mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2024-12-23 01:25:58 +00:00
Code Issues 25 Releases Wiki Activity
32,957 Commits 28 Branches 426 Tags 666 MiB
fc1119e8be
Commit Graph

32957 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Adam Johnson
2b71b2c8dc
Refs #34609 -- Fixed deprecation warning stack level in format_html(). 
Co-authored-by: Simon Charette <charette.s@gmail.com>
 2024-08-27 15:14:50 -03:00
Natalia
b941de340d Fixed grammatical error in stub release notes for upcoming security release. 2024-08-27 09:46:12 -03:00
Natalia
67efd42517 Added stub release notes and release date for 5.1.1, 5.0.9, and 4.2.16. 2024-08-27 09:24:15 -03:00
Tim Graham
bc9b6251e0 Added supports_sequence_reset skip in backends tests. 2024-08-26 12:53:08 -03:00
Tim Graham
6a85c888bf Added supports_select_union skips in queries and aggregation tests. 2024-08-26 12:53:08 -03:00
Maarten Breddels
cdcd604ef8 Fixed #35703 -- Made technical_404_response() respect SCRIPT_NAME to return default_urlconf(). 2024-08-23 18:07:47 +02:00
Giovanni Fabbretti
f72bbd4480 Fixed #35689 -- Handled custom labels in LabelCommand.missing_args_message. 2024-08-23 17:26:28 +02:00
Natalia
47b921391f Removed unnecessary trailing slashes in Sphinx intersphinx_mapping URLs. 2024-08-23 11:15:16 -03:00
David Smith
0304f677ca Updated Sphinx source_suffix setting to use a mapping. 
Since Sphinx 1.8 this setting should be a mapping of file extensions to
file types. Before this change, Sphinx 8+ would show the following  when
building docs:

Converting `source_suffix = '.txt'` to `source_suffix = {'.txt': 'restructuredtext'}`
 2024-08-23 11:15:16 -03:00
nessita
046a354217
Added helper and refactored PasswordResetFormTest to unify email sending tests. 2024-08-23 11:13:31 -03:00
nessita
7adb6dd98d
Sorted alphabetically forms list in docs/topics/auth/default.txt. 2024-08-22 09:14:11 -03:00
Hisham Mahmood
519087819e
Fixed #35695 -- Ensured FileFields use a storage pointing to a temp directory in model_fields tests. 2024-08-21 08:51:25 -03:00
Marijke Luttekes
ba46b09f31 Updated GitHub PR template headings to level 4. 
GitHub pull request descriptions are rendered as a comment. Comment
titles, which include the PR author, render in a h3. Hence, titles
within the comment body should be header level 4. This makes pull
request descriptions more accessible to screen readers.
 2024-08-20 12:51:25 +02:00
Sarah Boyce
d9ae7f5b58 Fixed #35686 -- Added table headers to app list tables for screen readers. 2024-08-20 09:05:16 +02:00
nabil-rady
231c0d8593 Fixed #35668 -- Added mapping support to format_html_join. 2024-08-20 08:20:34 +02:00
Clifford Gama
ca1318988c Fixed #35671 -- Clarified string-based fields behavior when null=False. 2024-08-20 08:09:39 +02:00
Natalia
0ebed5fa95 Fixed #35678 -- Removed "usable_password" field from BaseUserCreationForm. 
Refs #34429: Following the implementation allowing the setting of
unusable passwords via the admin site, the `BaseUserCreationForm` and
`UserCreationForm` were extended to include a new field for choosing
whether password-based authentication for the new user should be enabled
or disabled at creation time.
Given that these forms are designed to be extended when implementing
custom user models, this branch ensures that this new field is moved to
a new, admin-dedicated, user creation form `AdminUserCreationForm`.

Regression in e626716c28.

Thanks Simon Willison for the report, Fabian Braun and Sarah Boyce for
the review.
 2024-08-19 12:39:57 -03:00
Natalia
b60fd8722f Refs #35678 -- Split tests for BaseUserCreationForm when using a custom User model. 
This work also allows to subclass BaseUserCreationFormTest to reuse the
tests and assertions for testing forms that extend BaseUserCreationForm,
which is now used for UserCreationFormTest, increasing its coverage.
 2024-08-19 12:39:57 -03:00
Mariusz Felisiak
a57596e443 Refs #35658 -- Fixed test_create_file_field_from_another_file_field_in_memory_storage when run in reverse. 2024-08-15 08:52:19 +02:00
Mariusz Felisiak
43cdfa8b20 Refs #35537 -- Clarified release notes for email attachments and alternatives changes. 2024-08-14 10:00:03 +02:00
Jacob Walls
b99c608ea1 Refs #35402 -- Added tests for invalid usage of submodules in some settings. 2024-08-13 16:09:52 +02:00
Simon Charette
602fe961e6 Fixed #35665 -- Fixed a crash when passing an empty order_by to Window. 
This also caused un-ordered sliced prefetches to crash as they rely on Window.

Regression in e16d0c176e that made OrderByList
piggy-back ExpressionList without porting the empty handling that the latter
provided.

Supporting explicit empty ordering on Window functions and slicing is arguably
a foot-gun design due to how backends will return undeterministic results but
this is a problem that requires a larger discussion.

Refs #35064.

Thanks Andrew Backer for the report and Mariusz for the review.
 2024-08-13 11:26:17 +02:00
David Smith
5ae9922666 Fixed typo of --no-startup in django-admin docs. 2024-08-13 11:18:42 +02:00
Mariusz Felisiak
6f0a4c1f3f
Refs #35648 -- Corrected release notes for SafeString.__add__() changes. 2024-08-12 15:56:00 -03:00
Mohammad Salehi
ca47884410 Fixed #35623 -- Documented that a field cannot be named 'check'. 2024-08-12 19:58:37 +02:00
Matthias Kestenholz
d84200e4eb Fixed #35648 -- Raised NotImplementedError in SafeString.__add__ for non-string RHS. 
This change ensures SafeString addition operations handle non-string RHS
properly, allowing them to implement __radd__ for better compatibility.
 2024-08-12 14:25:05 -03:00
Matthias Kestenholz
b5c048f5ec Refs #35648 -- Added test for addition between SafeString and str in utils_tests. 2024-08-12 14:25:05 -03:00
Marc Picaud
b4c1569eae
Marked missing part of warning footer for translation in SelectFilter2.js. 2024-08-12 14:23:21 -03:00
Devin Cox
e03083917d Fixed #35586 -- Added support for set-returning database functions. 
Aggregation optimization didn't account for not referenced set-returning annotations on Postgres.

Co-authored-by: Simon Charette <charette.s@gmail.com>
 2024-08-12 15:35:19 +02:00
Mark Gensler
228128618b Fixed #35575 -- Added support for constraint validation on GeneratedFields. 2024-08-12 13:45:57 +02:00
Mariusz Felisiak
f883bef054 Refs #35591 -- Removed hardcoded "stable" version in runserver warning. 2024-08-12 10:57:02 +02:00
lucasesposito
f16a9a556f Fixed #35658 -- Initialized InMemoryFileNode instances with a name. 2024-08-09 12:27:15 +02:00
Andrew Miller
69aa13ffb9 Fixed #35591 -- Added unsuitable for production console warning to runserver. 2024-08-09 10:34:10 +02:00
Adam Johnson
9582745257 Fixed #35622 -- Made unittest ignore Django assertions in traceback frames. 
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
 2024-08-08 21:34:01 -03:00
Natalia
e1606d27b4 Added test for acheck_password() to ensure make_password is called for unusable passwords. 
This is a follow up for the fix of CVE-2024-39329
(5d86458579) where the timing of
verify_password() was standardized when checking unusable passwords.
 2024-08-08 12:53:36 -03:00
Jure Cuhalev
f8ef4579ea Doc'd that SessionMiddleware is required for the admin site. 
The system check "admin.E410" was already checking for this, but the
requirement was not listed in docs/ref/contrib/admin/index.txt.
 2024-08-08 08:48:41 -03:00
Andrew Miller
cec62fb99e Refs #35591 -- Emphasized that runserver is not suitable for production. 2024-08-08 10:08:53 +02:00
Adam Johnson
49815f70e4 Refs #31405 -- Improved LoginRequiredMiddleware documentation. 
co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
 2024-08-08 10:05:31 +02:00
Mariusz Felisiak
7fb15ad5bc Fixed #35661 -- Fixed test_too_many_digits_to_rander() test crash on PyPy. 
Thanks Michał Górny for the report.
 2024-08-08 09:53:04 +02:00
Matthias Kestenholz
54888408a1
Fixed #35639 -- Improved admin's delete confirmation page title. 2024-08-07 18:10:49 -03:00
Natalia
790f0f8868 Added stub release notes for 5.1.1. 2024-08-07 10:38:36 -03:00
Natalia
a05187fce6 Fixed i18n.tests.TranslationTests.test_plural to use correct French translation. 
Forwardport of d5ad743e79 from stable/5.1.x.
 2024-08-07 10:10:28 -03:00
Natalia
bdcf789553 Updated translations from Transifex. 
Forwardport of 380c6e6ddd from stable/5.1.x.
 2024-08-07 10:09:42 -03:00
Natalia
8ad6dc636b Finalized release notes for Django 5.1. 2024-08-07 10:04:18 -03:00
Farhan
6993c9d8c9 Fixed #35553 -- Handled import*as in HashedFilesMixin. 2024-08-07 11:01:56 +02:00
Sarah Boyce
fdc638bf4a Added CVE-2024-41989, CVE-2024-41990, CVE-2024-41991, and CVE-2024-42005 to security archive. 2024-08-06 17:22:46 +02:00
Simon Charette
c87bfaacf8 Fixed CVE-2024-42005 -- Mitigated QuerySet.values() SQL injection attacks against JSON fields. 
Thanks Eyal (eyalgabay) for the report.
 2024-08-06 08:50:08 +02:00
Mariusz Felisiak
5f1757142f Fixed CVE-2024-41991 -- Prevented potential ReDoS in django.utils.html.urlize() and AdminURLFieldWidget. 
Thanks Seokchan Yoon for the report.

Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
 2024-08-06 08:50:08 +02:00
Sarah Boyce
ecf1f8fb90 Fixed CVE-2024-41990 -- Mitigated potential DoS in urlize and urlizetrunc template filters. 
Thanks to MProgrammer for the report.
 2024-08-06 08:50:08 +02:00
Sarah Boyce
c19465ad87 Fixed CVE-2024-41989 -- Prevented excessive memory consumption in floatformat. 
Thanks Elias Myllymäki for the report.

Co-authored-by: Shai Berger <shai@platonix.com>
 2024-08-06 08:50:08 +02:00