Commit Graph

11538 Commits

Author SHA1 Message Date
Mariusz Felisiak d16133568e [3.2.x] Fixed CVE-2022-23833 -- Fixed DoS possiblity in file uploads.
Thanks Alan Ryan for the report and initial patch.

Backport of fc18f36c4a from main.
2022-02-01 07:54:17 +01:00
Markus Holtermann 1a1e8278c4 [3.2.x] Fixed CVE-2022-22818 -- Fixed possible XSS via {% debug %} template tag.
Thanks Keryn Knight for the report.

Backport of 394517f078 from main.

Co-authored-by: Adam Johnson <me@adamj.eu>
2022-02-01 07:53:21 +01:00
Florian Apolloner 8d2f7cff76 [3.2.x] Fixed CVE-2021-45452 -- Fixed potential path traversal in storage subsystem.
Thanks to Dennis Brinkrolf for the report.
2022-01-04 10:19:49 +01:00
Florian Apolloner c7fe895bca [3.2.x] Fixed CVE-2021-45116 -- Fixed potential information disclosure in dictsort template filter.
Thanks to Dennis Brinkrolf for the report.

Co-authored-by: Adam Johnson <me@adamj.eu>
2022-01-04 10:19:49 +01:00
Florian Apolloner a8b32fe13b [3.2.x] Fixed CVE-2021-45115 -- Prevented DoS vector in UserAttributeSimilarityValidator.
Thanks Chris Bailey for the report.

Co-authored-by: Adam Johnson <me@adamj.eu>
2022-01-04 10:19:49 +01:00
Florian Apolloner 333c656030 [3.2.x] Fixed #30530, CVE-2021-44420 -- Fixed potential bypass of an upstream access control based on URL paths.
Thanks Sjoerd Job Postmus and TengMA(@te3t123) for reports.

Backport of d4dcd5b9dd from main.
2021-12-07 06:32:24 +01:00
Mariusz Felisiak 6014b812e2 [3.2.x] Refs #33333 -- Fixed PickleabilityTestCase.test_annotation_with_callable_default() crash on Oracle.
Grouping by LOBs is not allowed on Oracle. This moves a binary field to
a separate model.
Backport of d3a64bea51 from main
2021-12-04 15:56:45 +01:00
Mariusz Felisiak cb724ef6c0 [3.2.x] Fixed #33333 -- Fixed setUpTestData() crash with models.BinaryField on PostgreSQL.
This makes models.BinaryField pickleable on PostgreSQL.

Regression in 3cf80d3fcf.

Thanks Adam Zimmerman for the report.

Backport of 2c7846d992 from main.
2021-12-03 12:01:28 +01:00
Hannes Ljungberg f5802a21c4 [3.2.x] Fixed #33194 -- Fixed migrations when altering a field with functional indexes on SQLite.
This adjusts Expressions.rename_table_references() to only update alias
when needed.

Regression in 83fcfc9ec8.

Co-authored-by: Simon Charette <charettes@users.noreply.github.com>

Backport of 86971c4090 from main.
2021-10-18 09:37:46 +02:00
Mariusz Felisiak dbcd81841f [3.2.x] Refs #32074 -- Removed usage of deprecated asyncore and smtpd modules.
asyncore and smtpd modules were deprecated in Python 3.10.

Backport of 569a33579c from main.
2021-10-15 10:04:06 +02:00
Mariusz Felisiak 137a9899d7 [3.2.x] Refs #27131 -- Removed SMTPBackendTests.test_server_login().
test_server_login() was a regression test for a crash when passing
Unicode strings to SMTP server using CRAM-MD5 method on Python 2.
Python 2 is no longer supported and test_server_login() passes even
without FakeSMTPChannel.smtp_AUTH() because
smtplib.SMTPAuthenticationError is raised when AUTH is not implemented.
Backport of cdad96e633 from main
2021-10-14 11:38:27 +02:00
Mariusz Felisiak f6726fdc3e [3.2.x] Refs #32074 -- Fixed find_module()/find_loader() warnings on Python 3.10+.
Backport of f1bcaa9be8 from main.
2021-10-05 11:24:18 +02:00
Karthikeyan Singaravelan d0dc446444 [3.2.x] Refs #32074 -- Removed usage of deprecated Thread.setDaemon().
Thread.setDaemon() was deprecated in Python 3.10 and will be removed in
Python 3.12.

Backport of f9f6bd63c9 from main
2021-10-05 11:15:03 +02:00
Mariusz Felisiak faeae84dad [3.2.x] Skipped test_archive tests when bz2/lzma module is not installed.
Backport of ae48601e6d from main
2021-10-05 11:00:25 +02:00
Carlton Gibson 6760f4fa25 [3.2.x] Fixed #33083 -- Fixed selecting all items in the admin changelist when actions are both top and bottom.
Thanks Benjamin Locher for the report.

Regression in 30e59705fc.
Backport of b0ed619303 from main
2021-09-21 19:59:41 +02:00
Ken Whitesell d4a587a5fa [3.2.x] Fixed #33077 -- Fixed links to related models for admin's readonly fields in custom admin site.
Backport of 0a9aa02e6f from main
2021-09-18 20:10:06 +02:00
Mariusz Felisiak b61f44c339 [3.2.x] Fixed #33082 -- Fixed CommandTests.test_subparser_invalid_option on Python 3.9.7+.
Thanks Michał Górny for the report.

Backport of 50ed545e2f from main.
2021-09-02 10:59:30 +02:00
Carlton Gibson fe3a854e1d [3.2.x] Fixed #32992 -- Restored offset extraction for fixed offset timezones.
Regression in 10d1261984.

Backport of cbba49971b from main
2021-08-30 10:46:19 +02:00
Märt Häkkinen 358e65a5cd [3.2.x] Fixed #33030 -- Fixed broken links to GDAL docs.
Backport of ed317e79e3 from main
2021-08-23 07:34:36 +02:00
Tom Wojcik b2f7b53fac [3.2.x] Fixed #32947 -- Fixed hash() crash on reverse M2M relation when through_fields is a list.
Regression in c32d8f33d8.

Backport of 20226fcd46 from main
2021-07-26 06:41:31 +02:00
yakimka 1346381760 [3.2.x] Fixed #32949 -- Restored invalid number handling in DecimalField.validate().
DecimalField must itself validate() values, such as NaN, which cannot be
passed to validators, such as MaxValueValidator, during the
run_validators() phase.

Regression in cc3d24d7d5.

Backport of c542d0a072 from main
2021-07-21 11:23:43 +02:00
Simon Charette a34a5f724c [3.2.x] Fixed CVE-2021-35042 -- Prevented SQL injection in QuerySet.order_by().
Regression introduced in 513948735b
by marking the raw SQL column reference feature for deprecation in
Django 4.0 while lifting the column format validation.

In retrospective the validation should have been kept around and the
user should have been pointed at using RawSQL expressions during the
deprecation period.

The main branch is not affected because the raw SQL column reference
support has been removed in 06eec31970
per the 4.0 deprecation life cycle.

Thanks Joel Saunders for the report.
2021-07-01 08:29:23 +02:00
Hasan Ramezani 8b2b627f34 [3.2.x] Fixed #32863 -- Skipped system check for specifying type of auto-created primary keys on models with invalid app_label.
Regression in b5e12d490a.

Thanks Iuri de Silvio for the report.

Backport of 7a9745fed4 from main
2021-06-22 21:19:47 +02:00
Mariusz Felisiak 826a1659ee [3.2.x] Fixed #32832 -- Fixed adding BLOB/TEXT nullable field with default on MySQL 8.0.13+.
Regression in d4ac23bee1.

Thanks Omkar Deshpande for the report.

Backport of fa0433d05f from main
2021-06-10 20:05:55 +02:00
Yuekui Li 57146ba388 [3.2.x] Fixed #32503 -- Fixed altering BLOB/TEXT field to non-nullable with default on MySQL 8.0.13+.
MySQL 8.0.13+ supports defaults for BLOB/TEXT but not in the
ALTER COLUMN statement.

Regression in 6b16c91157.

Thanks Matt Westcott for the report.

Backport of 5e04e84d67 from main
2021-06-10 20:01:38 +02:00
Takayuki Hirayama 8ec5b7403d [3.2.x] Fixed #32812 -- Restored immutability of named values from QuerySet.values_list().
Regression in 981a072dd4.

Thanks pirelle for the report.

Backport of 0393b9262d from main
2021-06-04 08:27:25 +02:00
Mariusz Felisiak 9f75e2e562 [3.2.x] Fixed CVE-2021-33571 -- Prevented leading zeros in IPv4 addresses.
validate_ipv4_address() was affected only on Python < 3.9.5, see [1].
URLValidator() uses a regular expressions and it was affected on all
Python versions.

[1] https://bugs.python.org/issue36384
2021-06-02 10:44:39 +02:00
Florian Apolloner dfaba12cda [3.2.x] Fixed CVE-2021-33203 -- Fixed potential path-traversal via admindocs' TemplateDetailView. 2021-06-02 10:44:39 +02:00
Mariusz Felisiak 94675a7633 [3.2.x] Fixed #32793 -- Fixed loss of precision for temporal operations with DecimalFields on MySQL.
Regression in 1e38f1191d.

Thanks Mohsen Tamiz for the report.
Backport of e703b152c6 from main
2021-06-01 15:13:10 +02:00
Mariusz Felisiak 246a31a843 [3.2.x] Fixed #32783 -- Fixed crash of autoreloader when __main__ module doesn't have __spec__ attribute.
Regression in ec6d2531c5.

Thanks JonathanNickelson for the report.
Backport of 12b19a1d76 from main
2021-05-26 11:20:05 +02:00
Hasan Ramezani c0d506f5ef [3.2.x] Fixed #32744 -- Normalized to pathlib.Path in autoreloader check for template changes.
Backport of 68357b2ca9 from main
2021-05-26 10:08:58 +02:00
Mariusz Felisiak 41e2aa7eb2 [3.2.x] Fixed #32747 -- Prevented initialization of unused caches.
Thanks Alexander Ebral for the report.

Regression in 98e05ccde4.

Backport of 958cdf65ae from main
2021-05-18 20:23:26 +02:00
Rust Saiargaliev 349bb58b8a [3.2.x] Fixed #32733 -- Skipped system check for specifying type of auto-created primary keys on abstract models.
Regression in b5e12d490a.

Backport of a24fed399c from main
2021-05-18 13:20:55 +02:00
Slava Skvortsov ce78bc9808 [3.2.x] Fixed #32754 -- Made AdminSite.catch_all_view() respect SCRIPT_NAME.
Regression in ba31b01034.

Backport of f7691d4812 from main
2021-05-18 09:58:49 +02:00
Mariusz Felisiak 224b8e5a5a [3.2.x] Fixed #32718 -- Relaxed file name validation in FileField.
- Validate filename returned by FileField.upload_to() not a filename
  passed to the FileField.generate_filename() (upload_to() may
  completely ignored passed filename).
- Allow relative paths (without dot segments) in the generated filename.

Thanks to Jakub Kleň for the report and review.
Thanks to all folks for checking this patch on existing projects.
Thanks Florian Apolloner and Markus Holtermann for the discussion and
implementation idea.

Regression in 0b79eb3691.
Backport of b55699968f from main
2021-05-13 08:55:00 +02:00
Simon Charette 386caa5445 [3.2.x] Fixed #32717 -- Fixed filtering of querysets combined with the | operator.
Address a long standing bug in a Where.add optimization to discard
equal nodes that was surfaced by implementing equality for Lookup
instances in bbf141bcdc.

Thanks Shaheed Haque for the report.

Backport of b81c7562fc from main
2021-05-13 07:53:56 +02:00
Nick Pope 4318e60a80 [3.2.x] Fixed #32732 -- Removed usage of deprecated 'db' and 'passwd' connection options in MySQL backend.
The 'db' and 'passwd' connection options have been deprecated, use
'database' and 'password' instead (available since mysqlclient >= 1.3.8).

This also allows the 'database' option in DATABASES['OPTIONS'] on MySQL.

Backport of 1061f52436 from main
2021-05-12 13:35:13 +02:00
Mariusz Felisiak 2d2c1d0c97 [3.2.x] Fixed #32713, Fixed CVE-2021-32052 -- Prevented newlines and tabs from being accepted in URLValidator on Python 3.9.5+.
In Python 3.9.5+ urllib.parse() automatically removes ASCII newlines
and tabs from URLs [1, 2]. Unfortunately it created an issue in
the URLValidator. URLValidator uses urllib.urlsplit() and
urllib.urlunsplit() for creating a URL variant with Punycode which no
longer contains newlines and tabs in Python 3.9.5+. As a consequence,
the regular expression matched the URL (without unsafe characters) and
the source value (with unsafe characters) was considered valid.

[1] https://bugs.python.org/issue43882 and
[2] 76cd81d603

Backport of e1e81aa1c4 from main.
2021-05-06 08:48:22 +02:00
Carlton Gibson a937d7f214 [3.2.x] Refs CVE-2021-31542 -- Skipped mock AWS storage test on Windows.
The validate_file_name() sanitation introduced in
0b79eb3691 correctly rejects the example
file name as containing path elements on Windows. This breaks the test
introduced in 914c72be2a to allow path
components for storages that may allow them.

Test is skipped pending a discussed storage refactoring to support this
use-case.

Backport of a708f39ce6 from main
2021-05-06 07:42:21 +02:00
Simon Charette 364098fdac [3.2.x] Fixed #32714 -- Prevented recreation of migration for Meta.ordering with OrderBy expressions.
Regression in c8b6594305.

Thanks Kevin Marsh for the report.

Backport of 96f55ccf79 from main
2021-05-05 08:44:37 +02:00
Florian Apolloner c98f446c18 [3.2.x] Fixed CVE-2021-31542 -- Tightened path & file name sanitation in file uploads. 2021-05-04 08:43:52 +02:00
Simon Charette d5add5d3a2 [3.2.x] Fixed #32632, Fixed #32657 -- Removed flawed support for Subquery deconstruction.
Subquery deconstruction support required implementing complex and
expensive equality rules for sql.Query objects for little benefit as
the latter cannot themselves be made deconstructible to their reference
to model classes.

Making Expression @deconstructible and not BaseExpression allows
interested parties to conform to the "expression" API even if they are
not deconstructible as it's only a requirement for expressions allowed
in Model fields and meta options (e.g. constraints, indexes).

Thanks Phillip Cutter for the report.

This also fixes a performance regression in bbf141bcdc.

Backport of c8b6594305 from main
2021-04-28 20:27:42 +02:00
Konstantin Alekseev 55cb3c8ac1 [3.2.x] Fixed #32687 -- Restored passing process’ environment to underlying tool in dbshell on PostgreSQL.
Regression in bbe6fbb876.

Backport of 6e742dabc9 from main.
2021-04-27 12:02:06 +02:00
Mariusz Felisiak 34981f399a [3.2.x] Fixed #32682 -- Made admin changelist use Exists() instead of distinct() for preventing duplicates.
Thanks Zain Patel for the report and Simon Charette for reviews.

The exception introduced in 6307c3f1a1
revealed a possible data loss issue in the admin.

Backport of 1871182031 from main
2021-04-27 10:39:55 +02:00
Mariusz Felisiak fbea64b8ce [3.2.x] Refs #32682 -- Renamed use_distinct variable to may_have_duplicates.
QuerySet.distinct() is not the only way to avoid duplicate, it's also
not preferred.

Backport of cd74aad90e from main
2021-04-27 10:37:13 +02:00
Mariusz Felisiak 7ad7034054 [3.2.x] Refs #32682 -- Fixed QuerySet.delete() crash on querysets with self-referential subqueries on MySQL.
Backport of 4074f38e1d from main
2021-04-27 10:35:42 +02:00
Mariusz Felisiak 727a154094 [3.2.x] Refs 32637 -- Made technical 404 debug page display exception message when URL is resolved.
Follow up to 3b8527e32b.
Backport of d68be0494b from main
2021-04-27 08:41:11 +02:00
Zain Patel 0dfe88eaba [3.2.x] Fixed #32681 -- Fixed VariableDoesNotExist when rendering some admin template.
Regression in 84609b3205.

Backport of 4e5bbb6ef2 from main.
2021-04-26 12:52:33 +02:00
Mariusz Felisiak 1cf0989b06 [3.2.x] Used assertCountEqual() in ExcludeTests.test_exclude_subquery().
Backport of c3278bb71f from main
2021-04-22 14:42:47 +02:00
Simon Charette 48e19bae49 [3.2.x] Fixed #32650 -- Fixed handling subquery aliasing on queryset combination.
This issue started manifesting itself when nesting a combined subquery
relying on exclude() since 8593e162c9 but
sql.Query.combine never properly handled subqueries outer refs in the
first place, see QuerySetBitwiseOperationTests.test_subquery_aliases()
(refs #27149).

Thanks Raffaele Salmaso for the report.

Backport of 6d0cbe42c3 from main
2021-04-21 10:32:39 +02:00