914c72be2a introduced a regression that
causes saving a NamedTemporaryFile in a FileField to raise a
SuspiciousFileOperation. To remedy this, if a File has an absolute
path as a filename, use only the basename as the filename.
File operations always raise a ENOENT error when a file doesn't exist.
Checking the file exists before the operation adds a race condition
condition where the file could be removed between operations. As the
operation already raises an error on a missing file, avoid this race and
avoid checking the file exists twice. Instead only check a file exists
by catching the ENOENT error.
Leading slashes in the second urljoin argument will return exactly that
argument, breaking FileSystemStorage.url behavior if called with a
parameter with leading slashes.
Also added test cases for null bytes and None. Thanks to Markus for
help and review.
New Storage.get_{accessed,created,modified}_time() methods convert the
naive time from now-deprecated {accessed,created_modified}_time()
methods into aware objects in UTC if USE_TZ=True.
This reverts commit f36151ed16.
Adding kwargs to deconstructed objects does not achieve useful
forward-compatibility in general, since additional arguments are silently
dropped rather than having their intended effect. In fact, it can make the
failure more difficult to diagnose. Thanks Shai Berger for discussion.
Added a test for the condition safe_join is designed to prevent.
Previously, a generic ValueError was raised. It was impossible to tell
an intentional exception raised to implement safe_join's contract from
an unintentional exception caused by incorrect inputs or unexpected
conditions. That resulted in bizarre exception catching patterns, which
this patch removes.
Since safe_join is a private API and since the change is unlikely to
create security issues for users who use it anyway -- at worst, an
uncaught SuspiciousFileOperation exception will bubble up -- it isn't
documented.
The following are recognized as ending a line: the Unix end-of-line
convention '\n', the Windows convention '\r\n', and the old
Macintosh convention '\r'.
http://www.python.org/dev/peps/pep-0278
Thanks tchaumeny for review.
This patch is two-fold; first it ensure that Django does close everything in
request.FILES at the end of the request and secondly the storage system should
no longer close any files during save, it's up to the caller to handle that --
or let Django close the files at the end of the request.
Tim Graham
Claude Paroz
Simon Charette
Simon Charette
Ramin Farajpour Cami
Berker Peksag
Tomas Pazderka
Ville Skyttä
Hugo Osvaldo Barrera
Jon Dufresne
Cristiano
Maxim Novikov
rixx
James Aylett
Maxime Lorant
Carson Gee
David Danier
steve
Matt Hooks
Raúl Cumplido
Pavel Shpilev
Sergey Fedoseev
Carl Meyer
Aymeric Augustin
Loic Bistuer
Florian Apolloner