Commit Graph

9360 Commits

Author SHA1 Message Date
Tim Graham dc8176eb3a [1.6.x] Fixed bug causing CSRF token not to rotate on login.
Thanks Gavin McQuillan for the report.

Backport of ac4fec5ca2 from master
2013-10-18 08:33:00 -04:00
Claude Paroz 621fc1f1d7 [1.6.x] Fixed #21284 -- Prevented KeyError swallowing in fetch_command
Thanks wildfire for the report.

Backport of 3514bcb251 from master.
2013-10-18 14:05:26 +02:00
Claude Paroz b2f9c74ed1 [1.6.x] Fixed #21282 -- Made HttpResponse.serialize_headers accept latin-1
Thanks Raphaël Barrois for the report and the initial patch and
Aymeric Augustin for the review.

Backport of a14f087233 from master.
2013-10-17 18:15:56 +02:00
Claude Paroz ba9cf9596b [1.6.x] Fixed #21269 -- Don't crash when CommandError contains non-ascii
Thanks kontakt@eikefoken.de for the report.

Backport of 42a67ec1cd from master.
2013-10-14 21:28:29 +02:00
Claude Paroz 4a9bae0b39 [1.6.x] Imported custom user classes in tests depending on it
Without those imports, affected test files cannot be run
independently. Refs #21164.

Backport of ef22d512b5 from master.
2013-10-14 10:17:51 +02:00
Aymeric Augustin 5591fe6829 [1.6.x] Fixed #21256 -- Error in datetime_safe.datetime.combine.
Backport of d9b6fb8 from master
2013-10-13 19:11:43 +02:00
Aymeric Augustin f0c7649b16 Fixed #21198 -- Prevented invalid use of @python_2_unicode_compatible.
Thanks jpic for the report and chmodas for working on a patch.

Reverts 2ea80b94. Refs #19362.

Conflicts:
	tests/utils_tests/test_encoding.py
2013-10-13 18:25:21 +02:00
Aymeric Augustin ddff6522fa [1.6.x] Fixed #19560 -- Identified field in warning for naive datetime.
Thanks gcc for the report and vajrasky for the patch.

Backport of 570d9c2678 from master.
2013-10-13 11:58:12 +02:00
Claude Paroz 8765eddf2e [1.6.x] Updated auth translation template 2013-10-09 20:21:08 +02:00
Russell Keith-Magee 1ab84b6c65 [1.6.x] Fixed #21164 -- Added documentation for issue with test users.
The package renaming restores the older package names (which were also the
documented package names). This doesn't affect test discovery because the
module in question doesn't contain any tests.

Thanks to Carl for the design discussion.

Backport of ddb5385 from master.
2013-10-08 10:37:48 +08:00
Russell Keith-Magee 7f0fdffd07 [1.6.x] Refs #21197 -- Clarified upgrade check message.
Thanks to Carl and Shai for the discussion.

Backport of 8ff4303 from master.
2013-10-08 10:02:08 +08:00
Aymeric Augustin b42f0665a8 [1.6.x] Fixed #21235 -- Disabled savepoints for old versions of SQLite.
Thanks Ramiro for the report.

Backport of 91547772 from master.
2013-10-07 10:49:28 +02:00
tschilling e5b0f5b95d [1.6.x] Fixed #21129 -- Prevented admin filter params modifications from throwing an exception.
Thanks Tuttle for the report.

Backport of 5381317fe3 from master
2013-10-02 09:13:59 -04:00
Ramiro Morales d16753eecd [1.6.x] Fixed #21209 -- .po file path comments on Windows.
Literals from source files with Django template language syntax don't
have a '.py' suffix anymore.

Also, the '.\' prefix is preserved to respect GNU gettext behavior on
that platform.

Refs #16903.

4b715fc05a from master.
2013-10-01 20:42:13 -03:00
Anssi Kääriäinen 9972a101e6 [1.6.x] Fixed #21203 -- resolve_columns fields misalignment
In queries using .defer() together with .select_related() the values
and fields arguments didn't align properly for resolve_columns().

Backpatch of bf13c75c0d from master.
2013-10-01 20:47:28 +03:00
Claude Paroz 5b97b99a01 [1.6.x] Factorized requires_tz_support decorator in test utils
Thanks Aymeric Augustin for the suggestion. Refs #21165.
Backport of c1c44b2506 from master.
2013-10-01 13:28:24 +02:00
Aymeric Augustin 0d74bdaf0c Fixed #21134 -- Prevented queries in broken transactions.
Backport of 728548e4 from master.

Squashed commit of the following:

commit 63ddb271a44df389b2c302e421fc17b7f0529755
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Sun Sep 29 22:51:00 2013 +0200

    Clarified interactions between atomic and exceptions.

commit 2899ec299228217c876ba3aa4024e523a41c8504
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Sun Sep 22 22:45:32 2013 +0200

    Fixed TransactionManagementError in tests.

    Previous commit introduced an additional check to prevent running
    queries in transactions that will be rolled back, which triggered a few
    failures in the tests. In practice using transaction.atomic instead of
    the low-level savepoint APIs was enough to fix the problems.

commit 4a639b059ea80aeb78f7f160a7d4b9f609b9c238
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Tue Sep 24 22:24:17 2013 +0200

    Allowed nesting constraint_checks_disabled inside atomic.

    Since MySQL handles transactions loosely, this isn't a problem.

commit 2a4ab1cb6e83391ff7e25d08479e230ca564bfef
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Sat Sep 21 18:43:12 2013 +0200

    Prevented running queries in transactions that will be rolled back.

    This avoids a counter-intuitive behavior in an edge case on databases
    with non-atomic transaction semantics.

    It prevents using savepoint_rollback() inside an atomic block without
    calling set_rollback(False) first, which is backwards-incompatible in
    tests.

    Refs #21134.

commit 8e3db393853c7ac64a445b66e57f3620a3fde7b0
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Sun Sep 22 22:14:17 2013 +0200

    Replaced manual savepoints by atomic blocks.

    This ensures the rollback flag is handled consistently in internal APIs.
2013-09-30 10:14:22 +02:00
Baptiste Mispelon c2a35d40db [1.6.x] Fixed #21186: Fixed regression when using date fields in the admin's list_filter.
Thanks to onlygoldi2201 for the report and to ramiro and apollo13
for the reviews.

Backport of 8f51ba669a from master.
2013-09-28 00:46:37 +02:00
Baptiste Mispelon 15bdc85117 [1.6.x] Fix #21185: Added tests for unescape_entities.
Also fixed a py3 incompatibility.
Thanks to brutasse for the report.

Backport of 3754f4ad41 from master.
2013-09-27 18:06:28 +02:00
Javed Khan f621aba99b [1.6.x] Fixed an ImportError in `django.core.cache.backends.db`
It was introduced by a979a2fea5.
2013-09-27 03:21:54 -04:00
Michael Manfre a979a2fea5 [1.6.x] Fixed #21146 - DatabaseCache converts expires to python value
DatabaseCache uses raw cursors to bypass the ORM. This prevents it from
being used by database backends that require special handling of datetime
values.

There is no easy way to test this, so no tests added.

Backport of d5606b5763 from master
2013-09-26 13:42:32 +03:00
Anssi Kääriäinen d7ae0bc372 [1.6.x] Fixed #21126 -- QuerySet value conversion failure
A .annotate().select_related() query resulted in misaligned rows vs
columns for compiler.resolve_columns() method.

Report & patch by Michael Manfre.

Backpatch of 83554b018e from master.
2013-09-25 20:50:48 +03:00
Florian Apolloner e5dc08f2db [1.6.x] Fixed #21138 -- Increased the performance of our PBKDF2 implementation.
Thanks go to Michael Gebetsroither for pointing out this issue and help on
the patch.

Backport of 68540fe4df from master.
2013-09-24 21:10:21 +02:00
Florian Apolloner 50a811a170 Revert "[1.6.x] Ensure that passwords are never long enough for a DoS."
This reverts commit 5ecc0f828e.

This fix is no longer necessary, our pbkdf2 (see next commit) implementation
no longer rehashes the password every iteration.
2013-09-24 21:09:52 +02:00
Anssi Kääriäinen 1a922870ea [1.6.x] Fixed #21150 -- Improved Query.add_fields() join promotion logic
Thanks to Eivind Fonn for the report and test case.
2013-09-24 19:04:42 +03:00
Michał Lech 11dfb58131 [1.6.x] Marked PermissionsMixin.user_permissions help_text for translation
Backport of 53c7d66869 from master
2013-09-24 07:37:12 -04:00
Florian Apolloner 56201fe5a8 [1.6.x] Fixed "Address already in use" from liveserver.
Our WSGIServer rewrapped the socket errors from server_bind into
WSGIServerExceptions, which is used later on to provide nicer
error messages in runserver and used by the liveserver to see if
the port is already in use. But wrapping server_bind isn't enough since
it only binds to the socket, socket.listen (which is called from
server_activate) could also raise "Address already in use".

Instead of overriding server_activate too I chose to just catch socket
errors, which seems to make more sense anyways and should be more robust
against changes in wsgiref.

Backport of 2ca00faa91 from master.
2013-09-22 22:04:50 +02:00
Florian Apolloner ece8d65217 [1.6.x] Ensured that BoundField.as_widget always returns properly localized fields.
This is a follow-up to #18777 which improperly converted to strings in
prepare_value and as such caused regressions like #21074.

Refs #18777, #21074

Backport of 56743cf9e3 from master.
2013-09-21 22:58:18 +02:00
Paul McMillan 85ba68cc14 [1.6.x] Increased default PBKDF2 iterations
Increases the default PBKDF2 iterations, since computers have gotten
faster since 2011. In the future, we plan to increment by 10% per
major version.

Backport of a075e2ad0d from master
2013-09-19 15:34:59 -04:00
Tim Graham 778d4da9cc [1.6.x] Fixed #21098 -- Applied sensitive_post_parameters to MultiValueDict
Thanks simonpercivall for the report and bmispelon for the review.

Backport of 2daada800f from master
2013-09-18 09:56:01 -04:00
Tim Graham 275497c570 [1.6.x] Fixed #15625 -- Made message in MultiValueDictKeyError less verbose.
Thanks margieroginski for the suggestion.

Backport of 893198509e from master
2013-09-18 06:49:59 -04:00
Florian Apolloner 325b03ea84 [1.6.x] Final attempt to solve sporadic test failures.
tearDownClass is not called if setUpClass throws an exception, in our case
this means that LiveServerTestCase leaks LiveServerThread sockets if the
test happens to be skipped later on, and AdminSeleniumWebDriverTestCase
doesn't close it's already open browser window. To prevent this leakage
we catch errors where needed and manually call _tearDownClassInternal.
_tearDownClassInternal should be written as defensively as possible since
it is not allowed to make any assumptions on how far setUpClass got.

This patch should fix the sporadic "Address already in use"-errors on jenkins
and also the "This code isn't under transaction management"-error for sqlite
(also just on jenkins).

After discussion with koniiiik, jezdez, kmtracey, tos9, lifeless, nedbat and
voidspace it was decided that this is the safest approach (thanks to everyone
for their comments and help). Manually calling tearDownClass was shut down
cause we don't know how our users override our classes.

This is a private and very specialized API on purpose and should not be used
without a strong reason!

This patch partially reverts the earlier attempts to fix those issues,
namely:
	2fa0dd73b1 and
	3c5775d36f

Final note: If this patch breaks in a later version of Django, please be
very careful on how you fix it, you might not see test failures locally.
That said, this patch hopefully doesn't produce even more failures.

Backport of 73a610d2a8 from master.
2013-09-17 18:36:32 +02:00
Anssi Kääriäinen 5937f291c1 [1.6.x] Fixed #21109 -- made db cursor error wrapping faster
Backpatch of 9400142132 from master.
2013-09-17 12:31:13 +03:00
James Bennett 623c4916df [1.6.x] Add release notes and bump version number for security release. 2013-09-15 00:36:03 -06:00
Russell Keith-Magee 5ecc0f828e [1.6.x] Ensure that passwords are never long enough for a DoS.
* Limit the password length to 4096 bytes
  * Password hashers will raise a ValueError
  * django.contrib.auth forms will fail validation
 * Document in release notes that this is a backwards incompatible change

Thanks to Josh Wright for the report, and Donald Stufft for the patch.

This is a security fix; disclosure to follow shortly.

Backport of aae5a96d57 from master.
2013-09-15 13:46:16 +08:00
James Bennett ed9b7b6295 [1.6.x] Bump version number for 1.6 beta 3 security release. 2013-09-10 20:32:14 -05:00
Tim Graham 536cc64240 [1.6.x] Prevented arbitrary file inclusion with {% ssi %} tag and relative paths.
Thanks Rainer Koirikivi for the report and draft patch.

This is a security fix; disclosure to follow shortly.

Backport of 7fe5b656c9 from master
2013-09-10 21:03:51 -04:00
Aymeric Augustin f9f792eb04 [1.6.x] Took advantage of django.utils.six.moves.urllib.*.
Backport of 6a6428a36 from master.
2013-09-10 21:29:31 +02:00
Садовский Николай e4274e3da1 [1.6.x] Fixed #20707 -- Added explicit quota assignment to Oracle test user
To enable testing on Oracle 12c
2013-09-09 14:02:21 +03:00
Aymeric Augustin 7c31e195db [1.6.x] Fixed #18766 -- Pointed to pytz when LocalTimezone fails.
Thanks void for the report.

Backport of ded11aa6 from master.
2013-09-08 09:17:03 +02:00
Aymeric Augustin 63b95ca452 [1.6.x] Fixed 9244447c -- incomplete backport.
The test client had been refactored in the mean time. This commit
de-factors the fix. Refs #20530.
2013-09-07 13:15:13 -05:00
Aymeric Augustin 7fcd6aa669 [1.6.x] Fixed #20530 -- Properly decoded non-ASCII query strings on Python 3.
Thanks mitsuhiko for the report.

Backport of 65b6eff3 and adaptation of 8aaca65 from master.
2013-09-07 12:06:38 -05:00
Aymeric Augustin 9244447cc4 [1.6.x] Fixed an encoding issue in the test client.
Refs #20530.

Backport of 7bb62793 and 476b0764 from master.

Conflicts:
	django/test/client.py
2013-09-07 12:06:19 -05:00
Aymeric Augustin fac5735a3d [1.6.x] Fixed #20557 -- Properly decoded non-ASCII cookies on Python 3.
Thanks mitsuhiko for the report.

Non-ASCII values are supported. Non-ASCII keys still aren't, because the
current parser mangles them. That's another bug.

Simplified backport of 8aaca651 and f5add47 from master.
2013-09-07 10:45:24 -05:00
Aymeric Augustin f855058c35 [1.6.x] Fixed #11811 -- Data-loss bug in queryset.update.
It's now forbidden to call queryset.update(field=instance) when instance
hasn't been saved to the database ie. instance.pk is None.

Conflicts:
	tests/queries/tests.py

Backport of b4cd8169 from master.
2013-09-06 21:59:28 -05:00
Russell Keith-Magee 2a2ac5c140 Merge pull request #1566 from adamsc64/ticket_11857
Fixed #11857 -- Added missing 'closed' property on TemporaryFile class.

Backport of 926bc42 from trunk.
2013-09-06 19:44:25 -05:00
Tim Graham 6ba01f64c1 [1.6.x] Fixed Python 3 syntax error introduced in [c72392da]
Backport of 498014ccd5 from master
2013-09-06 20:08:56 -04:00
Russell Keith-Magee 3df9647ad9 [1.6.x] Merge pull request #1582 from rca/12756-missing-yaml-module-serializer-error-message
Fixed #12756: Improved error message when yaml module is missing.

Backport of 4f5faa1916 from master.
2013-09-06 19:01:24 -05:00
Russell Keith-Magee 99952bab30 [1.6.x] Merge pull request #1580 from ianawilson/ticket_16502
Fixed #16502 -- Fixed a TemplateDoesNotExist error that should be an ImproperlyConfigured.

Assistance on the patch from #jambronrose.

Backport of 9b2dc12b83 from master.
2013-09-06 17:39:16 -05:00
Russell Keith-Magee b917458f47 Merge pull request #1579 from ianawilson/ticket_21058
[1.6.x] Fixed #21058 -- Fixed debug view blowing up when no template is provided to the template rendering functions.

Assistance on this commit from @jambonrose.

Backport of 122020fdb9 from master.
2013-09-06 17:11:07 -05:00
Max Burstein 92e89452f1 [1.6.x] Fixed #21049 -- Fixed autoreload for Python 3
Changed th system module values check to return a list.
In Python 3 it returns a dict_view which could occassionally produce
a runtime error of "dictionary changed size during iteration".

Backport of 559cb826b8 from master
2013-09-06 17:32:08 -04:00
Eric Boersma 180b9955cc [1.6.x] Fixed #21035 -- Changed docs to treat the acronym SQL phonetically.
The documentation and comments now all use 'an' to
refer to the word SQL and not 'a'.

Backport of 4d13cc56de from master
2013-09-05 20:16:14 -04:00
Aymeric Augustin a8624b22a7 [1.6.x] Tested exc_type instead of exc_value in __exit__.
exc_value might be None even though there's an exception, at least on
Python 2.6. Thanks Thomas Chaumeny for the report.

Fixed #21034.
2013-09-04 16:18:47 -05:00
Aymeric Augustin 7c1efc2fa6 Updated six to version 1.4.1. 2013-09-04 15:23:24 -05:00
Carl Meyer 4420de89b6 [1.6.x] Fixed #21026 -- Corrected help for manage.py test command.
Backport of 8f7f8bf688 from master.
2013-09-03 09:51:17 -06:00
Aymeric Augustin 2a14c08e71 Used six.moves.zip_longest, new in six 1.4.0. 2013-09-03 07:34:45 -05:00
Aymeric Augustin 115318051c [1.6.x] Replaced "not PY3" by "PY2", new in six 1.4.0.
Conflicts:
	django/db/backends/oracle/base.py
	django/db/backends/sqlite3/base.py
	django/db/models/base.py

Backport of 365c3e8b from master.
2013-09-03 07:34:45 -05:00
Aymeric Augustin 50012577f3 [1.6.x] Updated the bundled version of six to 1.4.0.
Backport of 42920970 from master.
2013-09-03 07:34:44 -05:00
Claude Paroz 0514fbb2f3 [1.6.x] Fixed #21003 -- Ensured geometry widget return value has SRID
Thanks Mathieu Leplatre for the report and initial patch.
Backport of dd656073ad from master.
2013-09-03 13:55:20 +02:00
Claude Paroz bd0319a261 [1.6.x] Isolated map creation JS code
Backport of 3550b27a8 from master.
2013-09-03 13:54:50 +02:00
Claude Paroz b53ce2f31c [1.6.x] Prevented rendering attrs to be squashed in OSMWidget
Backport of b6889c68d7 from master.
2013-09-03 10:04:50 +02:00
Claude Paroz aa1c175687 [1.6.x] Fixed syntax error in OSMWidget
Backport of 6ecbac21a from master.
2013-09-03 09:08:25 +02:00
Claude Paroz 0c57868908 [1.6.x] Fixed gis test to run on non gis-enabled settings
Refs #20998.
Backport of 973502c0 from master.
2013-09-02 14:31:20 +02:00
Claude Paroz 4e3794dd1f [1.6.x] Fixed #20998 -- Allow custom (de)serialization for GIS widgets
Thanks Mathieu Leplatre for the report and the initial patch.
Backport of 102f26c92 from master.
2013-09-02 13:34:26 +02:00
Carl Meyer 21a3efcf48 [1.6.x] Fixed #20999 - Allow overriding formfield class with choices, without subclass restrictions.
Refs #18162. Thanks claudep and mjtamlyn for review.

Backport of 7211741fc5 from master.
2013-08-30 17:45:14 -06:00
Claude Paroz 1d874ce0f9 [1.6.x] Set 'bidi' Urdu property to True
Refs #20454.
Backport of e4a67fd90 from master.
2013-08-30 12:04:17 +02:00
Anssi Kääriäinen 76e38a2177 [1.6.x] Fixed #20988 -- Added model meta option select_on_save
The option can be used to force pre 1.6 style SELECT on save behaviour.
This is needed in case the database returns zero updated rows even if
there is a matching row in the DB. One such case is PostgreSQL update
trigger that returns NULL.

Reviewed by Tim Graham.

Refs #16649

Backport of e973ee6a98 from master

Conflicts:
	django/db/models/options.py
	tests/basic/tests.py
2013-08-30 09:47:34 +03:00
Anssi Kääriäinen cd10e998b6 [1.6.x] Removed stale add_q() comment
Backport of 13be3bfef1 from master
2013-08-30 09:46:16 +03:00
Tim Graham 10d15f79e5 [1.6.x] Fixed #14786 -- Fixed get_db_prep_lookup calling get_prep_value twice if prepared is False.
Thanks homm for the report and Aramgutang and lrekucki for work on
the patch.

Backport of f19a3669b8 from master
2013-08-29 12:14:40 -04:00
Tim Graham ef1259342b [1.6.x] Fixed #16433 -- Fixed a help_text/read only field interaction that caused an admin crash.
Thanks chris at cogdon.org for the report and admackin for the patch.

Backport of af953c45cc from master
2013-08-29 09:45:02 -04:00
Claude Paroz 58157be5ad [1.6.x] Fixed #20984 -- Stopped decoding bytes in sqlite3 adapter on Python 3
Thanks lvella at gmail.com for the report.
Backport of 169637649 from master.
2013-08-29 08:43:35 +02:00
Claude Paroz 2c08d474a8 [1.6.x] Fixed #20961 -- Fixed HttpResponse default empty content
Thanks epandurski at gmail.com for the report.
Backport of f4e980456 from master.
2013-08-24 18:10:50 +02:00
Tim Graham 5f061986b9 [1.6.x] Fixed #20922 -- Allowed customizing the serializer used by contrib.sessions
Added settings.SESSION_SERIALIZER which is the import path of a serializer
to use for sessions.

Thanks apollo13, carljm, shaib, akaariai, charettes, and dstufft for reviews.

Backport of b0ce6fe656 from master
2013-08-22 17:55:01 -04:00
Claude Paroz ff92a6eb5b [1.6.x] Moved translator comment just above the target string
Backport of 8cd874298 from master.
2013-08-22 09:54:35 +02:00
Anssi Kääriäinen 161e26c2ec [1.6.x] Fixed #20955 -- select_related regression
In cases where the same connection (from model A to model B along the
same field) was needed multiple times in a select_related query, the
join setup code mistakenly reused an existing join.

Backpatch of 8d65b6082c.

Conflicts:

	django/db/models/sql/compiler.py
	tests/queries/tests.py
2013-08-22 10:59:59 +03:00
Tim Graham 28b1317fd8 [1.6.x] Fixed #20949 -- Typo #2 in docstring
Backport of 0073f1d94f from master
2013-08-21 10:50:27 -04:00
Tim Graham b0821e6d3a [1.6.x] Fixed docstring typo, thanks minddust.
Backport of d3ed15b79d from master
2013-08-21 09:02:19 -04:00
Florian Apolloner 12d364a9b0 [1.6.x] Fixed #20933 -- Allowed loaddata to load fixtures from relative paths.
Backport of 6e846f7627 from master.
2013-08-20 21:28:14 +02:00
Anssi Kääriäinen 2b1101a4a6 [1.6.x] Fixed #20820 -- Model inheritance + m2m fixture loading regression
Tests by Tim Graham, report from jeroen.pulles@redslider.net.

Backport of 1ed77e7782 from master
2013-08-20 17:15:52 +03:00
Simon Charette f0bc2865ff Fixed #20943 -- Weakly reference senders when caching their associated receivers
Backport of e55ca60903 from master.
2013-08-20 02:12:50 -04:00
Simon Charette e7a6eaf5fe [1.6.x] Correctly format missing Pillow/PIL exceptions messages. refs #19934
Backport of b9590a6935 from master.
2013-08-19 18:51:22 -04:00
Harm Geerts a6ac4f90d0 [1.6.x] Fixed #20829 -- Skip postgis metadata tables with introspection
Backport of 24088618 from master.
2013-08-16 21:21:41 +02:00
Claude Paroz 1b48de06c3 [1.6.x] Updated translation templates 2013-08-16 15:13:31 +02:00
Tim Graham c769c26601 [1.6.x] Revert "Fixed #18491 -- deleting a proxy doesn't show warning about cascade deletes"
This reverts commit 2b48fcc607.

It introduced a regression (#20777) which we can't easily fix in 1.6.
2013-08-16 07:59:16 -04:00
Alasdair Nicol 919934602f [1.6.x] Fixed #20895 -- Made check management command warn if a BooleanField does not have a default value
Thanks to Collin Anderson for the suggestion and Tim Graham for
reviewing the patch.

Backport of 22c6497f99 from master
2013-08-15 20:33:02 -04:00
Tim Graham ccff25b143 [1.6.x] Fixed #17778 -- Prevented class attributes on context from resolving as template variables.
Thanks KyleMac for the report, regebro for the patch, and Aymeric for the test.

Backport of 71b5617c24 from master.
2013-08-15 10:22:56 -04:00
Loic Bistuer 39db994790 [1.6.x] Fixed overflow for the "Recent Actions" widget on the admin index.
Previously the CSS targeted "li.changelink" and therefore didn't
work for the "add" and "delete" actions.

Refs #14868.

Backport of 33fc083b0d from master
2013-08-13 13:26:37 -04:00
Jacob Kaplan-Moss 57dc238d0e Bumped version numbers for 1.6b2. 2013-08-13 11:12:07 -05:00
Jacob Kaplan-Moss bfbae15c66 Apply autoescaping to AdminURLFieldWidget.
This is a security fix; disclosure to follow shortly.
2013-08-13 11:06:00 -05:00
Jacob Kaplan-Moss 79594b40c0 Fixed is_safe_url() to reject URLs that use a scheme other than HTTP/S.
This is a security fix; disclosure to follow shortly.
2013-08-13 11:05:41 -05:00
Collin Anderson e3e0cf8a0f [1.6.x] Fixed #20865 -- Fixed raw_id_fields to work with callable limit_choices_to.
Backport of d53e574676 from master
2013-08-06 13:44:31 -04:00
Alex Cucu 80b95a2b1f [1.6.x] Fixed #19918 -- Modified select_for_update to run on the write database.
Backport of 1c64a0f29e from master
2013-08-06 10:58:32 -04:00
Tim Heap 891cdf120a [1.6.x] Fixed #20850 -- Added MultiWidget.needs_multipart_form
Backport of 75c87e2d38 from master
2013-08-05 10:13:48 -04:00
Tim Graham 90bdb42702 [1.6.x] Fixed backport error in previous commit; refs #15961 2013-08-04 07:30:30 -04:00
Loic Bistuer 9053c6da5f [1.6.x] Moved get_search_results from BaseModelAdmin to ModelAdmin.
Refs #15961.

Backport of 470a9bb22d from master.
2013-08-04 07:19:13 -04:00
Aymeric Augustin 2eac989985 [1.6.x] Fixed #20822 -- Set content type of default error pages to 'text/html'.
Thanks Jimmy Song for the patch.

Backport of 7843775 from master.
2013-08-04 11:04:58 +02:00
Tim Graham 97254154ab [1.6.x] Fixed #18923 -- Corrected usage of sensitive_post_parameters in contrib.auth
Thanks Collin Anderson for the report.

Backport of 425d076d0c from master
2013-08-02 14:46:51 -04:00
Petr Dlouhý 4e7745cc1c [1.6.x] Fixed LogEntry.get_admin_url() for non-existent models.
Regression introduced by [369b6fa]; refs #18169.

Backport of 1b47508ac8 from master
2013-08-02 12:51:46 -04:00
Loic Bistuer 4f8fb19994 [1.6.x] Fixed #18681 -- GenericInlineModelAdmin.get_formset() no longer bypasses get_fieldsets().
Refs 23e1b59 which already fixed this issue for ModelAdmin and InlineModelAdmin.

Backport of a0ed2f9260 from master
2013-08-02 10:45:58 -04:00
Harm Geerts b0bde21884 [1.6.x] Fixed #20838 -- Fixed Geodjango spatialrefsys test failure with postgis-2.0.3
Backport of fd0d486467 from master
2013-08-02 10:45:27 -04:00