutoField for DEFAULT_AUTO_FIELD.
Backport of 45a58c31e64dbfdecab1178b1d00a3803a90ea2d from main
2021-04-08 13:44:21 +02:00
Claude Paroz
5eb17d31c3 [3.2.x] Fixed #32544 -- Confirmed support for GDAL 3.2 and GEOS 3.9.
Backport of e3cfba0029516aafe40f963378e234df2c0d33bb from main.
2021-04-07 17:04:10 +02:00
Carlton Gibson
011b92ce98 [3.2.x] Updated asgiref dependency for 3.2 release series.
Backport of 5aea50e57f6c1bd725db36a0664e21b2be91b591 from main
2021-04-06 10:43:40 +02:00
Mariusz Felisiak
2820fd1be5 [3.2.x] Fixed CVE-2021-28658 -- Fixed potential directory-traversal via uploaded files.
Thanks Claude Paroz for the initial patch.
Thanks Dennis Brinkrolf for the report.

Backport of d4d800ca1addc4141e03c5440a849bb64d1582cd from main.
2021-04-06 08:24:01 +02:00
Mariusz Felisiak
eb7c0a7076 [3.2.x] Fixed #32614 -- Fixed MiddlewareSyncAsyncTests tests with asgiref 3.3.2+.
Backport of 78fea27f690028204c03c28d821cb0c0240a7398 from main
2021-04-06 08:04:07 +02:00
Claude Paroz
1ea5e98315
[3.2.x] Updated translations from Transifex. 2021-04-06 06:17:47 +02:00
Mariusz Felisiak
d67d48e923 [3.2.x] Fixed #32595 -- Fixed SchemaEditor.quote_value() crash with bytes.
Backport of f6018c1e63a04e0c12e2ca759e76e05ccf5e09de from main
2021-03-30 11:47:49 +02:00
Mariusz Felisiak
682eba534f [3.2.x] Refs #32595 -- Added MySQL's SchemaEditor.quote_value() tests for values with Unicode chars.
Backport of 3c75f1f3cac7985e8a134fc1c33eb6e01639a04b from main
2021-03-30 11:47:41 +02:00
Mariusz Felisiak
e2e371593f [3.2.x] Refs #32353, Refs #32352 -- Fixed GIS tests with PROJ 7.X.
Different PROJ versions use different transformations, all are correct
as having a 1 meter accuracy.

These are differences in PROJ versions that cannot and should not be
handled in Django itself.

Thanks Jani Tiainen and David Smith for reports.

See: https://github.com/OSGeo/gdal/issues/3377
Backport of 2cd40263348a9c345a58c44d48922ac3b370a119 from main
2021-03-23 09:17:58 +01:00
Adam Johnson
15a8518388 [3.2.x] Refs #31732 -- Fixed django.utils.inspect caching for bound methods.
Thanks Alexandr Artemyev for the report, and Simon Charette for the
original patch.

Backport of 562898034f65e17bcdd2d951ac5236a1ec8ea690 from main
2021-03-22 20:49:15 +01:00
Adam Johnson
2420fd2d5c [3.2.x] Refs #31372 -- Added django.utils.inspect tests for bound methods.
Backport of ac72a216a7ef95e8e9cb8651b7e67320597c903b from main
2021-03-22 20:49:09 +01:00
Johannes Maron
a8fef6daaf [3.2.x] Fixed #32466 -- Corrected autocomplete to_field resolution for complex cases.
In MTI or ForeignKey as primary key cases, it is required to fetch the attname
from the field instance on the remote model in order to reliably resolve the
to_field_name.

Backport of ceb4b9ee68dffc6ab0398886f1758f15f037c472 from main Backport of 03d0f12c823239812da21e5180aaa74dc6fd146e from main

Co-authored-by: Johannes Maron <info@johanneshoppe.com>
Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
Co-authored-by: Carlton Gibson <carlton.gibson@noumenal.es>
2021-03-18 14:21:12 +01:00