Commit Graph

6301 Commits

Author SHA1 Message Date
Tim Graham baf2542c4f Fixed DoS possibility in ModelMultipleChoiceField.
This is a security fix. Disclosure following shortly.

Thanks Keryn Knight for the report and initial patch.
2015-01-13 13:03:06 -05:00
Tim Graham a3bebfdc34 Ensured views.static.serve() doesn't use large memory on large files.
This issue was fixed in master by refs #24072.
2015-01-13 13:03:06 -05:00
Tim Graham 69b5e66738 Fixed is_safe_url() to handle leading whitespace.
This is a security fix. Disclosure following shortly.
2015-01-13 13:03:06 -05:00
Carl Meyer 316b8d4974 Stripped headers containing underscores to prevent spoofing in WSGI environ.
This is a security fix. Disclosure following shortly.

Thanks to Jedediah Smith for the report.
2015-01-13 13:03:05 -05:00
Michał Modzelewski 65246de7b1 Fixed #24031 -- Added CASE expressions to the ORM. 2015-01-12 18:15:34 -05:00
Josh Smeaton 21b858cb67 Fixed #24060 -- Added OrderBy Expressions 2015-01-13 09:39:55 +11:00
Claude Paroz f48e2258a9 Fixed #24133 -- Replaced formatting syntax in success_url placeholders
Thanks Laurent Payot for the report, and Markus Holtermann, Tim Graham
for the reviews.
2015-01-12 22:51:22 +01:00
Aymeric Augustin 5f7230e12f Fixed #24124 (again) -- Updated tests with new default context_processors.
Thanks Collin for the review.
2015-01-12 22:31:44 +01:00
Aymeric Augustin 6b5113ec94 Made debug views not crash when there isn't a default template engine. 2015-01-12 21:01:34 +01:00
Aymeric Augustin 79deb6a071 Accounted for multiple template engines in template responses. 2015-01-12 21:01:34 +01:00
Aymeric Augustin a3e783fe11 Deprecated passing a Context to a generic Template.render.
A deprecation path is required because the return type of
django.template.loader.get_template changed during the
multiple template engines refactor.

test_csrf_token_in_404 was incorrect: it tested the case when the
hardcoded template was rendered, and that template doesn't depend on the
CSRF token. This commit makes it test the case when a custom template is
rendered.
2015-01-12 21:01:34 +01:00
Aymeric Augustin 71b7668b75 Rewrapped TemplateSyntaxError in Jinja2 backend.
Changed import style to avoid confusion between Django's and Jinja2's
APIs.
2015-01-12 21:01:34 +01:00
Claude Paroz 4c413e231c Fixed #17785 -- Preferred column names in get_relations introspection
Thanks Thomas Güttler for the report and the initial patch, and
Tim Graham for the review.
2015-01-12 19:58:47 +01:00
Muthiah Annamalai b75c707943 Fixed #24089 -- Added check for when ModelAdmin.fieldsets[1]['fields'] isn't a list/tuple. 2015-01-12 13:47:58 -05:00
Markus Holtermann eeb88123e7 Fixed #24129 -- Added indicator that migrations are rendering the initial state
Thanks Tim Graham for the review.
2015-01-12 19:23:46 +01:00
Tim Graham 9f51d0c86d Fixed test from refs #23913 when running tests in reverse. 2015-01-12 13:20:44 -05:00
Markus Holtermann bbbed99f62 Fixed #24123 -- Used all available migrations to generate the initial migration state
Thanks Collin Anderson for the input when creating the patch and Tim Graham for the review.
2015-01-12 18:39:18 +01:00
Pavel Shpilev a7c256cb54 Fixed #9893 -- Allowed using a field's max_length in the Storage. 2015-01-12 09:09:18 -05:00
Marc Tamlyn b5c1a85b50 Fixed #24118 -- Added --debug-sql option for tests.
Added a --debug-sql option for tests and runtests.py which outputs the
SQL logger for failing tests. When combined with --verbosity=2, it also
outputs the SQL for passing tests.

Thanks to Berker, Tim, Markus, Shai, Josh and Anssi for review and
discussion.
2015-01-12 08:16:08 +00:00
Claude Paroz 68a439a18d Removed supports_binary_field flag as all backends support them
It was mainly for MySQL on Python 3, but now the current
recommended MySQL driver for Python 3 (mysqlclient) does support
binary fields, it is unneeded. Refs #20377.
2015-01-11 23:34:47 +01:00
Ola Sitarska d563e3be68 Fixed #23913 -- Deprecated the `=` comparison in `if` template tag. 2015-01-11 15:21:01 -05:00
Claude Paroz 412066e71e Revert "Marked a test as an expected failure on MySQL and Python 3.2."
This reverts commit 832b4a5722.
We officially don't support MySQL on Python 3.2. Refs #20380.
2015-01-11 20:59:07 +01:00
Markus Holtermann fdc2cc9487 Fixed #24110 -- Rewrote migration unapply to preserve intermediate states 2015-01-10 23:14:15 +01:00
Simon Charette 07988744b3 Fixed #13165 -- Added edit and delete links to admin foreign key widgets.
Thanks to Collin Anderson for the review and suggestions and Tim for the
final review.
2015-01-10 12:24:52 -05:00
Marc Tamlyn 48ad288679 Fixed #24001 -- Added range fields for PostgreSQL.
Added support for PostgreSQL range types to contrib.postgres.

- 5 new model fields
- 4 new form fields
- New validators
- Uses psycopg2's range type implementation in python
2015-01-10 16:18:19 +00:00
Claude Paroz 7289d01973 Introspected alternate SQLite FK definitions 2015-01-10 16:51:14 +01:00
Claude Paroz ffca9b49d4 Updated introspection test to use skipUnlessDBFeature 2015-01-10 15:42:31 +01:00
Claude Paroz d7bc37d611 Fixed #24097 -- Prevented AttributeError in redirect_to_login
Thanks Peter Schmidt for the report and the initial patch.
Thanks to ​Oktay Sancak for writing the original failing test and
Alvin Savoy for supporting contributing back to the community.
2015-01-10 10:05:02 +01:00
Loic Bistuer 8f4877c89d Fixed #22583 -- Allowed RunPython and RunSQL to provide hints to the db router.
Thanks Markus Holtermann and Tim Graham for the review.
2015-01-10 00:30:48 +07:00
Preston Timmons 665e0aa6ec Fixed #24094 -- Enabled template tests to run individually. 2015-01-09 11:43:59 -05:00
Markus Holtermann c8bac4b556 Fixed #24098 -- Added no-op attributes to RunPython and RunSQL
Thanks Loïc Bistuer and Tim Graham for the discussion and review.
2015-01-09 10:31:32 -05:00
Anssi Kääriäinen 0c7633178f Fixed #24020 -- Refactored SQL compiler to use expressions
Refactored compiler SELECT, GROUP BY and ORDER BY generation.
While there, also refactored select_related() implementation
(get_cached_row() and get_klass_info() are now gone!).

Made get_db_converters() method work on expressions instead of
internal_type. This allows the backend converters to target
specific expressions if need be.

Added query.context, this can be used to set per-query state.

Also changed the signature of database converters. They now accept
context as an argument.
2015-01-08 14:07:54 -05:00
Tim Graham b8abfe141b Fixed #24101 -- Fixed flaky admin_views selenium tests; refs #7361. 2015-01-08 13:17:00 -05:00
Tim Graham 5c43fd4825 Isolated some cache tests; refs #23947.
This reverts a change made in 40c60efecc
which was incorrect and caused CacheKeyWarnings.
2015-01-08 13:14:45 -05:00
Claude Paroz 543df07720 Fixed #24073 -- Returned None for get_language when translations are deactivated
This fixes a regression caused by f7c287fca9. Thanks Markus Holtermann
for identifying the regression.
2015-01-08 17:43:07 +01:00
Tim Graham ade9859996 Fixed #24095 -- Prevented WarningLoggerTests from leaking a warnings filter. 2015-01-08 08:49:54 -05:00
Markus Holtermann 862ea825b5 Fixed #24093 -- Prevented MigrationWriter to write operation kwargs that are not explicitly deconstructed 2015-01-07 17:29:20 -07:00
Tim Graham f487a3275e Avoided a deprecated alias on Python 3 in file_uploads test. 2015-01-07 19:12:37 -05:00
Josh Smeaton 8713ea7568 Fixed null handling in Value expression 2015-01-07 19:07:49 -05:00
Markus Holtermann 1f03d2d924 Refs #23822 -- Made MigrationOptimizer aware of model managers 2015-01-07 17:33:04 -05:00
Aymeric Augustin 127f9e073d Restored support for multiple template names in render(_to_response).
This possibility was documented but not tested.

It had been broken during the multiple template engines refactor.
2015-01-07 21:54:22 +01:00
Aymeric Augustin eaa1a22341 Added a request argument to render_to_string.
This is for consistency with Template.render.

It adds a little bit of knowledge about HTTP requests in
django.template.loader but I think consistency trumps purity.
2015-01-07 21:54:22 +01:00
Claude Paroz f7c287fca9 Fixed #24073 -- Deactivated translations when leave_locale_alone is False
Thanks Tim Graham and Markus Holtermann for the reviews.
2015-01-07 20:11:24 +01:00
Michał Modzelewski ee86e59051 Refs #2443 -- Allowed creation of objects with NULL DurationFields 2015-01-07 08:33:26 -05:00
Josh Smeaton 5a4ac4ead9 Fixed #24078 -- Removed empty strings from GenericIPAddressField 2015-01-07 08:08:36 -05:00
Daniel Pyrathon fb48eb0581 Fixed #12663 -- Formalized the Model._meta API for retrieving fields.
Thanks to Russell Keith-Magee for mentoring this Google Summer of
Code 2014 project and everyone else who helped with the patch!
2015-01-06 19:25:12 -05:00
Tim Graham 749d23251b Removed warning handling that should have been removed in refs #23891. 2015-01-06 18:33:55 -05:00
Aymeric Augustin 0cdb09d489 Made context take priority over context processors.
This is the expected behavior, but given RequestContext's tortuous
implementation, a straightforward use of its API results in the
opposite.

This commits fixes a regression that must have happened at different
points in the multiple templates engine refactor for different features.
2015-01-06 22:02:27 +01:00
Danilo Bargen 2e65d56156 Fixed #20003 -- Improved and extended URLValidator
This adds support for authentication data (`user:password`) in URLs,
IPv6 addresses, and unicode domains.

The test suite has been improved by adding test URLs from
http://mathiasbynens.be/demo/url-regex (with a few adjustments,
like allowing local and reserved IPs).

The previous URL validation regex failed this test suite on 13
occasions, the validator was updated based on
https://gist.github.com/dperini/729294.
2015-01-06 14:04:25 -05:00
Claude Paroz 011f21b4fa Used None-related assertions in CSRF tests
Thanks Markus Holtermann for spotting this.
2015-01-06 08:48:01 +01:00