Commit Graph

1617 Commits

Author SHA1 Message Date
Carl Meyer c6d69c12ea Restrict the XML deserializer to prevent network and entity-expansion DoS attacks.
This is a security fix. Disclosure and advisory coming shortly.
2013-02-19 11:23:30 -07:00
Russell Keith-Magee f5e4a699ca Fixed #19822 -- Added validation for uniqueness on USERNAME_FIELD on custom User models.
Thanks to Claude Peroz for the draft patch.
2013-02-15 09:00:55 +08:00
Simon Charette ec469ade2b Fixed #19689 -- Renamed `Model._meta.module_name` to `model_name`. 2013-02-05 04:16:07 -05:00
Claude Paroz 7c5b244826 Fixed #17061 -- Factored out importing object from a dotted path
Thanks Carl Meyer for the report.
2013-02-04 16:38:25 +01:00
Aymeric Augustin 3f1c7b7053 Simplified default project template.
Squashed commit of:

commit 508ec9144b35c50794708225b496bde1eb5e60aa
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Tue Jan 29 22:50:55 2013 +0100

    Tweaked default settings file.

    * Explained why BASE_DIR exists.
    * Added a link to the database configuration options, and put it in its
      own section.
    * Moved sensitive settings that must be changed for production at the
      top.

commit 6515fd2f1aa73a86dc8dbd2ccf512ddb6b140d57
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Tue Jan 29 14:35:21 2013 +0100

    Documented the simplified app & project templates in the changelog.

commit 2c5b576c2ea91d84273a019b3d0b3b8b4da72f23
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Tue Jan 29 13:59:27 2013 +0100

    Minor fixes in tutorials 5 and 6.

commit 55a51531be8104f21b3cca3f6bf70b0a7139a041
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Tue Jan 29 13:51:11 2013 +0100

    Updated tutorial 2 for the new project template.

commit 29ddae87bdaecff12dd31b16b000c01efbde9e20
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Tue Jan 29 11:58:54 2013 +0100

    Updated tutorial 1 for the new project template.

commit 0ecb9f6e2514cfd26a678a280d471433375101a3
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Tue Jan 29 11:29:13 2013 +0100

    Adjusted the default URLconf detection to account for the admin.

    It's now enabled by default.

commit 5fb4da0d3d09dac28dd94e3fde92b9d4335c0565
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Tue Jan 29 10:36:55 2013 +0100

    Added security warnings for the most sensitive settings.

commit 718d84bd8ac4a42fb4b28ec93965de32680f091e
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Mon Jan 28 23:24:06 2013 +0100

    Used an absolute path for the SQLite database.

    This ensures the settings file works regardless of which directory
    django-admin.py / manage.py is invoked from.

    BASE_DIR got a +1 from a BDFL and another core dev. It doesn't involve
    the concept of a "Django project"; it's just a convenient way to express
    relative paths within the source code repository for non-Python files.

    Thanks Jacob Kaplan-Moss for the suggestion.

commit 1b559b4bcda622e10909b68fe5cab90db6727dd9
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Mon Jan 28 23:22:40 2013 +0100

    Removed STATIC_ROOT from the default settings template.

    It isn't necessary in development, and it confuses beginners to no end.

    Thanks Carl Meyer for the suggestion.

commit a55f141a500bb7c9a1bc259bbe1954c13b199671
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Mon Jan 28 23:21:43 2013 +0100

    Removed MEDIA_ROOT/URL from default settings template.

    Many sites will never deal with user-uploaded files, and MEDIA_ROOT is
    complicated to explain.

    Thanks Carl Meyer for the suggestion.

commit 44bf2f2441420fd9429ee9fe1f7207f92dd87e70
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Mon Jan 28 22:22:09 2013 +0100

    Removed logging config.

    This configuration is applied regardless of the value of LOGGING;
    duplicating it in LOGGING is confusing.

commit eac747e848eaed65fd5f6f254f0a7559d856f88f
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Mon Jan 28 22:05:31 2013 +0100

    Enabled the locale middleware by default.

    USE_I18N is True by default, and doesn't work well without
    LocaleMiddleware.

commit d806c62b2d00826dc2688c84b092627b8d571cab
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Mon Jan 28 22:03:16 2013 +0100

    Enabled clickjacking protection by default.

commit 99152c30e6a15003f0b6737dc78e87adf462aacb
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Mon Jan 28 22:01:48 2013 +0100

    Reorganized settings in logical sections, and trimmed comments.

commit d37ffdfcb24b7e0ec7cc113d07190f65fb12fb8a
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Mon Jan 28 16:54:11 2013 +0100

    Avoided misleading TEMPLATE_DEBUG = DEBUG.

    According to the docs TEMPLATE_DEBUG works only when DEBUG = True.

commit 15d9478d3a9850e85841e7cf09cf83050371c6bf
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Mon Jan 28 16:46:25 2013 +0100

    Removed STATICFILES_FINDERS/TEMPLATE_LOADERS from default settings file.

    Only developers with special needs ever need to change these settings.

commit 574da0eb5bfb4570883756914b4dbd7e20e1f61e
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Mon Jan 28 16:45:01 2013 +0100

    Removed STATICFILES/TEMPLATES_DIRS from default settings file.

    The current best practice is to put static files and templates in
    applications, for easier testing and deployment.

commit 8cb18dbe56629aa1be74718a07e7cc66b4f9c9f0
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Mon Jan 28 16:24:16 2013 +0100

    Removed settings related to email reporting from default settings file.

    While handy for small scale projects, it isn't exactly a best practice.

commit 8ecbfcb3638058f0c49922540f874a7d802d864f
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Tue Jan 29 18:54:43 2013 +0100

    Documented how to enable the sites framework.

commit 23fc91a6fa67d91ddd9d71b1c3e0dc26bdad9841
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Mon Jan 28 16:28:59 2013 +0100

    Disabled the sites framework by default.

    RequestSite does the job for single-domain websites.

commit c4d82eb8afc0eb8568bf9c4d12644272415e3960
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Tue Jan 29 00:08:33 2013 +0100

    Added a default admin.py to the application template.

    Thanks Ryan D Hiebert for the suggestion.

commit 4071dc771e5c44b1c5ebb9beecefb164ae465e22
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Mon Jan 28 10:59:49 2013 +0100

    Enabled the admin by default.

    Everyone uses the admin.

commit c807a31f8d89e7e7fd97380e3023f7983a8b6fcb
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Mon Jan 28 10:57:05 2013 +0100

    Removed admindocs from default project template.

commit 09e4ce0e652a97da1a9e285046a91c8ad7a9189c
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Mon Jan 28 16:32:52 2013 +0100

    Added links to the settings documentation.

commit 5b8f5eaef364eb790fcde6f9e86f7d266074cca8
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Mon Jan 28 11:06:54 2013 +0100

    Used a significant example for URLconf includes.

commit 908e91d6fcee2a3cb51ca26ecdf12a6a24e69ef8
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Mon Jan 28 16:22:31 2013 +0100

    Moved code comments about WSGI to docs, and rewrote said docs.

commit 50417e51996146f891d08ca8b74dcc736a581932
Author: Aymeric Augustin <aymeric.augustin@m4x.org>
Date:   Mon Jan 28 15:51:50 2013 +0100

    Normalized the default application template.

    Removed the default test that 1 + 1 = 2, because it's been committed
    way too many times, in too many projects.

    Added an import of `render` for views, because the first view will
    often be:

    def home(request):
        return render(request, "mysite/home.html")
2013-02-04 13:21:36 +01:00
Ramiro Morales 21ea58b8cc Enhanced docs and docctrings added in 869c9ba.
Thanks Claude for the suggestion.
2013-02-04 08:55:45 -03:00
Claude Paroz 2edef932ff Revert "Fixed #19724 -- Output error when settings are improperly configured"
This reverts commit 40ca99097f.
Outputting error is not always suitable, for example this shouldn't
happen for the 'startproject' command.
2013-02-04 12:15:22 +01:00
Claude Paroz 40ca99097f Fixed #19724 -- Output error when settings are improperly configured
...during retrieval of available management commands.
Thanks Peter Davis for the report and Julien Phalip for the review.
2013-02-04 11:47:59 +01:00
Ramiro Morales 869c9ba306 Fixed #19730 -- Don't validate importability of settings by using i18n in management commands.
They are handled independently now and the latter can be influenced by
the new BaseCommand.leave_locale_alone internal option.

Thanks chrischambers for the report, Claude, lpiatek, neaf and gabooo for
their work on a patch, originally on refs. #17379.
2013-02-03 23:40:38 -03:00
Ramiro Morales 08dc90bccf Fixed #14305 -- Switched inspectdb to create unmanaged models.
Thanks Ian Kelly for the report and initial patch.
2013-02-02 21:11:32 -03:00
Aymeric Augustin 0412b7d280 Avoided ambiguous output when runserver port is already in use.
Thanks James Pic for the suggestion (PR 88).
2013-02-01 22:25:29 +01:00
Claude Paroz b757e7ae18 Fixed dict randomization issue in inspectdb 2013-01-31 22:21:24 +01:00
Claude Paroz 7bbd17bf20 Fixed #19341 -- Detected NullBooleanField when introspecting models
Thanks Tim Bowden for the report.
2013-01-31 20:55:00 +01:00
Claude Paroz eb03fe1642 Added introspection tests for most of Django model fields 2013-01-31 20:41:57 +01:00
Claude Paroz fc8efc2d9e Fixed #19034 -- Added proper i18n pluralization for max/min length validation messages
This was made possible by commit 3f1a0c0040. Thanks Evil Clay
for the report and Alexey Boriskin his work on the ticket.
2013-01-30 21:44:14 +01:00
Aymeric Augustin c47fa3b481 Fixed #19676 -- Supported 'self' foreign keys in inspectdb.
Thanks Georgy Kutsurua for the report and Simon Charette for the patch.
2013-01-28 10:21:07 +01:00
Aymeric Augustin 424eb67867 Fixed validation of email addresses when the local part contains an @.
See also BaseUserManager.normalize_email -- it uses rsplit.

Refs #4833.
2013-01-26 12:20:57 +01:00
Ramiro Morales ce27fb198d Revert "Patch by Claude for #16084."
This reverts commit 2babab0bb3.
2013-01-25 13:58:37 -03:00
Ramiro Morales 2babab0bb3 Patch by Claude for #16084. 2013-01-25 13:23:33 -03:00
Claude Paroz b9c8bbf372 Fixed #19665 -- Ensured proper stderr output for Command.run_from_argv
Thanks Stefan Koegl for the report and Simon Charette for the review.
2013-01-25 14:56:41 +01:00
Ramiro Morales 1f6b2e7a65 Fixed #6682 -- Made shell's REPL actually execute $PYTHONSTARTUP and `~/.pythonrc.py`.
Also:

* Added a ``--no-startup`` option to disable this behavior. Previous
  logic to try to execute the code in charge of this funcionality was
  flawed (it only tried to do so if the user asked for ipython/bpython
  and they weren't found)
* Expand ``~`` in PYTHONSTARTUP value.

Thanks hekevintran at gmail dot com  for the report and initial patch.

Refs #3381.
2013-01-24 22:01:47 -03:00
Claude Paroz 9893fa12b7 Fixed #19125 -- The startproject command should validate the name earlier
Thanks Łukasz Rekucki for the report and the patch.
2013-01-24 09:26:13 +01:00
Ramiro Morales 37718eb50b Fix in makemessages refactoring plus UI tweaks. 2013-01-19 12:58:33 -03:00
Claude Paroz 755f215590 Refactored makemessages command 2013-01-19 12:05:06 +01:00
Anssi Kääriäinen 3647c0a49a Avoided unnecessary recreation of RelatedObjects
Refs #19399. Thanks to Track alias KJ for the patch.
2013-01-18 07:09:39 +02:00
Craig Blaszczyk 6158c79dbe Made (make|compile)messages commands accept multiple locales at once.
Thanks Craig Blaszczyk for the initial patch. Refs #17181.
2013-01-17 00:53:17 -03:00
Ramiro Morales 248aee1606 Modified makemessages so it creates .pot files once per invocation.
It creates a `locale/django.pot` file once instead of one
`locale/<locale_code>/django.pot` file for every locale involved.

Thanks Michal Čihař for the report and patch.
2013-01-16 20:48:06 -03:00
Ramiro Morales eee865257a Fixed #17008 -- Added makemessages option to not remove .pot files.
Thanks airstrike for the report and initial patch, Julien for an
enhanced patch and Jannis for reviewing.
2013-01-16 20:29:06 -03:00
Claude Paroz 4e2e8f39d1 Fixed #4833 -- Validate email addresses with localhost as domain 2013-01-11 20:45:46 +01:00
Claude Paroz a843539af2 Fixed #12914 -- Use yaml faster C implementation when available
Thanks Beuc for the report and the initial patch.
2013-01-05 18:04:00 +01:00
Claude Paroz 850630b4b7 Replaced deprecated sslerror by ssl.SSLError
The exact conditions on which this exception is raised are not
known, but this replacement is the best guess we can do at this
point.
2013-01-03 22:16:43 +01:00
Claude Paroz ffa50ca352 Fixed #19382 -- Stopped smtp backend raising exception when already closed
Thanks Sebastian Noack for the report and the initial patch.
2013-01-03 20:41:45 +01:00
Claude Paroz 1b3f832ab7 Fixed #19134 -- Allowed closing smtp backend when the server is stopped
Thanks Sebastian Noack for the report and the initial patch.
2013-01-03 18:49:00 +01:00
Florian Apolloner 7cb0cd5aff Replaced six.reraise with a simple raise. 2013-01-01 13:20:36 +01:00
Florian Apolloner a4a4b139cd Replaced e.message with e.args[0] in 3aa4b8165d. 2013-01-01 13:14:55 +01:00
Anton Baklanov 3aa4b8165d Fixed #19457 -- ImageField size detection failed for some files.
This was caused by PIL raising a zlib truncated stream error since we fed
the parser with chunks instead of the whole image.
2013-01-01 11:54:56 +01:00
Ramiro Morales 3570ff734e Fixed #17078 -- Made shell use std IPython startup.
This allows for a behavior more in line with what is expected by Ipython
users, e.g. the user namespace is initialized from config files, startup
files.

Thanks Benjamin Ragan-Kelley from the IPython dev team for the patch.
2012-12-31 19:40:02 -03:00
Aymeric Augustin acc5396e6d Fixed #19519 -- Fired request_finished in the WSGI iterable's close(). 2012-12-31 12:47:34 +01:00
Aymeric Augustin a53c474026 Fixed #16241 -- Ensured the WSGI iterable's close() is always called.
Thanks Graham Dumpleton for the report.
2012-12-31 12:45:20 +01:00
Aymeric Augustin ef017a5f00 Advanced pending deprecation warnings.
Also added stacklevel argument, fixed #18127.
2012-12-29 21:59:07 +01:00
Aymeric Augustin d1c72d9e01 Removed django.core.management.setup_environ and execute_manager. 2012-12-29 21:59:07 +01:00
Aymeric Augustin 59351247bd Removed django.core.cache.backends.memcached.CacheClass. 2012-12-29 21:59:07 +01:00
Aymeric Augustin 1e4a27d087 Fixed #19468 -- Decoded request.path correctly on Python 3.
Thanks aliva for the report and claudep for the feedback.
2012-12-22 13:32:39 +01:00
Aymeric Augustin be9f2919e0 Edited the middleware doc for completeness, clarity, and consistency. 2012-12-09 22:30:01 +01:00
Claude Paroz c91667338a Fixed #19357 -- Allow non-ASCII chars in filesystem paths
Thanks kujiu for the report and Aymeric Augustin for the review.
2012-12-08 11:13:52 +01:00
Claude Paroz 34dcf51e06 Fixed #19367 -- Fixed saving ContentFile in filesystem storage
This was not working properly when ContentFile was initialized with
an unicode string.
Thanks Alexey Boriskin for the report and the test.
2012-12-06 17:14:44 +01:00
Claude Paroz 5fa5621f57 Fixed #19416 -- Fixed multi-line commands in initial SQL files
Thanks Aymeric Augustin for detecting this regression.
2012-12-03 20:47:08 +01:00
Aymeric Augustin baae4b8187 Fixed #19397 -- Crash on binary files in project templates.
Thanks gw 2012 at tnode com for the report.
2012-12-03 10:45:18 +01:00
Russell Keith-Magee f2d8004967 Removed some stray debug lines introduced accidentally in c8985a8. 2012-11-24 15:26:36 +08:00
Russell Keith-Magee c8985a8a73 Fixed #19806 -- Ensure that content types and permissions aren't created for swapped models.
Thanks to rizumu for the report.
2012-11-24 13:43:20 +08:00