Commit Graph

3792 Commits

Author SHA1 Message Date
Mariusz Felisiak 6695d29b1c Fixed CVE-2020-9402 -- Properly escaped tolerance parameter in GIS functions and aggregates on Oracle.
Thanks to Norbert Szetei for the report.
2020-03-04 09:04:50 +01:00
Hannes Ljungberg 65ab4f9f03 Fixed #31147 -- Added SearchHeadline to django.contrib.postgres. 2020-03-03 15:39:52 +01:00
Mariusz Felisiak 7b8fa1653f Fixed #31150 -- Included subqueries that reference related fields in GROUP BY clauses.
Thanks Johannes Hoppe for the report.

Regression in fb3f034f1c.

Co-authored-by: Simon Charette <charette.s@gmail.com>
2020-03-03 11:25:37 +01:00
Claude Paroz d4fff711d4 Fixed #31274 -- Used signing infrastructure in SessionBase.encode()/decode().
Thanks Mariusz Felisiak and Florian Apolloner for the reviews.
2020-03-02 12:16:48 +01:00
Carlton Gibson 8b30360322
Fixed #31032 -- Updated admin browser support FAQ for 2020.
Following web standards, the modern _evergreen_ browsers are all
supported. This applies equally to mobile platforms. Assuming current
trends continue, this should be a sustainable policy.

Microsoft deprecated all versions of Internet Explorer. IE 11, the last
version, is described as a "compatibility solution" rather than a web
browser. Whilst it will receive security updates for the lifetime of
Windows 10 it's use is actively discouraged.

The IE 11 downloads page makes it clear: "We recommend you use the new
Microsoft Edge".
2020-02-28 12:39:14 +01:00
Simon Charette 41ebe60728 Fixed #31312 -- Properly ordered temporal subtraction params on MySQL.
Regression in 9bcbcd599a.

Thanks rick2ricks for the report.
2020-02-27 08:50:55 +01:00
Adam Johnson a6b3938afc
Fixed #31182 -- Adjusted release notes for ASGI support. 2020-02-20 15:05:47 +01:00
Claude Paroz 4d973f5939 Refs #26601 -- Deprecated passing None as get_response arg to middleware classes.
This is the new contract since middleware refactoring in Django 1.10.

Co-authored-by: Carlton Gibson <carlton.gibson@noumenal.es>
Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2020-02-18 20:03:44 +01:00
Mariusz Felisiak 2a038521c4
Fixed #31271 -- Preserved ordering when unifying query parameters on Oracle.
This caused misplacing parameters in logged SQL queries.

Regression in 79065b55a7.

Thanks Hans Aarne Liblik for the report.
2020-02-18 11:45:12 +01:00
Keshav Kumar f37d548ede Fixed #20995 -- Added support for iterables of template names to {% include %} template tag.
Thanks Adam Johnson for the review.
2020-02-18 06:56:05 +01:00
Claude Paroz da4923ea87 Refs #27468 -- Made PasswordResetTokenGenerator use SHA-256 algorithm. 2020-02-12 21:46:56 +01:00
Abhijeet Viswa 1712a76b9d Fixed #31246 -- Fixed locking models in QuerySet.select_for_update(of=()) for related fields and parent link fields with multi-table inheritance.
Partly regression in 0107e3d105.
2020-02-11 20:43:57 +01:00
Florian Apolloner 41a3b3d186 Fixed #31240 -- Properly closed FileResponse when wsgi.file_wrapper is used.
Thanks to Oskar Persson for the report.
2020-02-11 20:39:12 +01:00
Jon Dufresne e3f6e18513 Fixed #31253 -- Fixed data loss possibility when using caching from async code.
Case missed in a415ce70be.
2020-02-11 09:09:25 +01:00
Mariusz Felisiak 7e8339748c Added stub release notes for 2.2.11. 2020-02-10 08:18:58 +01:00
Mariusz Felisiak 932bd794b2 Added "Bugfixes" section to release notes for 3.0.4. 2020-02-10 08:14:58 +01:00
Simon Charette 430e796980 Refs #31055 -- Made DiscoverRunner skip running system checks on unused test databases. 2020-02-07 11:01:31 +01:00
Simon Charette 0b83c8cc4d Refs #31055 -- Added --database option to the check management command.
This avoids enabling the ``database`` checks unless they are explicitly
requested and allows to disable on a per-alias basis which is required
when only creating a subset of the test databases.

This also removes unnecessary BaseCommand._run_checks() hook.
2020-02-07 11:01:31 +01:00
Jon Dufresne f48f671223 Refs #31233 -- Changed DatabaseWrapper._nodb_connection to _nodb_cursor().
It is now a method instead of a property and returns a context manager
that yields a cursor on entry and closes the cursor and connection upon
exit.
2020-02-06 15:29:38 +01:00
Adam Johnson 72b97a5b1e Fixed #31232 -- Changed default SECURE_REFERRER_POLICY to 'same-origin'. 2020-02-05 14:39:01 +01:00
Adam Johnson de1924e0e7
Improved grammar in 3.0 release notes for SECURE_CONTENT_TYPE_NOSNIFF change. 2020-02-05 12:46:14 +01:00
Adam Johnson 469bf2db15 Fixed #31210 -- Doc'd how to reproduce HttpRequest.is_ajax() in release notes. 2020-02-04 12:21:48 +01:00
Adam Johnson 85cb59cba9 Fixed typo in docs/releases/3.1.txt. 2020-02-04 12:21:45 +01:00
Claude Paroz 8ae84156d6 Fixed #27604 -- Used the cookie signer to sign message cookies.
Co-authored-by: Craig Anderson <craiga@craiga.id.au>
2020-02-04 08:05:02 +01:00
Carlton Gibson 273918c25b Added stub release notes for 3.0.4. 2020-02-03 10:23:54 +01:00
Carlton Gibson d8b2ccbbb8 Added CVE-2020-7471 to security archive. 2020-02-03 10:11:34 +01:00
Carlton Gibson 1a2600d8df Added release date for 3.0.3. 2020-02-03 08:52:16 +01:00
Simon Charette eb31d84532 Fixed CVE-2020-7471 -- Properly escaped StringAgg(delimiter) parameter. 2020-02-03 08:49:13 +01:00
Hasan Ramezani a97111eabf Fixed 31207 -- Prevented references to non-local remote fields in ForeignKey.to_field.
Thanks Simon Charette for the initial patch and review.
2020-01-31 10:19:12 +01:00
Mariusz Felisiak 0ac8ac8b0d
Refs #25778 -- Updated some links to HTTPS and new locations. 2020-01-29 09:34:37 +01:00
Nick Pope c9bf1910e2 Refs #30997 -- Added link to Fetch API in release notes. 2020-01-28 08:37:41 +01:00
Claude Paroz e348ab0d43 Fixed #30997 -- Deprecated HttpRequest.is_ajax(). 2020-01-27 08:54:32 +01:00
Claude Paroz 7fa0fa45c5 Refs #30997 -- Removed HttpRequest.is_ajax() usage. 2020-01-27 08:52:40 +01:00
Claude Paroz d66d72f956 Refs #30997 -- Added HttpRequest.accepts(). 2020-01-24 14:24:59 +01:00
Hasan Ramezani b94764e178 Fixed #27888 -- Added link to clear all filters in the admin changelist view. 2020-01-23 14:14:54 +01:00
Eugene Hatsko 0b013564ef Fixed #31190 -- Fixed prefetch_related() crash for GenericForeignKey with custom ContentType foreign key.
Regression in dffa3e1992.
2020-01-22 07:54:16 +01:00
Pavel Lysak 13e4abf83e Fixed #30752 -- Allowed using ExceptionReporter subclasses in error reports. 2020-01-16 15:25:49 +01:00
Flavio Curella d08d4f464a Fixed #30765 -- Made cache_page decorator take precedence over max-age Cache-Control directive. 2020-01-16 13:39:16 +01:00
Carlton Gibson 29c126bb34 Fixed #31124 -- Fixed setting of get_FOO_display() when overriding inherited choices.
Regression in 2d38eb0ab9
2020-01-15 15:35:22 +01:00
Carlton Gibson 927c903f3c Refs #31097 -- Added release notes for 2f565f84ac.
.
2020-01-14 14:35:28 +01:00
Carlton Gibson 1f4b9f4f1f Removed unused ExceptionReporterFilter class.
Unused since 8f8c54f70b.
2020-01-11 20:18:38 +01:00
Mariusz Felisiak 6f7998adc7
Fixed #31155 -- Fixed a system check for the longest choice when a named group contains only non-string values.
Regression in b6251956b6.

Thanks Murat Guchetl for the report.
2020-01-11 19:47:36 +01:00
Carlton Gibson e2d9d66a22 Fixed #23004 -- Added request.META filtering to SafeExceptionReporterFilter.
Co-authored-by: Ryan Castner <castner.rr@gmail.com>
2020-01-10 11:35:41 +01:00
Carlton Gibson 581ba5a948 Refs #23004 -- Allowed exception reporter filters to customize settings filtering.
Thanks to Tim Graham for the original implementation idea.

Co-authored-by: Daniel Maxson <dmaxson@ccpgames.com>
2020-01-10 11:21:23 +01:00
Adam Johnson 5166097d7c Fixed #31154 -- Added support for using enumeration types in templates.
Enumeration helpers are callables, so the template system tried to call
them with no arguments.

Thanks Rupert Baker for helping discover this.
2020-01-10 07:52:06 +01:00
Jack Cushman eb629f4c02 Fixed #30995 -- Allowed converter.to_url() to raise ValueError to indicate no match. 2020-01-09 14:41:41 +01:00
Shubham singh ffcf1a8ebf Fixed #31118 -- Made FileInput to avoid the required attribute when initial data exists. 2020-01-08 09:15:31 +01:00
Mariusz Felisiak 53d8646f79
Fixed #31141 -- Relaxed system check of translation settings for sublanguages.
Regression in 4400d8296d.

Thanks Enrique Matías Sánchez for the report.
2020-01-08 08:05:43 +01:00
Claude Paroz 188b003014 Fixed #15982 -- Added DATE_INPUT_FORMATS to forms.DateTimeField default input formats. 2020-01-07 11:08:40 +01:00
Claude Paroz 1487f16f2d Fixed #11385 -- Made forms.DateTimeField accept ISO 8601 date inputs.
Thanks José Padilla for the initial patch, and Carlton Gibson for the
review.
2020-01-06 10:52:09 +01:00
Mariusz Felisiak 0f843fdd5b
Fixed #31136 -- Disabled grouping by aliases on QuerySet.values()/values_list().
Regression in fb3f034f1c.

Thanks Sigurd Ljødal for the report.
2020-01-04 20:49:11 +01:00
Simon Charette 9bcbcd599a Fixed #31133 -- Fixed crash when subtracting against a subquery annotation.
The subtract_temporals() database operation was not handling expressions
returning SQL params in mixed database types.

Regression in 3543129822.

Thanks Reupen Shah for the report.
2020-01-03 10:35:08 +01:00
Federico Jaramillo Martínez 372eaa395f Fixed #28991 -- Added EmptyFieldListFilter class in admin.filters.
Thanks Simon Charette and Carlton Gibson for reviews.

Co-Authored-By: Jonas Haag <jonas@lophus.org>
Co-Authored-By: Christophe Baldy <christophe.baldy@polyconseil.fr>
2020-01-03 07:58:04 +01:00
Mariusz Felisiak 69331bb851 Added stub release notes for 3.0.3. 2020-01-02 08:36:08 +01:00
Mariusz Felisiak 434a81d320 Added release date for 3.0.2. 2020-01-02 07:55:53 +01:00
Farhaan Bukhsh cf5d4701dc Fixed #30819 -- Fixed year determination in admin calendar widget for two-digit years.
Two-digit years in the range of [00, 68] are in the current century,
while [69,99] are in the previous century, according to the Open Group
Specification.
2019-12-30 13:06:29 +01:00
Simon Charette 9e14bc2135 Refs #29260 -- Doc'd Model.save() behavior change in Django 3.0. 2019-12-30 07:49:10 +01:00
Simon Charette 5779cc938a Fixed #31071 -- Disabled insert optimization for primary keys with defaults when loading fixtures.
Model.save_base() is called directly when loading fixtures and assumes
existing rows will be updated. Branching of "raw" allows to maintain
the optimization introduced in #29260 while supporting this edge case.

Regression in 85458e94e3.

Thanks Reupen Shah for the report.
2019-12-30 07:49:10 +01:00
Mariusz Felisiak 22ce5d0031
Fixed #31106 -- Fixed migrations crash on PostgreSQL 10+ when adding FK constraints inline and changing data.
This allows adding foreign key constraints inline and changing data in
the same migration on PostgreSQL 10+.

Regression in 738faf9da2.

Thanks Janne Rönkkö for the report and Simon Charette for the
implementation idea and review.
2019-12-23 23:28:59 +01:00
Jon Dufresne 67ea35df52 Fixed #30998 -- Added ModelChoiceIteratorValue to pass the model instance to ChoiceWidget.create_option(). 2019-12-23 10:34:50 +01:00
Simon Charette 720de4d044 Fixed #31109 -- Disabled grouping by aliases on QuerySet.exists().
Clearing the SELECT clause in Query.has_results was orphaning GROUP BY
references to it.

Thanks Thierry Bastian for the report and Baptiste Mispelon for the
bisect.

Regression in fb3f034f1c.
2019-12-23 09:24:03 +01:00
Simon Charette 5a4d7285bd Fixed #31094 -- Included columns referenced by subqueries in GROUP BY on aggregations.
Thanks Johannes Hoppe for the report.

Regression in fb3f034f1c.

Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2019-12-19 10:04:56 +01:00
Mike Hansen d291c72bf2 Fixed #30585 -- Added {% translate %} and {% blocktranslate %} template tags. 2019-12-18 13:15:38 +01:00
Mariusz Felisiak 50a69efb2e Added stub release notes for 3.0.2. 2019-12-18 10:51:57 +01:00
Mariusz Felisiak 5a2b9f0b54 Added CVE-2019-19844 to the security archive. 2019-12-18 10:36:22 +01:00
Simon Charette 5b1fbcef7a Fixed CVE-2019-19844 -- Used verified user email for password reset requests.
Co-Authored-By: Florian Apolloner <florian@apolloner.eu>
2019-12-18 09:11:39 +01:00
James Turk ff00a05347 Fixed #31088 -- Added support for websearch searching in SearchQuery. 2019-12-16 14:59:59 +01:00
Rabah Saadi 5b7450080f Added Algerian Arabic language. 2019-12-14 16:26:31 +01:00
Hasan Ramezani 9736137cdc Fixed #31069, Refs #26431 -- Doc'd RegexPattern behavior change in passing optional named groups in Django 3.0. 2019-12-12 14:24:10 +01:00
Osaetin Daniel b33bfc3839 Fixed #30862 -- Allowed setting SameSite cookies flags to 'none'.
Thanks Florian Apolloner and Carlton Gibson for reviews.
2019-12-12 10:52:31 +01:00
Hasan Ramezani 52018e1615 Fixed typos in 3.0 release notes and docs/ref/request-response.txt. 2019-12-12 10:19:09 +01:00
Mariusz Felisiak ec12c37384
Refs #31073 -- Added release notes for 02eff7ef60. 2019-12-11 10:07:41 +01:00
Baptiste Mispelon 9e565386d3 Fixed #27430 -- Added -b/--buffer option to DiscoverRunner. 2019-12-09 13:47:12 +01:00
Ali Mirlou 663bb435de Fixed typo in docs/releases/3.0.1.txt. 2019-12-09 07:57:36 +01:00
Alex Aktsipetrov bf12273db4 Fixed #31060 -- Reallowed window expressions to be used in conditions outside of queryset filters.
Regression in 4edad1ddf6.

Thanks utapyngo for the report.
2019-12-06 13:52:16 +01:00
Jon Dufresne 5708327c37 Fixed #23433 -- Deprecated django-admin.py entry point in favor of django-admin.
Unify on the entry point created by setuptools entry_points feature.
2019-12-06 12:11:44 +01:00
Mariusz Felisiak 82a88d2f48
Fixed #31061 -- Ignored positional args in django.urls.resolve() when all optional named parameters are missing.
Regression in 76b993a117.

Thanks Claude Paroz for the report and Carlton Gibson for reviews.
2019-12-06 09:32:51 +01:00
Hasan Ramezani 5d674eac87 Fixed #31039 -- Added support for contained_by lookup with AutoFields, SmallIntegerField, and DecimalField. 2019-12-05 15:50:39 +01:00
Gordon Pendleton adb9661789 Fixed #31010 -- Allowed subdomains of localhost in the Host header by default when DEBUG=True. 2019-12-05 09:44:45 +01:00
jsals1 1f62c008d1 Fixed typo in docs/releases/3.0.txt. 2019-12-05 07:55:20 +01:00
Aymeric Augustin c06492dd87 Fixed #23524 -- Allowed DATABASES['TIME_ZONE'] option on PostgreSQL. 2019-12-04 18:22:08 +01:00
Aymeric Augustin ad88524e4d Refs #23524 -- Unified BaseDatabaseWrapper.timezone.
There was a special case in this property to return None when the
database backend supports time zone. However, only the PostgreSQL
backend supports time zones and it never uses this property.
2019-12-04 18:07:51 +01:00
Mariusz Felisiak 95ae1a9f8c Fixed #31059 -- Fixed typo in docs/releases/3.0.txt. 2019-12-04 09:22:51 +01:00
Baptiste Mispelon 26cab4e8c1 Fixed #31046 -- Allowed RelatedManager.add()/create()/set() to accept callable values in through_defaults. 2019-12-03 19:47:38 +01:00
Andrew Godwin c90ab30fa1 Fixed #31056 -- Allowed disabling async-unsafe check with an environment variable. 2019-12-03 17:29:31 +01:00
Mariusz Felisiak 908c67e719 Added stub release notes for 3.0.1. 2019-12-02 21:43:59 +01:00
Carlton Gibson 3b347a8a00 Finalized release notes for Django 3.0. 2019-12-02 11:54:32 +01:00
Carlton Gibson 900ea762e5 Added CVE-2019-19118 to the security archive. 2019-12-02 11:42:24 +01:00
Carlton Gibson 368b8d20aa Removed issue reporter name from 2.1.15 and 2.2.8 release notes. 2019-12-02 09:46:25 +01:00
Carlton Gibson e31d185267 Added release dates for 2.1.15, 2.2.8 and 3.0. 2019-12-02 09:10:15 +01:00
Carlton Gibson 11c5e0609b Fixed CVE-2019-19118 -- Required edit permissions on parent model for editable inlines in admin.
Thank you to Shen Ying for reporting this issue.
2019-12-02 08:56:08 +01:00
Mariusz Felisiak 39e39d0ac1 Refs #30953 -- Added 2.1.15 release note for 0107e3d105. 2019-12-02 08:10:39 +01:00
Mariusz Felisiak 0107e3d105
Fixed #30953 -- Made select_for_update() lock queryset's model when using "self" with multi-table inheritance.
Thanks Abhijeet Viswa for the report and initial patch.
2019-12-02 07:57:19 +01:00
Mariusz Felisiak e8fcdaad5c Fixed #31021 -- Fixed proxy model permissions data migration crash with a multiple databases setup.
Regression in 98296f86b3.
2019-11-29 08:23:01 +01:00
Farhaan Bukhsh 1f817daa20 Fixed #30803 -- Allowed comma separators for milliseconds in django.utils.dateparse functions.
Co-Authored-By: Ben Wilber <benwilber@gmail.com>
2019-11-27 09:43:12 +01:00
Farhaan Bukhsh 42b23d1e79 Refs #30803 -- Allowed comma separators for decimal fractions in parse_duration(). 2019-11-27 09:43:12 +01:00
Sergey Fedoseev abc51d44af Used 🎫 role in all tickets links. 2019-11-26 14:02:24 +01:00
Baptiste Mispelon 52936eface Fixed #31031 -- Fixed data loss in admin changelist view when formset's prefix contains regex special chars.
Regression in b18650a263.
2019-11-26 08:48:10 +01:00
Sergey Fedoseev a5855c8f0f Fixed #30996 -- Added AsWKB and AsWKT GIS functions. 2019-11-22 13:40:48 +01:00
Carlton Gibson ee4a19053a Fixed #31012 -- Reverted "Fixed #29056 -- Fixed HTML5 validation of required SelectDateWidget."
This reverts commit f038214d91.

The initial issue was incorrect. Django 2.2, and before, did not
generate invalid HTML as reported. With f03821 in place invalid HTML
was generated.

Thanks to Kevin Brown for follow-up report and investigation.
2019-11-21 20:53:31 +01:00
Simon Charette e9a0e1d4f6 Fixed #30484 -- Added conditional expressions support to CheckConstraint. 2019-11-21 11:56:35 +01:00
Hasan Ramezani f69b32782e Fixed #30625 -- Doc'd cache.get()/delete() behavior change in Django 2.2. 2019-11-21 10:54:05 +01:00
Jon Dufresne f5ebdfce5c Fixed #25388 -- Added an option to allow disabling of migrations during test database creation. 2019-11-20 20:42:38 +01:00
Mariusz Felisiak e9def97d10 Added stub release notes for 2.1.15. 2019-11-19 12:33:39 +01:00
Daniel Izquierdo 89abecc75d Fixed #27272 -- Added an on_delete RESTRICT handler to allow cascading deletions while protecting direct ones. 2019-11-19 10:55:05 +01:00
Caio Ariede 555bebe774 Fixed #30987 -- Added models.PositiveBigIntegerField. 2019-11-19 09:34:11 +01:00
Sergey Fedoseev f95b59a1b3 Fixed #30994 -- Added Oracle support for AsGeoJSON GIS function. 2019-11-18 15:32:44 +01:00
Simon Charette 11e327a3ff Fixed #30988 -- Deprecated the InvalidQuery exception.
It was barely documented without pointers at its defining location and
was abused to prevent misuse of the QuerySet field deferring feature.
2019-11-18 14:06:51 +01:00
Dulmandakh 24b9f50823 Fixed #29916 -- Added lower_inc, lower_inf, upper_inc, and upper_inf lookups for RangeFields.
Co-Authored-By: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2019-11-14 22:27:29 +01:00
daniel a rios efc3e32d6d Fixed #30759 -- Made cache.delete() return whether it succeeded.
Thanks Simon Charette for the review.
2019-11-14 11:14:11 +01:00
Mariusz Felisiak b93a0e34d9
Refs #29926 -- Doc'd Python 3.8 compatibility in Django 2.2.x. 2019-11-12 22:11:44 +01:00
Mariusz Felisiak 30359496a3 Added stub release notes for 2.2.8 release. 2019-11-12 14:37:59 +01:00
Hasan Ramezani 153c7956f8 Fixed #24858 -- Added support for get_FOO_display() to ArrayField and RangeFields.
_get_FIELD_display() crashed when Field.choices was unhashable.
2019-11-08 10:59:24 +01:00
Nick Pope 02983c5242 Fixed #30943 -- Added BloomIndex to django.contrib.postgres. 2019-11-07 11:23:53 +01:00
Jon Dufresne 26554cf5d1 Fixed #29983 -- Replaced os.path() with pathlib.Path in project template and docs.
Thanks Curtis Maloney for the original patch.
2019-11-07 11:11:27 +01:00
Jon Dufresne 77aa74cb70 Refs #29983 -- Added support for using pathlib.Path in all settings. 2019-11-07 10:26:22 +01:00
Mariusz Felisiak 4c45b627f8 Removed unused import of ACTION_CHECKBOX_NAME in django.contrib.admin.
Unused since e651b3095c.
2019-11-06 12:49:42 +01:00
Jon Dufresne fbbff7f808 Refs #29983 -- Added pathlib.Path support to the file email backend. 2019-11-06 09:33:07 +01:00
Stephen Rauch 4b6db766ba Refs #30183 -- Doc'd dropping support for sqlparse < 0.2.2.
Support for sqlparse < 0.2.2 was broken in
782d85b6df because is_whitespace property
was added in sqlparse 0.2.2.
2019-11-06 08:45:43 +01:00
Jon Dufresne b9fe7f9294 Fixed #30947 -- Changed tuples to lists in model Meta options in django.contrib modules.
The Django "Model Meta options" docs provide examples and generally
point the reader to use lists for the unique_together and ordering
options. Follow our own advice for contrib models.

More generally, lists should be used for homogeneous sequences of
arbitrary lengths of which both unique_together and ordering are.
2019-11-05 08:16:31 +01:00
Claude Paroz 6ccb1b68bc Added Uzbek language. 2019-11-04 14:50:00 +01:00
Mariusz Felisiak 126cfefce2 Added release dates for 2.2.7, 2.1.14, and 1.11.26. 2019-11-04 08:20:22 +01:00
Carlton Gibson 2d38eb0ab9 Fixed #30931 -- Restored ability to override Model.get_FIELD_display().
Thanks Sergey Fedoseev for the implementation idea.

Regression in a68ea23101.
2019-11-04 07:55:34 +01:00
Sky 3cf907c20c Fixed #30761 -- Prevented floatformat filter from returning a negative zero. 2019-10-31 10:48:35 +01:00
Hasan Ramezani 17752003a8 Refs #28428 -- Made FileSystemStorage.save() to support pathlib.Path. 2019-10-31 09:06:05 +01:00
Hasan Ramezani 6315a272c5 Refs #28428 -- Made filepath_to_uri() support pathlib.Path. 2019-10-30 13:13:15 +01:00
Sergey Fedoseev 6bbf9a20e2 Fixed #29770 -- Added LinearRing.is_counterclockwise property. 2019-10-25 14:28:26 +02:00
Nick Pope 55df1750be Refs #30897 -- Added support for ANALYZE option to Queryset.explain() on MariaDB and MySQL 8.0.18+. 2019-10-24 15:13:26 +02:00
Nick Pope 742961332e Refs #30897 -- Added support for TREE format to Queryset.explain() on MySQL 8.0.16+. 2019-10-24 15:13:23 +02:00
Hannes Ljungberg fa5f3291e7 Fixed #30903 -- Fixed migrations crash on PostgreSQL when adding Index with opclasses and ordering. 2019-10-24 09:33:14 +02:00
André Ericson 3120490912 Fixed #30876 -- Moved classproperty() decorator to the django.utils.functional. 2019-10-21 09:57:39 +02:00
André Ericson 31174031f1 Fixed #30841 -- Deprecated using non-boolean values for isnull lookup. 2019-10-21 08:44:20 +02:00
Pavel Savchenko 1711c509fa Fixed #27391 -- Implemented SimpleTestCase.debug().
debug() should bubbled up exceptions if occurring in test, but behave
the same as run() when no exceptions occurred.
2019-10-18 12:22:51 +02:00
Mariusz Felisiak 3a8af298b9 Fixed #30890 -- Added MariaDB support for the relate lookup. 2019-10-18 07:46:31 +02:00
Mariusz Felisiak 187a64608d Fixed #30885 -- Dropped support for MariaDB 10.1. 2019-10-16 18:40:48 +02:00
Mariusz Felisiak 06d34aab7c Fixed #30870 -- Fixed showing that RunPython operations are irreversible by migrate --plan.
Thanks Hasan Ramezani for the initial patch and Kyle Dickerson for the
report.
2019-10-14 11:13:27 +02:00
Louise Grandjonc 7d1bf29977 Fixed #30826 -- Fixed crash of many JSONField lookups when one hand side is key transform.
Regression in 6c3dfba892.
2019-10-11 10:55:22 +02:00
Flavio Curella ed112fadc1 Fixed #23755 -- Added support for multiple field names in the no-cache Cache-Control directive to patch_cache_control().
https://tools.ietf.org/html/rfc7234#section-5.2.2.2
2019-10-10 19:30:51 +02:00
Mariusz Felisiak 2a6f45e08e Fixed typos in docs/releases/3.0.txt. 2019-10-10 14:22:04 +02:00
Viktor Lomakin ee6b17187f Fixed #30812 -- Made ConditionalGetMiddleware set ETag only for responses with non-empty content. 2019-10-10 09:51:05 +02:00
Benjy Weinberger 3cd3bebe89 Fixed #30300 -- Allowed migrations to be loaded from directories without __init__.py file. 2019-10-10 08:31:41 +02:00
Carlton Gibson f4ac9ae8d9 Refs #14218 -- Adjusted release note to use present tense.
Thanks to Tim Graham for review.
2019-10-03 10:14:06 +02:00
Anatol Ulrich 8ed6788aa4 Fixed #30821 -- Added ExtractIsoWeekYear database function and iso_week_day lookup. 2019-10-02 10:41:34 +02:00
Tanner Stirrat 17595407ca Fixed #14218 -- Added Paginator.__iter__(). 2019-10-02 09:49:31 +02:00
Mariusz Felisiak 84322a29ce Added stub release notes for 1.11.26 and 2.1.14. 2019-10-02 07:49:47 +02:00
Carlton Gibson e1c1eaf0c6 Added stub release notes for 2.2.7. 2019-10-01 10:43:30 +02:00
Carlton Gibson 3826aed46d Added release dates for 2.2.6, 2.1.13, and 1.11.25. 2019-10-01 08:49:15 +02:00
Oleg Kainov c574bec092 Fixed #25598 -- Added SCRIPT_NAME prefix to STATIC_URL and MEDIA_URL set to relative paths.
Thanks Florian Apolloner for reviews.

Co-authored-by: Joel Dunham <Joel.Dunham@technicalsafetybc.ca>
2019-09-25 19:47:03 +02:00
Mads Jensen 129583a0d3 Removed some outdated backwards compatibility imports and misleading comments.
EmptyResultSet moved in 46509cf13d.
FieldDoesNotExist moved in 8958170755.
BoundField and pretty_name moved in 8550161e53.
EMPTY_VALUES moved in 471596fc1a.
BaseRunserverCommand moved in 5c53e30607.
2019-09-24 15:18:53 +02:00
Johannes Hoppe b31e63879e Fixed #29444 -- Allowed returning multiple fields from INSERT statements on Oracle. 2019-09-24 10:22:43 +02:00
Hasan Ramezani 226ebb1729 Fixed #28622 -- Allowed specifying password reset link expiration in seconds and deprecated PASSWORD_RESET_TIMEOUT_DAYS. 2019-09-20 13:52:04 +02:00
Daniel Fairhead 5cb3ed187b Fixed #30772 -- Optimized make_template_fragment_key().
Removed usage of urllib.quote(), unnecessary since cbbe60c7fc.
Used hasher's .update() on key fragments.
2019-09-18 14:53:05 +02:00
Simon Charette 6c3dfba892 Fixed #30769 -- Fixed a crash when filtering against a subquery JSON/HStoreField annotation.
This was a regression introduced by 7deeabc7c7
to address CVE-2019-14234.

Thanks Tim Kleinschmidt for the report and Mariusz for the tests.
2019-09-16 08:24:40 +02:00
Mariusz Felisiak bd7e0f81f8 Added stub release notes for 1.11.25 and 2.1.13. 2019-09-16 07:37:47 +02:00
Nick Pope 1c66767d4e Refs #27910 -- Improved documentation for model field choice enumeration types. 2019-09-13 15:37:40 +02:00
Carlton Gibson ea25bdc2b9 Added PBKDF2 hasher iteration increase to 3.0 release notes.
Refs 06670015f7
2019-09-12 17:24:01 +02:00
Carlton Gibson b5db65c4fb Increased the default PBKDF2 iterations for Django 3.1. 2019-09-12 17:24:01 +02:00
Mariusz Felisiak 0ddb4ebf7b Refs #14357 -- Made Meta.ordering not affect GROUP BY queries.
Per deprecation timeline.
2019-09-10 12:01:00 +02:00
Mariusz Felisiak d17be88afd Refs #30037 -- Required the RemoteUserBackend.configure_user() to have request as the first positional argument.
Per deprecation timeline.
2019-09-10 12:01:00 +02:00
Mariusz Felisiak b61ea56789 Refs #28478 -- Removed support for TestCase's allow_database_queries and multi_db per deprecation timeline. 2019-09-10 12:01:00 +02:00
Mariusz Felisiak f1894bae30 Refs #28606 -- Removed CachedStaticFilesStorage per deprecation timeline. 2019-09-10 12:01:00 +02:00
Mariusz Felisiak 81993b47ea Refs #29703 -- Removed QuerySetPaginator alias per deprecation timeline. 2019-09-10 12:01:00 +02:00
Mariusz Felisiak cb2be9d5d5 Refs #29546 -- Removed django.utils.timezone.FixedOffset per deprecation timeline. 2019-09-10 12:01:00 +02:00
Mariusz Felisiak 3d716467a9 Refs #29817 -- Removed settings.FILE_CHARSET per deprecation timeline. 2019-09-10 12:01:00 +02:00
Mariusz Felisiak b47bb4c4a7 Refs #29598 -- Removed FloatRangeField per deprecation timeline. 2019-09-10 12:01:00 +02:00
Mariusz Felisiak 32796826bb Added stub release notes for 3.1. 2019-09-10 12:00:56 +02:00
Simon Charette 34decdebf1 Fixed #30754 -- Prevented inclusion of aliases in partial index conditions.
SQLite doesn't repoint table aliases in partial index conditions on table
rename which breaks the documented table alteration procedure.

Thanks Pēteris Caune for the report.
2019-09-10 10:03:16 +02:00
Carlton Gibson a624803514 Finalised release notes for 3.0 alpha release.
* Removed empty sections
* Corrected some typos and wrapping errors.
2019-09-10 09:58:42 +02:00
Vojtech Bocek b1d37fea8f Fixed #28107 -- Added DatabaseFeatures.allows_group_by_selected_pks_on_model() to allow enabling optimization for unmanaged models. 2019-09-09 14:04:46 +02:00
Nick Pope 406dba04e1 Fixed #29406 -- Added support for Referrer-Policy header.
Thanks to James Bennett for the initial implementation.
2019-09-09 13:35:41 +02:00
Nick Pope 1edbb6c194 Refs #30426 -- Moved release notes into separate security section. 2019-09-09 13:35:31 +02:00
Johannes Hoppe 7254f1138d Refs #29444 -- Allowed returning multiple fields from INSERT statements on PostgreSQL.
Thanks Florian Apolloner, Tim Graham, Simon Charette, Nick Pope, and
Mariusz Felisiak for reviews.
2019-09-09 10:51:14 +02:00
Claude Paroz 05d0eca635 Fixed #30426 -- Changed X_FRAME_OPTIONS setting default to DENY. 2019-09-09 08:15:26 +02:00
Mariusz Felisiak 350123f38c
Moved release note for refs #30158 from deprecated to backwards incompatible changes. 2019-09-05 15:56:52 +02:00
Mariusz Felisiak e2c6a0858d Fixed #30750 -- Added support for check constraints on MySQL 8.0.16+. 2019-09-05 09:18:34 +02:00
Shai Berger 72ebe85a26 Fixed #27910 -- Added enumeration helpers for use in Field.choices.
These classes can serve as a base class for user enums, supporting
translatable human-readable names, or names automatically inferred
from the enum member name.

Additional properties make it easy to access the list of names, values
and display labels.

Thanks to the following for ideas and reviews:

Carlton Gibson, Fran Hrženjak, Ian Foote, Mariusz Felisiak, Shai Berger.

Co-authored-by: Shai Berger <shai@platonix.com>
Co-authored-by: Nick Pope <nick.pope@flightdataservices.com>
Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2019-09-04 14:42:49 +02:00
Nasir Hussain 25706d7285 Fixed #29714 -- Allowed using ExceptionReporter subclass with AdminEmailHandler. 2019-09-04 08:40:46 +02:00
Mariusz Felisiak 0d4529d314 Added stub release notes for 2.2.6. 2019-09-04 08:02:32 +02:00
Carlton Gibson 4f61810751 Fixed #30747 -- Renamed is_safe_url() to url_has_allowed_host_and_scheme(). 2019-09-02 15:32:23 +02:00
Mariusz Felisiak 47f49adc11 Added release dates for 2.2.5, 2.1.12, and 1.11.24. 2019-09-02 07:43:51 +02:00
yukihira1992 0545781764 Fixed #30736 -- Added Storage.get_alternative_name() to allow customization. 2019-08-30 11:32:19 +02:00
Berker Peksag 400ec5125e Fixed #18763 -- Added ModelBackend/UserManager.with_perm() methods.
Co-authored-by: Nick Pope <nick.pope@flightdataservices.com>
2019-08-29 19:32:12 +02:00
Matthew Schinckel 4137fc2efc Fixed #25367 -- Allowed boolean expressions in QuerySet.filter() and exclude().
This allows using expressions that have an output_field that is a
BooleanField to be used directly in a queryset filters, or in the
When() clauses of a Case() expression.

Thanks Josh Smeaton, Tim Graham, Simon Charette, Mariusz Felisiak, and
Adam Johnson for reviews.

Co-Authored-By: NyanKiyoshi <hello@vanille.bid>
2019-08-29 09:45:29 +02:00
Hasan Ramezani 03dbdfd9bb Fixed #29019 -- Added ManyToManyField support to REQUIRED_FIELDS. 2019-08-26 14:48:40 +02:00
Dulmandakh 06372a8d27 Fixed #30507 -- Updated admin's jQuery to 3.4.1. 2019-08-23 11:00:16 +02:00
Mads Jensen 85ac838d9e Fixed #21039 -- Added AddIndexConcurrently/RemoveIndexConcurrently operations for PostgreSQL.
Thanks to Simon Charettes for review.

Co-Authored-By: Daniel Tao <daniel.tao@gmail.com>
2019-08-21 13:10:06 +02:00
François Freitag 9a88e43aeb Fixed broken links and redirects in documentation.
Removed reference to custom builds, feature removed in
8e6b3bba99.
2019-08-21 10:57:24 +02:00
Nick Pope 21e559495b Fixed #29979, Refs #17337 -- Extracted AutoField field logic into a mixin and refactored AutoFields.
This reduces duplication by allowing AutoField, BigAutoField and
SmallAutoField to inherit from IntegerField, BigIntegerField and
SmallIntegerField respectively. Doing so also allows for enabling the
max_length warning check and minimum/maximum value validation for auto
fields, as well as providing a mixin that can be used for other possible
future auto field types such as a theoretical UUIDAutoField.
2019-08-20 09:22:25 +02:00
Claude Paroz d1c2e6dd04 Refs #28428 -- Made FileField.upload_to support pathlib.Path. 2019-08-18 20:34:58 +02:00
Claude Paroz 0468159763 Refs #30426 -- Changed default SECURE_CONTENT_TYPE_NOSNIFF to True. 2019-08-18 13:17:49 +02:00
Adnan Umer 6805c0f99f Fixed #30701 -- Updated patch_vary_headers() to handle an asterisk according to RFC 7231. 2019-08-16 15:25:42 +02:00
zeyneloz 00035672a4 Fixed #30449 -- Fixed RelatedFieldListFilter/RelatedOnlyFieldListFilter to respect model's Meta.ordering.
Regression in 6d4e5feb79.

Co-Authored-By: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2019-08-15 10:29:05 +02:00
Mariusz Felisiak 1f8382d34d
Fixed #30672 -- Fixed crash of JSONField/HStoreField key transforms on expressions with params.
Regression in 4f5b58f5cd.

Thanks Florian Apolloner for the report and helping with tests.
2019-08-14 15:25:35 +02:00
Claude Paroz eed2e740f7 Fixed #30461 -- Made GeoIP2 and GEOIP_PATH setting accept pathlib.Path as library path.
Thanks Nikita Krokosh for the initial patch.
2019-08-13 19:44:10 +02:00
Adnan Umer 8d3519071e Fixed #30673 -- Relaxed system check for db_table collision when database routers are installed by turning the error into a warning. 2019-08-08 21:14:06 +02:00
Andrew Godwin 052388aba4 Fixed #30676 -- Added --pdb option to test runner. 2019-08-07 08:16:31 +02:00
Mariusz Felisiak 1af469e67f Added stub release notes for 2.2.5. 2019-08-02 20:32:21 +02:00
Nick Pope 194d1dfc18 Fixed #30661 -- Added models.SmallAutoField. 2019-08-02 11:39:01 +02:00
Carlton Gibson a5652eb795 Added CVE-2019-14235 to security release archive. 2019-08-01 12:01:27 +02:00
Carlton Gibson 3a6a2f5eaf Added CVE-2019-14234 to security release archive. 2019-08-01 11:59:45 +02:00
Carlton Gibson 9600f63885 Added CVE-2019-14233 to security release archive. 2019-08-01 11:57:24 +02:00
Carlton Gibson 87750787d1 Added CVE-2019-14232 to the security release archive. 2019-08-01 11:54:24 +02:00
Florian Apolloner 76ed1c49f8 Fixed CVE-2019-14235 -- Fixed potential memory exhaustion in django.utils.encoding.uri_to_iri().
Thanks to Guido Vranken for initial report.
2019-08-01 09:24:54 +02:00
Mariusz Felisiak 7deeabc7c7 Fixed CVE-2019-14234 -- Protected JSONField/HStoreField key and index lookups against SQL injection.
Thanks to Sage M. Abdullah for the report and initial patch.
Thanks Florian Apolloner for reviews.
2019-08-01 09:24:54 +02:00
Florian Apolloner 4b78420d25 Fixed CVE-2019-14233 -- Prevented excessive HTMLParser recursion in strip_tags() when handling incomplete HTML entities.
Thanks to Guido Vranken for initial report.
2019-08-01 09:24:54 +02:00
Florian Apolloner 7f65974f82 Fixed CVE-2019-14232 -- Adjusted regex to avoid backtracking issues when truncating HTML.
Thanks to Guido Vranken for initial report.
2019-08-01 09:24:54 +02:00
Étienne Beaulé 5f24e7158e Fixed #30665 -- Added support for distinct argument to Avg() and Sum(). 2019-07-31 11:22:50 +02:00
Nick Pope f618e033ac Fixed #30160 -- Added support for LZMA and XZ templates to startapp/startproject management commands. 2019-07-31 10:02:13 +02:00
Jon Dufresne 4122d9d3f1 Refs #28147 -- Fixed setting of OneToOne and Foreign Key fields to None when using attnames.
Regression in 519016e5f2.
2019-07-27 12:04:56 +02:00
Carlton Gibson f13147c8de Added stub release notes for security releases. 2019-07-25 10:49:30 +02:00
Jon Dufresne 5ed20b3aa3 Fixed #30657 -- Allowed customizing Field's descriptors with a descriptor_class attribute.
Allows model fields to override the descriptor class used on the model
instance attribute.
2019-07-25 08:15:20 +02:00
Tom Forbes fc75694257 Fixed #30647 -- Fixed crash of autoreloader when extra directory cannot be resolved. 2019-07-24 14:08:37 +02:00
Tom Forbes 2ff517ccb6 Fixed #30506 -- Fixed crash of autoreloader when path contains null characters. 2019-07-23 10:03:23 +02:00
Mads Jensen a3417282ac Fixed #29824 -- Added support for database exclusion constraints on PostgreSQL.
Thanks to Nick Pope and Mariusz Felisiak for review.

Co-Authored-By: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2019-07-16 18:04:41 +02:00
Mads Jensen 7174cf0b00 Refs #29824 -- Added RangeOperators helper class. 2019-07-16 16:57:46 +02:00
Johannes Hoppe 00d4e6f8b5 Updated Select2 to version 4.0.7. 2019-07-10 12:31:16 +02:00
Mariusz Felisiak 7991111af1
Fixed #30621 -- Fixed crash of __contains lookup for Date/DateTimeRangeField when the right hand side is the same type.
Thanks Tilman Koschnick for the report and initial patch.
Thanks Carlton Gibson the review.

Regression in 6b048b364c.
2019-07-10 10:33:36 +02:00
Simon Charette ee6e93ec87 Fixed #30628 -- Adjusted expression identity to differentiate bound fields.
Expressions referring to different bound fields should not be
considered equal.

Thanks Julien Enselme for the detailed report.

Regression in bc7e288ca9.
2019-07-10 07:46:08 +02:00
Mariusz Felisiak 08e69cad9c Added stub release notes for 2.2.4. 2019-07-09 07:39:35 +02:00
can febe136d4c Fixed #30397 -- Added app_label/class interpolation for names of indexes and constraints. 2019-07-08 14:57:56 +02:00
Johannes Hoppe bc91f27a86 Refs #29444 -- Added support for fetching a returned non-integer insert values on Oracle.
This is currently not actively used, since the ORM will ask the
SQL compiler to only return auto fields.
2019-07-08 08:53:08 +02:00
Hasan Ramezani a5308514fb Fixed #27801 -- Made createsuperuser fall back to environment variables for password and required fields. 2019-07-02 12:55:09 +02:00
Mariusz Felisiak 868cd56f05 Added CVE-2019-12781 to the security release archive. 2019-07-01 10:14:36 +02:00
Mariusz Felisiak fc41401f33 Added release date for 2.2.3. 2019-07-01 07:48:45 +02:00
Carlton Gibson 54d0f5e62f Fixed CVE-2019-12781 -- Made HttpRequest always trust SECURE_PROXY_SSL_HEADER if set.
An HTTP request would not be redirected to HTTPS when the
SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings were used if
the proxy connected to Django via HTTPS.

HttpRequest.scheme will now always trust the SECURE_PROXY_SSL_HEADER if
set, rather than falling back to the request scheme when the
SECURE_PROXY_SSL_HEADER did not have the secure value.

Thanks to Gavin Wahl for the report and initial patch suggestion, and
Shai Berger for review.
2019-07-01 07:48:04 +02:00
Mariusz Felisiak 30b3ee9d0b Added stub release notes for security releases. 2019-07-01 06:57:27 +02:00
Claude Paroz d54baf6970 Updated translations from Transifex
Forward port of b3f7262e6e from stable/2.2.x
2019-06-29 16:17:16 +02:00
nsasaki128 a289e79679 Fixed #30594 -- Added 'private' Cache-Control directive to never_cache() decorator. 2019-06-26 09:25:24 +02:00
Tom Forbes 8454f6dea4 Fixed #30588 -- Fixed crash of autoreloader when __main__ module doesn't have __file__ attribute. 2019-06-26 06:44:10 +02:00
Nadège Michel 87b1ad6e73 Fixed #30421 -- Allowed symmetrical intermediate table for self-referential ManyToManyField. 2019-06-21 15:03:17 +02:00
Jon Dufresne 2ef6f209f7 Fixed typos in 1.11.19, 2.0.11, 2.1.6 release notes. 2019-06-21 07:07:23 +02:00
Andrew Godwin a415ce70be Fixed #30451 -- Added ASGI handler and coroutine-safety.
This adds an ASGI handler, asgi.py file for the default project layout,
a few async utilities and adds async-safety to many parts of Django.
2019-06-20 12:29:43 +02:00
Sanyam Khurana 87f5d07eed Fixed #12952 -- Adjusted admin log change messages to use form labels instead of field names. 2019-06-14 18:20:29 +02:00
can fde9b7d35e Fixed #30128 -- Fixed handling timedelta timezone in database functions. 2019-06-13 09:29:43 +02:00
Jon Dufresne 9e38ed0536 Fixed #27486 -- Fixed Python 3.7 DeprecationWarning in intword and filesizeformat filters.
intword and filesizeformat passed floats to ngettext() which is
deprecated in Python 3.7. The rationale for this warning is documented
in BPO-28692: https://bugs.python.org/issue28692.

For filesizeformat, the filesize value is expected to be an int -- it
fills %d string formatting placeholders. It was likely coerced to a
float to ensure floating point division on Python 2. Python 3 always
does floating point division, so coerce to an int instead of a float to
fix the warning.

For intword, the number may contain a decimal component. In English, a
decimal component makes the noun plural. A helper function,
round_away_from_one(), was added to convert the float to an integer that
is appropriate for ngettext().
2019-06-11 20:34:59 +02:00
Hasan Ramezani dcb8f00d06 Fixed #29379 -- Added autocomplete attribute to contrib.auth.forms fields.
Thank you to Nick Pope for review.

Co-authored-by: CHI Cheng <cloudream@gmail.com>
2019-06-07 12:44:39 +02:00
Tobias Bengfort 581a0f4545 Refs #30226 -- Added User.get_user_permissions() method.
Added to mirror the existing User.get_group_permissions().
2019-06-05 13:56:37 +02:00
Tobias Bengfort 75337a6050 Fixed #30226 -- Added BaseBackend for authentication. 2019-06-05 13:39:46 +02:00
Étienne Beaulé 4b6dfe1622 Fixed #30542 -- Fixed crash of numerical aggregations with filter.
Filters in annotations crashed when used with numerical-type
aggregations (i.e. Avg, StdDev, and Variance). This was caused as the
source expressions no not necessarily have an output_field (such as the
filter field), which lead to an AttributeError: 'WhereNode' object has
no attribute output_field.

Thanks to Chuan-Zheng Lee for the report.

Regression in c690afb873 and two following
commits.
2019-06-05 08:06:26 +02:00
Mariusz Felisiak 1f81e2df69 Added stub release notes for 2.2.3. 2019-06-05 06:57:44 +02:00
Nick Pope 21b1d23912 Added CVE-2019-12308 to the security release archive. 2019-06-03 21:44:55 +02:00
Nick Pope 8fb0ea5583 Added CVE-2019-11358 to the security release archive. 2019-06-03 21:44:55 +02:00
Mariusz Felisiak 100ec901ae Fixed typos in 1.11.21, 2.1.9, 2.2.2 release notes. 2019-06-03 14:08:51 +02:00
Carlton Gibson 34ec52269a Applied jQuery patch for CVE-2019-11358. 2019-06-03 11:36:12 +02:00
Carlton Gibson deeba6d920 Fixed CVE-2019-12308 -- Made AdminURLFieldWidget validate URL before rendering clickable link. 2019-06-03 11:36:12 +02:00
Carlton Gibson 98c0fe19ee Added stub release notes for security releases. 2019-06-03 10:48:52 +02:00
Hasan Ramezani e2de49ec2e Fixed #28520 -- Added --start-at/--start-after options to runtests.py. 2019-05-31 07:01:12 +02:00
Tom Forbes 480492fe70 Fixed #30523 -- Fixed updating file modification times on seen files in auto-reloader when using StatReloader.
Previously we updated the file mtimes if the file has not been seen
before - i.e on the first iteration of the loop.

If the mtime has been changed we triggered the notify_file_changed()
method which in all cases except the translations will result in the
process being terminated. To be strictly correct we need to update the
mtime for either branch of the conditional.

Regression in 6754bffa2b.
2019-05-29 09:41:24 +02:00
Tom Forbes 0344565179 Fixed #30516 -- Fixed crash of autoreloader when re-raising exceptions with custom signature.
Regression in c8720e7696.
2019-05-29 08:08:50 +02:00
Caio Ariede a3f91891d2 Fixed #30315 -- Fixed crash of ArrayAgg and StringAgg with ordering when used in Subquery. 2019-05-28 10:05:50 +02:00
Tom Forbes b2790f74d4 Fixed #30479 -- Fixed detecting changes in manage.py by autoreloader when using StatReloader.
Regression in c8720e7696.
2019-05-28 08:31:33 +02:00
Mariusz Felisiak b6c4766f53
Refs #29548 -- Updated docs for MariaDB support. 2019-05-27 19:59:49 +02:00
Johan Lübcke 0670b1b403 Fixed #30485 -- Adjusted django.utils.http.urlencode for doseq=False case. 2019-05-24 17:15:34 +02:00
Rob 58df8aa40f Fixed #28780 -- Allowed specyfing a token parameter displayed in password reset URLs.
Co-authored-by: Tim Givois <tim.givois.mendez@gmail.com>
2019-05-24 08:40:25 +02:00
Hasan Ramezani 9d6f981a66 Fixed #28763 -- Allowed overriding the session cookie age with SessionStore.get_session_cookie_age(). 2019-05-21 08:50:09 +02:00
Mariusz Felisiak df28ebd6c8 Fixed typo in docs/releases/3.0.txt. 2019-05-21 08:21:35 +02:00
Thomasina Lee c38e7a79f4 Fixed #30488 -- Removed redundant Coalesce call in SQL generated by SearchVector.
Regression in 405c836336.
2019-05-20 08:34:06 +02:00
ruchit2801 04042b2b44 Fixed #30463 -- Fixed crash of deprecation message when Meta.ordering contains expressions.
Regression in 1b1f64ee5a.
2019-05-18 19:29:00 +02:00
Johannes Hoppe 8d010f3986 Fixed #30220 -- Added support for headless mode in selenium tests. 2019-05-17 08:14:54 +02:00
Claude Paroz e286987a27 Fixed #30459 -- Delegated hide/show JS toggle to parent div.
Co-authored-by: Carlton Gibson <carlton.gibson@noumenal.es>
2019-05-17 07:46:45 +02:00
Troon a3a4f5c144 Fixed #30310 -- Added support for looking up HttpHeaders.headers using underscores. 2019-05-09 16:26:52 +02:00
Jon Dufresne 48235ba807 Refs #30399 -- Made assertHTMLEqual normalize character and entity references. 2019-05-09 15:55:32 +02:00
Mariusz Felisiak 30dd43884e
Added stub release notes for 2.2.2. 2019-05-08 14:41:16 +02:00
Hasan Ramezani f038214d91 Fixed #29056 -- Fixed HTML5 validation of required SelectDateWidget.
placeholder is required for "select" with "required" attribute.
2019-05-08 12:46:30 +02:00
Jon Dufresne b915b9f10f Refs #27753 -- Deprecated django.utils.text.unescape_entities().
The function was undocumented and only required for compatibility with
Python 2.

Code should use Python's html.unescape() that was added in Python 3.4.
2019-05-08 08:00:59 +02:00
Tobias Kunze 3166880301 Fixed #29352 -- Allowed specifying a Feed language. 2019-05-06 15:10:54 +02:00
Daniel Hahler 29601bca9b Ignored pywatchman.SocketTimeout in Watchman autoreloader.
Bumped minimum supported pywatchman version to 1.2.0.

These exceptions don't require checking a server status.
2019-05-03 13:56:49 +02:00
Mykola Kokalko ef082ebb84 Fixed #29529 -- Allowed models.fields.FilePathField to accept a callable path. 2019-05-02 11:11:56 +02:00
Mariusz Felisiak 2106b983c4
Added release date for 2.2.1. 2019-05-01 07:05:47 +02:00
François Freitag 568eed9e79 Fixed #30245 -- Added -k option to DiscoverRunner. 2019-04-30 16:20:51 +02:00
can 719b746620 Fixed #30412 -- Fixed crash when adding check constraints with OR'ed condition on Oracle and SQLite. 2019-04-30 12:32:27 +02:00
Jon Dufresne 6866c91b63 Fixed #30418 -- Added --skip-checks management command option. 2019-04-30 10:48:30 +02:00
Simon Charette a8b3f96f6a Fixed #30408 -- Fixed crash when adding check constraints with LIKE operator on Oracle and PostgreSQL.
The LIKE operator wildcard generated for contains, startswith, endswith and
their case-insensitive variant lookups was conflicting with parameter
interpolation on CREATE constraint statement execution.

Ideally we'd delegate parameters interpolation in DDL statements on backends
that support it but that would require backward incompatible changes to the
Index and Constraint SQL generating methods.

Thanks David Sanders for the report.
2019-04-30 07:38:22 +02:00
kingbuzzman 673fe2e3ec Fixed #30148 -- Logged COPY ... TO statements in connection.queries on PostgreSQL. 2019-04-29 14:20:17 +02:00
Tom Forbes 6754bffa2b Fixed #30323 -- Fixed detecting changes by autoreloader when using StatReloader. 2019-04-29 11:41:00 +02:00
Tom Forbes 0636d4d2aa Refs #30323 -- Prevented crash of autoreloader when get_resolver().urlconf_module raising an exception. 2019-04-29 11:41:00 +02:00
Carlton Gibson 98296f86b3
Fixed #30351 -- Handled pre-existing permissions in proxy model permissions data migration.
Regression in 181fb60159.
2019-04-27 20:18:22 +02:00
Jacob Green ed3c59097a
Fixed #30361 -- Increased the default timeout of watchman client to 5 seconds and made it customizable.
Made the default timeout of watchman client customizable via
DJANGO_WATCHMAN_TIMEOUT environment variable.
2019-04-26 12:55:49 +02:00
Aarni Koskela efeceba589
Fixed #30312 -- Relaxed admin check from django.contrib.sessions to SessionMiddleware subclasses. 2019-04-26 11:31:06 +02:00
Mariusz Felisiak 85676979a4
Refs #30388 -- Added release note for 0f22671ecb. 2019-04-25 15:45:00 +02:00
Jon Dufresne 8d76443aba Fixed #30399 -- Changed django.utils.html.escape()/urlize() to use html.escape()/unescape(). 2019-04-25 15:09:07 +02:00
Alasdair Nicol a5accc0368 Fixed #30318 -- Added check for importability of arguments of custom error handler views.
Thanks to Jon on Stack Overflow for reporting the issue.
2019-04-25 11:08:22 +02:00
Simon Charette 405c836336 Fixed #30385 -- Restored SearchVector(config) immutability.
Regression in 1a28dc3887.

The usage of CONCAT to allow SearchVector to deal with non-text fields
made the generated expression non-IMMUTABLE which prevents a functional
index to be created for it.

Using a combination of COALESCE and ::text makes sure the expression
preserves its immutability.

Refs #29582. Thanks Andrew Brown for the report, Nick Pope for the
review.
2019-04-23 08:11:33 +02:00
Dustin Neighly 49fb3f5f3e Fixed #30341 -- Added support for the furlong unit in Distance. 2019-04-19 08:54:23 +02:00
Mariusz Felisiak 753580ecd1
Made cosmetic edits in docs/releases/2.2.1.txt. 2019-04-19 08:27:06 +02:00
Scott Fitsimones a14c0fda15 Fixed #30328 -- Fixed crash of IntegerField.validators when limit_value in a custom validator is callable. 2019-04-19 07:58:27 +02:00
Ramiro Morales aed89adad5 Fixed #30367 -- Changed "pip install" to "python -m pip install" in docs, comments and hints. 2019-04-18 14:41:15 +02:00
Ville Skyttä 03db5fddfd Fixed typos in docs, comments, and exception messages. 2019-04-18 09:33:53 +02:00
Oleh Mykytiuk 177fa08339 Fixed #30370 -- Added dbshell support for client TLS certificates on PostgreSQL. 2019-04-18 08:10:31 +02:00
can d87bd29c4f Fixed #30335, #29139 -- Fixed crash when ordering or aggregating over a nested JSONField key transform. 2019-04-18 07:16:50 +02:00
Hasan Ramezani 917fd9d03f
Fixed #27755 -- Added ModelAdmin.get_inlines() hook. 2019-04-17 07:16:04 +02:00
Mariusz Felisiak 5f7991c42c Fixed #30325 -- Reverted "Fixed #29725 -- Removed unnecessary join in QuerySet.count() and exists() on a many-to-many relation."
This reverts commit 1299421cad due to
a regression with custom managers.
2019-04-15 12:02:26 +02:00
Florian Apolloner 2e38f2015a
Fixed #30350 -- Prevented recreation of migration for operations with a range object.
Thanks to Mariusz Felisiak for helping with the patch.
2019-04-14 12:04:48 +02:00
Florian Apolloner afc708cf6d
Fixed #30330 -- Fixed setting of primary key to None during fast-delete.
Regression in bc7dd8490b.
2019-04-08 21:14:00 +02:00
Ran Benita 19fc6376ce
Fixed #30304 -- Added support for the HttpOnly, SameSite, and Secure flags on language cookies. 2019-04-08 11:26:06 +02:00
Tim Graham c84b91b760 Refs #27807 -- Removed docs for User.username_validator.
The new override functionality claimed in refs #21379 doesn't work.
Forwardport of 714fdbaa70 from stable/1.10.x.
2019-04-07 20:02:20 -04:00
Simone Pellizzari d0315584b5
Fixed #30332 -- Fixed crash of ordering by expressions with params in ArrayAgg and StringAgg. 2019-04-06 14:23:29 +02:00
Nick Pope efb257a017 Fixed #30324 -- Forced utf-8 encoding when loading the template for the technical 500 debug page.
Regression in 50b8493.
Related to ea542a9.
2019-04-05 16:35:01 +02:00
Mariusz Felisiak 5efaf078f7
Fixed #30331 -- Added support for psycopg2 2.8. 2019-04-05 11:05:53 +02:00
msg 755673e1bc
Fixed #30307 -- Fixed incorrect quoting of database user password when using dbshell on Oracle.
Regression in acfc650f2a.
2019-04-04 08:33:28 +02:00