p31829507
/
django
mirror of https://github.com/django/django.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
29,339 Commits 28 Branches 411 Tags 641 MiB
Commit Graph

220 Commits

Author SHA1 Message Date
Carlton Gibson 66cc97c6b3 [3.2.x] Added stub release notes for Django 3.2.5. 
Backport of ba10772bf6 from main
 2021-06-02 11:26:00 +02:00
Carlton Gibson 4ba4c07e4e [3.2.x] Added stub release notes and date for Django 3.2.4, 3.1.12, and 2.2.24. 
Backport of b46dbd4e3e from main
 2021-05-26 10:17:27 +02:00
Mariusz Felisiak 1037825eed [3.2.x] Added stub release notes for Django 3.2.4. 
Backport of 820408d842 from main
 2021-05-13 09:45:39 +02:00
Mariusz Felisiak 224b8e5a5a [3.2.x] Fixed #32718 -- Relaxed file name validation in FileField. 
- Validate filename returned by FileField.upload_to() not a filename
  passed to the FileField.generate_filename() (upload_to() may
  completely ignored passed filename).
- Allow relative paths (without dot segments) in the generated filename.

Thanks to Jakub Kleň for the report and review.
Thanks to all folks for checking this patch on existing projects.
Thanks Florian Apolloner and Markus Holtermann for the discussion and
implementation idea.

Regression in 0b79eb3691.
Backport of b55699968f from main
 2021-05-13 08:55:00 +02:00
Mariusz Felisiak 8afb677ce7 [3.2.x] Added stub release notes for Django 3.2.3. 
Backport of 29779075d7 from main
 2021-05-06 10:11:32 +02:00
Mariusz Felisiak 2d2c1d0c97 [3.2.x] Fixed #32713, Fixed CVE-2021-32052 -- Prevented newlines and tabs from being accepted in URLValidator on Python 3.9.5+. 
In Python 3.9.5+ urllib.parse() automatically removes ASCII newlines
and tabs from URLs [1, 2]. Unfortunately it created an issue in
the URLValidator. URLValidator uses urllib.urlsplit() and
urllib.urlunsplit() for creating a URL variant with Punycode which no
longer contains newlines and tabs in Python 3.9.5+. As a consequence,
the regular expression matched the URL (without unsafe characters) and
the source value (with unsafe characters) was considered valid.

[1] https://bugs.python.org/issue43882 and
[2] 76cd81d603

Backport of e1e81aa1c4 from main.
 2021-05-06 08:48:22 +02:00
Carlton Gibson 04d8ed3660 [3.2.x] Added stub release notes for Django 3.2.2. 
Backport of 5a43cfe245 from main
 2021-05-04 11:02:11 +02:00
Florian Apolloner c98f446c18 [3.2.x] Fixed CVE-2021-31542 -- Tightened path & file name sanitation in file uploads. 2021-05-04 08:43:52 +02:00
Carlton Gibson 2e8ff5f902 [3.2.x] Added stub release notes for Django 3.2.1. 
Backport of df0a9e6d5c from main
 2021-04-06 11:50:23 +02:00
Mariusz Felisiak 2820fd1be5 [3.2.x] Fixed CVE-2021-28658 -- Fixed potential directory-traversal via uploaded files. 
Thanks Claude Paroz for the initial patch.
Thanks Dennis Brinkrolf for the report.

Backport of d4d800ca1a from main.
 2021-04-06 08:24:01 +02:00
Mariusz Felisiak 904a889ccc [3.2.x] Added stub release notes for 3.1.8. 
Backport of e0f82d7992 from master
 2021-02-25 20:49:18 +01:00
Nick Pope be8237c7cc [3.2.x] Fixed CVE-2021-23336 -- Fixed web cache poisoning via django.utils.http.parse_qsl(). 2021-02-19 09:15:09 +01:00
Mariusz Felisiak b62e767b88 [3.2.x] Added stub release notes for 3.1.7. 
Backport of 8d3c3a5717 from master
 2021-02-01 10:55:07 +01:00
Mariusz Felisiak f944f79e55 [3.2.x] Fixed CVE-2021-3281 -- Fixed potential directory-traversal via archive.extract(). 
Thanks Florian Apolloner, Shai Berger, and Simon Charette for reviews.

Thanks Wang Baohua for the report.

Backport of 05413afa8c from master.
 2021-02-01 09:13:37 +01:00
Carlton Gibson 966ed414b2 Added stub release notes for 3.1.6. 2021-01-04 08:58:03 +01:00
Mariusz Felisiak adb40d217e Added stub release notes for 3.1.5. 2020-12-01 07:12:49 +01:00
Carlton Gibson c8785b473f Added stub release notes for 3.1.4. 2020-11-02 09:20:53 +01:00
Mariusz Felisiak e18156b6c3
Refs #31040 -- Doc'd Python 3.9 compatibility. 2020-10-13 08:35:01 +02:00
Mariusz Felisiak 85fa24e3eb Added stub release notes for 3.1.3. 2020-10-01 07:52:45 +02:00
Carlton Gibson 7a60670b78 Added stub release notes for 3.1.2. 2020-09-01 10:45:12 +02:00
Mariusz Felisiak 8a5683b6b2 Added stub release notes for 2.2.16 and 3.0.10. 2020-08-11 10:31:44 +02:00
Mariusz Felisiak 6c19230297 Added stub release notes for 3.1.1. 2020-08-04 10:34:38 +02:00
Mariusz Felisiak 240cbb63bf
Fixed #31790 -- Fixed setting SameSite and Secure cookies flags in HttpResponse.delete_cookie(). 
Cookies with the "SameSite" flag set to None and without the "secure"
flag will be soon rejected by latest browser versions.

This affects sessions and messages cookies.
 2020-07-16 08:16:58 +02:00
Mariusz Felisiak c2a835703f Added stub release notes for 3.0.9. 2020-07-01 07:00:43 +02:00
Mariusz Felisiak 926148ef01
Fixed #31654 -- Fixed cache key validation messages. 2020-06-05 07:21:52 +02:00
Carlton Gibson 7ec2658e1e Added stub release notes for 3.0.8. 2020-06-03 10:54:29 +02:00
Mariusz Felisiak 50798d4389 Added stub release notes for 2.2.13. 2020-05-14 06:22:54 +02:00
Mariusz Felisiak 3b94f12462 Added stub release notes for 3.2. 2020-05-13 09:07:51 +02:00
Mariusz Felisiak 8e8ff38cb8 Added stub release notes for 3.0.7. 2020-05-04 07:38:35 +02:00
Carlton Gibson a7e4ff370c Added stub release notes for 3.0.6. 2020-04-01 10:09:43 +02:00
Carlton Gibson a4200e958d Added stub release notes for 2.2.12. 2020-03-10 12:01:01 +01:00
Mariusz Felisiak 1b3a900a69 Added stub release notes for 3.0.5. 2020-03-04 10:56:07 +01:00
Mariusz Felisiak 6695d29b1c Fixed CVE-2020-9402 -- Properly escaped tolerance parameter in GIS functions and aggregates on Oracle. 
Thanks to Norbert Szetei for the report.
 2020-03-04 09:04:50 +01:00
Mariusz Felisiak 7e8339748c Added stub release notes for 2.2.11. 2020-02-10 08:18:58 +01:00
Carlton Gibson 273918c25b Added stub release notes for 3.0.4. 2020-02-03 10:23:54 +01:00
Simon Charette eb31d84532 Fixed CVE-2020-7471 -- Properly escaped StringAgg(delimiter) parameter. 2020-02-03 08:49:13 +01:00
Mariusz Felisiak 69331bb851 Added stub release notes for 3.0.3. 2020-01-02 08:36:08 +01:00
Mariusz Felisiak 50a69efb2e Added stub release notes for 3.0.2. 2019-12-18 10:51:57 +01:00
Mariusz Felisiak ec12c37384
Refs #31073 -- Added release notes for 02eff7ef60. 2019-12-11 10:07:41 +01:00
Mariusz Felisiak 908c67e719 Added stub release notes for 3.0.1. 2019-12-02 21:43:59 +01:00
Mariusz Felisiak e9def97d10 Added stub release notes for 2.1.15. 2019-11-19 12:33:39 +01:00
Mariusz Felisiak 30359496a3 Added stub release notes for 2.2.8 release. 2019-11-12 14:37:59 +01:00
Mariusz Felisiak 84322a29ce Added stub release notes for 1.11.26 and 2.1.14. 2019-10-02 07:49:47 +02:00
Carlton Gibson e1c1eaf0c6 Added stub release notes for 2.2.7. 2019-10-01 10:43:30 +02:00
Mariusz Felisiak bd7e0f81f8 Added stub release notes for 1.11.25 and 2.1.13. 2019-09-16 07:37:47 +02:00
Mariusz Felisiak 32796826bb Added stub release notes for 3.1. 2019-09-10 12:00:56 +02:00
Mariusz Felisiak 0d4529d314 Added stub release notes for 2.2.6. 2019-09-04 08:02:32 +02:00
Mariusz Felisiak 1f8382d34d
Fixed #30672 -- Fixed crash of JSONField/HStoreField key transforms on expressions with params. 
Regression in 4f5b58f5cd.

Thanks Florian Apolloner for the report and helping with tests.
 2019-08-14 15:25:35 +02:00
Mariusz Felisiak 1af469e67f Added stub release notes for 2.2.5. 2019-08-02 20:32:21 +02:00
Carlton Gibson f13147c8de Added stub release notes for security releases. 2019-07-25 10:49:30 +02:00