django1/django/contrib
Aymeric Augustin 7f6fbc906a Prevented static file corruption when URL fragment contains '..'.
When running collectstatic with a hashing static file storage backend,
URLs referencing other files were normalized with posixpath.normpath.
This could corrupt URLs: for example 'a.css#b/../c' became just 'c'.

Normalization seems to be an artifact of the historical implementation.
It contained a home-grown implementation of posixpath.join which relied
on counting occurrences of .. and /, so multiple / had to be collapsed.

The new implementation introduced in the previous commit doesn't suffer
from this issue. So it seems safe to remove the normalization.

There was a test for this normalization behavior but I don't think it's
a good test. Django shouldn't modify CSS that way. If a developer has
rendundant /s, it's mostly an aesthetic issue and it isn't Django's job
to fix it. Conversely, if the user wants a series of /s, perhaps in the
URL fragment, Django shouldn't destroy it.

Refs #26249.
2016-02-23 19:35:16 +01:00
..
admin Fixed #25653 -- Made --selenium run only the selenium tests. 2016-02-19 14:21:00 -05:00
admindocs Fixed #26013 -- Moved django.core.urlresolvers to django.urls. 2015-12-31 14:21:29 -05:00
auth Fixed #25304 -- Allowed management commands to check if migrations are applied. 2016-02-12 13:34:56 -05:00
contenttypes Removed unneeded hint=None/obj=None in system check messages. 2016-02-12 13:01:25 -05:00
flatpages Fixed #26176 -- Fixed E123 flake8 warnings. 2016-02-05 15:11:07 -05:00
gis Refs #26112 -- Fixed aggregate GIS test on Oracle. 2016-02-09 10:04:54 -05:00
humanize Updated translations from Transifex 2015-12-31 15:53:02 +01:00
messages Used getattr() to simplify contrib.messages.api. 2015-09-26 20:04:09 -04:00
postgres Fixed #26215 -- Fixed RangeField/ArrayField serialization with None values 2016-02-16 21:07:05 +01:00
redirects Updated translations from Transifex 2015-12-31 15:53:02 +01:00
sessions Removed British/Austrialian word: whilist. 2015-12-31 14:29:52 -05:00
sitemaps Fixed #25989 -- Corrected sitemap's Last-Modified header to use the latest lastmod of all sitemaps. 2016-01-23 08:48:31 -05:00
sites Removed unneeded hint=None/obj=None in system check messages. 2016-02-12 13:01:25 -05:00
staticfiles Prevented static file corruption when URL fragment contains '..'. 2016-02-23 19:35:16 +01:00
syndication Fixed #25806 -- Removed name mangling from syndication.Feed's _get_dynamic_attr(). 2015-11-25 17:46:58 -05:00
__init__.py