Carlton Gibson 83ab3e2664 [2.2.x] Fixed CVE-2019-6975 -- Fixed memory exhaustion in utils.numberformat.format(). ...

Thanks Sjoerd Job Postmus for the report and initial patch.
Thanks Michael Manfre, Tim Graham, and Florian Apolloner for review.

Backport of 402c0caa851e265410fbcaa55318f22d2bf22ee2 from master

2019-02-11 11:10:38 +01:00

..

0.95.txt

Replaced "django" with "Django" in spelling_wordlist.

2016-11-15 17:00:50 -05:00

0.96.txt

Fixed spelling of "nonexistent".

2017-02-03 08:01:45 -05:00

1.0-porting-guide.txt

[2.2.x] Removed extra characters in docs header underlines.

2019-02-08 21:39:54 +01:00

1.0.1.txt

Updated obsolete links in the documentation

2012-06-28 10:49:07 +02:00

1.0.2.txt

…

1.0.txt

Fixed #28594 -- Removed Jython docs and specific code

2017-12-23 10:26:32 +01:00

1.1.2.txt

Updated capitalization in the word "JavaScript" for consistency

2015-05-01 13:26:42 -04:00

1.1.3.txt

Replaced "django" with "Django" in spelling_wordlist.

2016-11-15 17:00:50 -05:00

1.1.4.txt

Fixed #26020 -- Normalized header stylings in docs.

2016-01-22 12:12:17 -05:00

1.1.txt

[2.2.x] Removed extra characters in docs header underlines.

2019-02-08 21:39:54 +01:00

1.2.1.txt

Fixed a number of minor misspellings.

2013-07-27 18:46:03 -07:00

1.2.2.txt

Fixed #19885 -- cleaned up the django.test namespace

2013-09-09 16:03:13 -04:00

1.2.3.txt

Added placeholder release notes for the 1.2.1 and 1.2.3 releases.

2011-08-26 09:31:01 +00:00

1.2.4.txt

Replaced "django" with "Django" in spelling_wordlist.

2016-11-15 17:00:50 -05:00

1.2.5.txt

Fixed #26020 -- Normalized header stylings in docs.

2016-01-22 12:12:17 -05:00

1.2.6.txt

Added basic release notes for 1.2.6 and 1.3.1.

2011-09-10 03:33:54 +00:00

1.2.7.txt

Whitespace cleanup.

2013-10-10 16:49:20 -04:00

1.2.txt

Refs #26601 -- Removed support for old-style middleware using settings.MIDDLEWARE_CLASSES.

2017-01-17 20:52:04 -05:00

1.3.1.txt

Added basic release notes for 1.2.6 and 1.3.1.

2011-09-10 03:33:54 +00:00

1.3.2.txt

Added 1.4.1 and 1.3.2 release notes

2012-08-31 20:35:50 +02:00

1.3.3.txt

Added missing release notes for older versions of Django

2013-08-12 14:05:25 -04:00

1.3.4.txt

Fixed #26020 -- Normalized header stylings in docs.

2016-01-22 12:12:17 -05:00

1.3.5.txt

Fixed #26020 -- Normalized header stylings in docs.

2016-01-22 12:12:17 -05:00

1.3.6.txt

Refs #29784 -- Switched to https:// links where available.

2018-09-26 08:48:47 +02:00

1.3.7.txt

Added missing release notes for older versions of Django

2013-08-12 14:05:25 -04:00

1.3.txt

Removed code terms from docs/spelling_wordlist.

2018-07-31 12:22:28 -04:00

1.4.1.txt

Added 1.4.1 and 1.3.2 release notes

2012-08-31 20:35:50 +02:00

1.4.2.txt

Fixed #26020 -- Normalized header stylings in docs.

2016-01-22 12:12:17 -05:00

1.4.3.txt

Fixed #26020 -- Normalized header stylings in docs.

2016-01-22 12:12:17 -05:00

1.4.4.txt

Refs #29784 -- Switched to https:// links where available.

2018-09-26 08:48:47 +02:00

1.4.5.txt

Added missing release notes for older versions of Django

2013-08-12 14:05:25 -04:00

1.4.6.txt

Refs #17209 -- Removed login/logout and password reset/change function-based views.

2017-09-22 12:51:17 -04:00

1.4.7.txt

Fixed #26020 -- Normalized header stylings in docs.

2016-01-22 12:12:17 -05:00

1.4.8.txt

Fixed #26020 -- Normalized header stylings in docs.

2016-01-22 12:12:17 -05:00

1.4.9.txt

Fixed #26020 -- Normalized header stylings in docs.

2016-01-22 12:12:17 -05:00

1.4.10.txt

Fixed #26020 -- Normalized header stylings in docs.

2016-01-22 12:12:17 -05:00

1.4.11.txt

Refs #23919 -- Removed Python 2 notes in docs.

2017-01-18 11:51:29 -05:00

1.4.12.txt

Fixed #26013 -- Moved django.core.urlresolvers to django.urls.

2015-12-31 14:21:29 -05:00

1.4.13.txt

Refs #17209 -- Removed login/logout and password reset/change function-based views.

2017-09-22 12:51:17 -04:00

1.4.14.txt

Fixed #26013 -- Moved django.core.urlresolvers to django.urls.

2015-12-31 14:21:29 -05:00

1.4.15.txt

Used the 🎫 syntax more extensively

2014-12-19 18:07:52 +01:00

1.4.16.txt

Used the 🎫 syntax more extensively

2014-12-19 18:07:52 +01:00

1.4.17.txt

Refs #23919 -- Removed Python 2 notes in docs.

2017-01-18 11:51:29 -05:00

1.4.18.txt

Refs #17209 -- Removed login/logout and password reset/change function-based views.

2017-09-22 12:51:17 -04:00

1.4.19.txt

Fixed #25778 -- Updated docs links to use https when available.

2015-12-01 08:01:34 -05:00

1.4.20.txt

Refs #17209 -- Removed login/logout and password reset/change function-based views.

2017-09-22 12:51:17 -04:00

1.4.21.txt

Prevented newlines from being accepted in some validators.

2015-07-08 15:23:03 -04:00

1.4.22.txt

Refs #17209 -- Removed login/logout and password reset/change function-based views.

2017-09-22 12:51:17 -04:00

1.4.txt

Fixed #28606 -- Deprecated CachedStaticFilesStorage.

2018-10-27 11:58:29 -04:00

1.5.1.txt

Used https for most *.python.org links

2014-12-19 18:07:52 +01:00

1.5.2.txt

Refs #17209 -- Removed login/logout and password reset/change function-based views.

2017-09-22 12:51:17 -04:00

1.5.3.txt

Fixed #26020 -- Normalized header stylings in docs.

2016-01-22 12:12:17 -05:00

1.5.4.txt

Fixed #26020 -- Normalized header stylings in docs.

2016-01-22 12:12:17 -05:00

1.5.5.txt

Fixed #26020 -- Normalized header stylings in docs.

2016-01-22 12:12:17 -05:00

1.5.6.txt

Refs #23919 -- Removed Python 2 notes in docs.

2017-01-18 11:51:29 -05:00

1.5.7.txt

Fixed #26013 -- Moved django.core.urlresolvers to django.urls.

2015-12-31 14:21:29 -05:00

1.5.8.txt

Refs #17209 -- Removed login/logout and password reset/change function-based views.

2017-09-22 12:51:17 -04:00

1.5.9.txt

Fixed #26013 -- Moved django.core.urlresolvers to django.urls.

2015-12-31 14:21:29 -05:00

1.5.10.txt

Used the 🎫 syntax more extensively

2014-12-19 18:07:52 +01:00

1.5.11.txt

Used the 🎫 syntax more extensively

2014-12-19 18:07:52 +01:00

1.5.12.txt

Added dates to release notes.

2015-01-02 19:20:18 -05:00

1.5.txt

Capitalized "Python" in docs and comments.

2018-10-09 09:26:07 -04:00

1.6.1.txt

Copied 1.6.1 release notes from stable/1.6.x branch.

2013-12-12 15:08:22 -05:00

1.6.2.txt

Refs #23919 -- Removed Python 2 notes in docs.

2017-01-18 11:51:29 -05:00

1.6.3.txt

Refs #23919 -- Removed Python 2 notes in docs.

2017-01-18 11:51:29 -05:00

1.6.4.txt

Fixed #26013 -- Moved django.core.urlresolvers to django.urls.

2015-12-31 14:21:29 -05:00

1.6.5.txt

Refs #17209 -- Removed login/logout and password reset/change function-based views.

2017-09-22 12:51:17 -04:00

1.6.6.txt

Fixed #26013 -- Moved django.core.urlresolvers to django.urls.

2015-12-31 14:21:29 -05:00

1.6.7.txt

Added dates to release notes.

2014-09-02 21:34:29 -04:00

1.6.8.txt

Added release dates to release notes.

2014-10-22 12:23:21 -04:00

1.6.9.txt

Refs #23919 -- Removed Python 2 notes in docs.

2017-01-18 11:51:29 -05:00

1.6.10.txt

Refs #17209 -- Removed login/logout and password reset/change function-based views.

2017-09-22 12:51:17 -04:00

1.6.11.txt

Refs #17209 -- Removed login/logout and password reset/change function-based views.

2017-09-22 12:51:17 -04:00

1.6.txt

Removed code terms from docs/spelling_wordlist.

2018-07-31 12:22:28 -04:00

1.7.1.txt

Added release dates to release notes.

2014-10-22 12:23:21 -04:00

1.7.2.txt

Refs #23919 -- Removed Python 2 notes in docs.

2017-01-18 11:51:29 -05:00

1.7.3.txt

Refs #17209 -- Removed login/logout and password reset/change function-based views.

2017-09-22 12:51:17 -04:00

1.7.4.txt

Added 1.4.19 release notes.

2015-01-27 11:48:04 -05:00

1.7.5.txt

Added release date for 1.7.5 release.

2015-02-25 08:47:11 -05:00

1.7.6.txt

Refs #24461 -- Added test/release notes for XSS issue in ModelAdmin.readonly_fields

2015-03-09 10:12:21 -04:00

1.7.7.txt

Refs #17209 -- Removed login/logout and password reset/change function-based views.

2017-09-22 12:51:17 -04:00

1.7.8.txt

Added dates to release notes.

2015-05-01 16:24:39 -04:00

1.7.9.txt

Prevented newlines from being accepted in some validators.

2015-07-08 15:23:03 -04:00

1.7.10.txt

Refs #17209 -- Removed login/logout and password reset/change function-based views.

2017-09-22 12:51:17 -04:00

1.7.11.txt

Added release date for 1.8.7/1.7.11 releases.

2015-11-24 11:20:29 -05:00

1.7.txt

Fixed #28606 -- Deprecated CachedStaticFilesStorage.

2018-10-27 11:58:29 -04:00

1.8.1.txt

Fixed #23868 -- Added support for non-unique django-admin-options in docs.

2016-01-14 18:21:33 -05:00

1.8.2.txt

Added release date for 1.8.2.

2015-05-20 13:48:06 -04:00

1.8.3.txt

Fixed catastrophic backtracking in URLValidator.

2015-07-08 15:23:03 -04:00

1.8.4.txt

Refs #17209 -- Removed login/logout and password reset/change function-based views.

2017-09-22 12:51:17 -04:00

1.8.5.txt

Added release date for 1.8.5.

2015-10-03 19:31:45 -04:00

1.8.6.txt

Added release date for 1.8.6.

2015-11-04 17:48:49 +01:00

1.8.7.txt

Refs #23919 -- Removed Python 2 notes in docs.

2017-01-18 11:51:29 -05:00

1.8.8.txt

Added release date for 1.9.1/1.8.8 releases.

2016-01-02 08:35:54 -05:00

1.8.9.txt

Added release dates for 1.9.2 and 1.8.9.

2016-02-01 12:02:16 -05:00

1.8.10.txt

Refs #17209 -- Removed login/logout and password reset/change function-based views.

2017-09-22 12:51:17 -04:00

1.8.11.txt

Added safety to URL decoding in is_safe_url() on Python 2

2016-03-04 23:33:35 +01:00

1.8.12.txt

Added release date for 1.9.5 and 1.8.12.

2016-04-01 13:29:43 -04:00

1.8.13.txt

Added release date for 1.9.6/1.8.13.

2016-05-02 18:16:36 -04:00

1.8.14.txt

Fixed XSS in admin's add/change related popup.

2016-07-18 11:17:01 -04:00

1.8.15.txt

Added release notes for 1.9.10 and 1.8.15 releases.

2016-09-26 13:55:21 -04:00

1.8.16.txt

Refs #29784 -- Switched to https:// links where available.

2018-09-26 08:48:47 +02:00

1.8.17.txt

Added release dates for 1.10.4, 1.9.12, 1.8.17.

2016-12-01 17:15:04 -05:00

1.8.18.txt

Refs #17209 -- Removed login/logout and password reset/change function-based views.

2017-09-22 12:51:17 -04:00

1.8.19.txt

Fixed CVE-2018-7537 -- Fixed catastrophic backtracking in django.utils.text.Truncator.

2018-03-06 08:30:40 -05:00

1.8.txt

Removed duplicate words in docs.

2018-07-18 11:24:06 -04:00

1.9.1.txt

Fixed typo in docs/releases/1.9.1.txt.

2016-03-04 14:16:56 -05:00

1.9.2.txt

Added release dates for 1.9.2 and 1.8.9.

2016-02-01 12:02:16 -05:00

1.9.3.txt

Refs #17209 -- Removed login/logout and password reset/change function-based views.

2017-09-22 12:51:17 -04:00

1.9.4.txt

Added safety to URL decoding in is_safe_url() on Python 2

2016-03-04 23:33:35 +01:00

1.9.5.txt

Added release date for 1.9.5 and 1.8.12.

2016-04-01 13:29:43 -04:00

1.9.6.txt

Added release date for 1.9.6/1.8.13.

2016-05-02 18:16:36 -04:00

1.9.7.txt

Added release date for 1.9.7.

2016-06-04 19:24:51 -04:00

1.9.8.txt

Fixed XSS in admin's add/change related popup.

2016-07-18 11:17:01 -04:00

1.9.9.txt

Added release dates for 1.10 and 1.9.9

2016-08-01 13:55:08 -04:00

1.9.10.txt

Added release notes for 1.9.10 and 1.8.15 releases.

2016-09-26 13:55:21 -04:00

1.9.11.txt

Refs #29784 -- Switched to https:// links where available.

2018-09-26 08:48:47 +02:00

1.9.12.txt

Added release dates for 1.10.4, 1.9.12, 1.8.17.

2016-12-01 17:15:04 -05:00

1.9.13.txt

Refs #17209 -- Removed login/logout and password reset/change function-based views.

2017-09-22 12:51:17 -04:00

1.9.txt

Refs #20910 -- Replaced snippet directive with code-block.

2018-09-10 13:00:34 -04:00

1.10.1.txt

Added release date for 1.10.1.

2016-09-01 16:24:46 -04:00

1.10.2.txt

Fixed #27302 -- Fixed ModelAdmin.construct_change_message() changed field detection

2016-10-01 20:14:27 +02:00

1.10.3.txt

Refs #29784 -- Switched to https:// links where available.

2018-09-26 08:48:47 +02:00

1.10.4.txt

Added release dates for 1.10.4, 1.9.12, 1.8.17.

2016-12-01 17:15:04 -05:00

1.10.5.txt

Added release date for 1.10.5.

2017-01-04 13:20:01 -05:00

1.10.6.txt

Fixed typo in docs/releases/1.10.6.txt.

2017-03-01 10:11:32 -05:00

1.10.7.txt

Refs #17209 -- Removed login/logout and password reset/change function-based views.

2017-09-22 12:51:17 -04:00

1.10.8.txt

Fixed CVE-2017-12794 -- Fixed XSS possibility in traceback section of technical 500 debug page.

2017-09-05 10:58:38 -04:00

1.10.txt

Refs #29784 -- Switched to https:// links where available.

2018-09-26 08:48:47 +02:00

1.11.1.txt

Added release date for 1.11.1.

2017-05-06 08:19:41 -04:00

1.11.2.txt

Added release date for 1.11.2.

2017-06-01 11:09:51 -04:00

1.11.3.txt

Added release date for 1.11.3.

2017-07-01 19:13:35 -04:00

1.11.4.txt

Added release date for 1.11.4.

2017-08-01 08:08:18 -04:00

1.11.5.txt

Fixed CVE-2017-12794 -- Fixed XSS possibility in traceback section of technical 500 debug page.

2017-09-05 10:58:38 -04:00

1.11.6.txt

Added release date for 1.11.6.

2017-10-05 14:13:32 -04:00

1.11.7.txt

Added release date for 1.11.7.

2017-11-01 21:11:38 -04:00

1.11.8.txt

Added release dates for 2.0 and 1.11.8.

2017-12-02 08:55:33 -05:00

1.11.9.txt

Added release date for 2.0.1 and 1.11.9.

2018-01-01 19:34:34 -05:00

1.11.10.txt

Fixed CVE-2018-6188 -- Fixed information leakage in AuthenticationForm.

2018-02-01 09:05:14 -05:00

1.11.11.txt

Fixed CVE-2018-7537 -- Fixed catastrophic backtracking in django.utils.text.Truncator.

2018-03-06 08:30:40 -05:00

1.11.12.txt

Added release date for 2.0.4 and 1.11.12.

2018-04-02 21:36:23 -04:00

1.11.13.txt

Added release date for 2.0.5 and 1.11.13.

2018-05-01 21:18:44 -04:00

1.11.14.txt

Added release date for 1.11.14.

2018-07-02 10:12:20 +02:00

1.11.15.txt

Fixed CVE-2018-14574 -- Fixed open redirect possibility in CommonMiddleware.

2018-08-01 09:28:42 -04:00

1.11.16.txt

Added release date for 1.11.16.

2018-10-01 09:34:57 +02:00

1.11.17.txt

Added release date for 1.11.17.

2018-12-03 15:14:58 +01:00

1.11.18.txt

Fixed #30070, CVE-2019-3498 -- Fixed content spoofing possiblity in the default 404 page.

2019-01-03 21:21:55 -05:00

1.11.19.txt

[2.2.x] Fixed CVE-2019-6975 -- Fixed memory exhaustion in utils.numberformat.format().

2019-02-11 11:10:38 +01:00

1.11.txt

Refs #28814 -- Doc'd Python 3.7 compatibility in Django 1.11.x.

2018-11-17 15:40:35 -05:00

2.0.1.txt

Added release date for 2.0.1 and 1.11.9.

2018-01-01 19:34:34 -05:00

2.0.2.txt

Fixed CVE-2018-6188 -- Fixed information leakage in AuthenticationForm.

2018-02-01 09:05:14 -05:00

2.0.3.txt

Fixed CVE-2018-7537 -- Fixed catastrophic backtracking in django.utils.text.Truncator.

2018-03-06 08:30:40 -05:00

2.0.4.txt

Added release date for 2.0.4 and 1.11.12.

2018-04-02 21:36:23 -04:00

2.0.5.txt

Fixed typo in docs/releases/2.0.5.txt.

2018-08-21 09:48:14 -04:00

2.0.6.txt

Fixed #28462 -- Decreased memory usage with ModelAdmin.list_editable.

2018-06-01 10:41:05 -04:00

2.0.7.txt

Forwardported 2.0.7 release note.

2018-06-28 11:07:37 -04:00

2.0.8.txt

Fixed CVE-2018-14574 -- Fixed open redirect possibility in CommonMiddleware.

2018-08-01 09:28:42 -04:00

2.0.9.txt

Added release date for 2.0.9 release.

2018-10-01 09:55:56 +02:00

2.0.10.txt

Fixed #30070, CVE-2019-3498 -- Fixed content spoofing possiblity in the default 404 page.

2019-01-03 21:21:55 -05:00

2.0.11.txt

[2.2.x] Fixed CVE-2019-6975 -- Fixed memory exhaustion in utils.numberformat.format().

2019-02-11 11:10:38 +01:00

2.0.txt

[2.2.x] Updated Oracle docs links to Oracle 18c.

2019-02-07 10:03:11 +01:00

2.1.1.txt

Added release date for 2.1.1.

2018-08-31 10:12:51 +02:00

2.1.2.txt

Added release date for 2.1.2 release.

2018-10-01 10:10:48 +02:00

2.1.3.txt

Added release date for 2.1.2 release.

2018-11-01 15:02:22 +01:00

2.1.4.txt

Added release date for 2.1.4.

2018-12-03 17:29:46 +01:00

2.1.5.txt

Fixed #30070, CVE-2019-3498 -- Fixed content spoofing possiblity in the default 404 page.

2019-01-03 21:21:55 -05:00

2.1.6.txt

[2.2.x] Fixed CVE-2019-6975 -- Fixed memory exhaustion in utils.numberformat.format().

2019-02-11 11:10:38 +01:00

2.1.txt

Doc'd purpose of "Database backend API" backwards incompatible changes section.

2018-11-17 15:58:10 -05:00

2.2.txt

[2.2.x] Fixed typo in docs/releases/2.2.txt.

2019-01-29 09:10:53 -05:00

index.txt

[2.2.x] Added stub release notes for security releases.

2019-02-07 15:47:52 +01:00

security.txt

[2.2.x] Used extlinks for GitHub commits.

2019-02-01 15:49:31 -05:00