Commit Graph

4423 Commits

Author SHA1 Message Date
Erik Romijn 50a289d05f [1.6.x] Fixed #22579 -- Corrected validation for email to reject trailing slash
Backport of 424fe76349 from master.
2014-05-16 15:40:52 +02:00
Erik Romijn 6011075245 [1.6.x] Added additional checks in is_safe_url to account for flexible parsing.
This is a security fix. Disclosure following shortly.
2014-05-14 10:15:06 +02:00
Aymeric Augustin 1abcf3a808 [1.6.x] Dropped fix_IE_for_vary/attach.
This is a security fix. Disclosure following shortly.
2014-05-14 10:15:06 +02:00
Aymeric Augustin b6d3212190 [1.6.x] Fixed #22508 -- Avoided overwriting select_related.
Previously, known related objects overwrote related objects loaded
though select_related. This could cancel the effect of select_related
when it was used over more than one level.

Thanks boxm for the bug report and timo for bisecting the regression.

Conflicts:
	tests/select_related_regress/tests.py

Backport of f574220f from master
2014-05-10 17:05:09 +02:00
Anssi Kääriäinen 0e37049636 [1.6.x] Fixed #22429 -- Incorrect SQL when using ~Q and F
Backpatch of 5e1f4656b9 from master.

Conflicts:
	django/db/models/sql/query.py
	tests/queries/models.py
	tests/queries/tests.py
2014-05-05 13:27:54 +03:00
Claude Paroz 034866204b [1.6.x] Fixed #22565 -- Prevented pgettext_lazy crash with bytestring input
Thanks ygbo for the report.
Backport of 142c27218 from master.
2014-05-02 19:38:46 +02:00
Tim Graham 6915220ff9 [1.6.x] Fixed #22486 -- Restored the ability to reverse views created using functools.partial.
Regression in 8b93b31487.

Thanks rcoup for the report.

Backport of 3c06b2f2a3 from master
2014-04-23 08:56:13 -04:00
Erik Romijn 5f0829a27e [1.6.x] Fixed queries that may return unexpected results on MySQL due to typecasting.
This is a security fix. Disclosure will follow shortly.

Backport of 75c0d4ea3a from master
2014-04-21 18:30:27 -04:00
Aymeric Augustin d63e20942f [1.6.x] Prevented leaking the CSRF token through caching.
This is a security fix. Disclosure will follow shortly.

Backport of c083e3815a from master
2014-04-21 18:30:27 -04:00
Tim Graham 4352a50871 [1.6.x] Fixed a remote code execution vulnerabilty in URL reversing.
Thanks Benjamin Bach for the report and initial patch.

This is a security fix; disclosure to follow shortly.

Backport of 8b93b31487 from master
2014-04-21 18:30:27 -04:00
valtron 1252b77824 [1.6.x] Fixed #21760 -- prefetch_related used an inefficient query for reverse FK.
Regression introduced by commit 9777442. Refs #21410.

Conflicts:
	tests/prefetch_related/tests.py

Backport of d3b71b976d from master
2014-04-13 01:06:03 +07:00
Aymeric Augustin 1d3d2b9a24 [1.6.x] Fixed #21202 -- Maintained atomicity when the server disconnects.
Thanks intgr for the report.

This commit doesn't include a test because I don't know how to emulate a
database disconnection in a cross-database compatible way.

Also simplified a 'backends' test that was constrained by this problem.

Backport of 81761508 from master
2014-04-10 23:22:13 +02:00
Aymeric Augustin 4ea02bdb0d [1.6.x] Fixed #21239 -- Maintained atomicity when closing the connection.
Refs #15802 -- Reverted #7c657b24 as BaseDatabaseWrapper.close() now
has a proper "finally" clause that may need to preserve self.connection.

Backport of 25860096 from master.
2014-04-10 23:22:13 +02:00
Aymeric Augustin 9afedbef42 [1.6.x] Fixed #22291 -- Avoided shadowing deadlock exceptions on MySQL.
Thanks err for the report.

Backport of 58161e4e from master.
2014-04-10 23:05:09 +02:00
Aymeric Augustin e68c084ed1 Fixed a broken test introduced in 6fa7d7c5. Refs #21553.
Thanks Shai.
2014-04-10 07:51:04 +02:00
Shai Berger 690a5984a3 [1.6.x] Fixed #22343 -- Disallowed select_for_update in autocommit mode
The ticket was originally about two failing tests, which are
fixed by putting their queries in transactions.

Thanks Tim Graham for the report, Aymeric Augustin for the fix,
and Simon Charette, Tim Graham & Loïc Bistuer for review.

Backport of b990df1d63 from master
2014-04-10 02:15:14 +03:00
Aymeric Augustin 6fa7d7c594 [1.6.x] Fixed #21553 -- Ensured unusable database connections get closed.
Backport of 5f2f47f from master
2014-04-09 22:54:39 +02:00
Patrick Michaud 73474df954 Fixed #22256 -- Replaced bad fallback for missing PATH
Thanks Baptiste Mispelon for the review.
Backport of acee46fc9 from master.
2014-04-01 20:45:12 +02:00
Loic Bistuer 07e2a56814 [1.6.x] Fixed #22360 -- Fixed two non-deterministic tests in Python 3.4.
The order of admin's changelist filters in the querystring relied on
dict ordering.

Backport of 4d996b8e69 from master
2014-03-31 08:24:12 -04:00
Loic Bistuer a5297c1ef4 [1.6.x] Fixed #21795 -- Made add_preserved_filters account for url prefixes.
Thanks to trac username honyczek for the report. Refs #6903.

Backport of 4339e9a92d from master
2014-03-31 07:29:08 -04:00
Tim Graham 059bc7eb60 [1.6.x] Fixed #22338 -- Fixed a test dependent on dictionary key iteration order.
Backport of 69a4f383f6 from master
2014-03-30 14:27:11 -04:00
Claude Paroz c9b2feffee [1.6.x] Tweaked strip_tags tests to pass on Python 3.3
Backport of 6a0291bda from master.
2014-03-22 15:05:28 +01:00
Claude Paroz f05f5c231a [1.6.x] Removed a strip_tags test for older Python versions
Django's custom HTMLParser for older Python versions cannot
parse convoluted syntax.
2014-03-22 14:21:35 +01:00
Claude Paroz d1503afd66 [1.6.x] Improved strip_tags and clarified documentation
The fact that strip_tags cannot guarantee to really strip all
non-safe HTML content was not clear enough. Also see:
https://www.djangoproject.com/weblog/2014/mar/22/strip-tags-advisory/
Backport of 6ca6c36f8 from master.
2014-03-22 11:07:27 +01:00
Claude Paroz 1a2939bc26 [1.6.x] Fixed #22245 -- Avoided widget overwrite in forms.IntegerField subclasses
Thanks Jeroen Pulles for the report and Simon Charette for the review.
Backport of 5a976b4bec from master.
2014-03-13 16:59:23 +01:00
Alexey Voronov 5cda1d2702 [1.6.x] Fixed #21643 -- repeated execution of qs with F() + timedelta
Thanks Tim Graham for review and Tai Lee for the additional test to prove
this was a regression in 1.6.

Backport of 7f2485b4d1 and 8137215973 from master
2014-02-28 20:49:13 -05:00
Baptiste Mispelon 12da6902e9 [1.6.x] Fixed #22107 -- Fixed django.core.files.File object iteration.
Due to a mixup between text and bytes, iteration over
a File instance was broken under Python 3.

Thanks to trac user pdewacht for the report and patch.

Backport of 3841feee86 from master.
2014-02-20 23:59:51 +01:00
Roger Hu 9a446211bd [1.6.x] Fixed #21566 -- Fixed AttributeError when using bulk_create with ForeignObject.
Backport of bbc73e6a12 from master.
2014-02-14 20:57:32 -05:00
Tim Graham 32a880ae95 [1.6.x] Added a missing import in staticfiles tests. 2014-02-13 08:03:43 -05:00
Loic Bistuer d6db48e5f6 [1.6.x] Reworked the detection of local storages for the collectstatic command.
Before 4befb30 the detection was broken because we used isinstance
against a LazyObject rather than against a Storage class. That commit
fixed it by looking directly at the object wrapped by LazyObject.
This could however be a problem to anyone who subclasses the
collectstatic management Command and directly supplies a Storage class.

Refs #21581.

Backport of 7e27885c6e from master.
2014-02-12 11:05:07 -05:00
Baptiste Mispelon 8864d24789 [1.6.x] Revert "Fixed #20296 -- Allowed SafeData and EscapeData to be lazy"
This reverts commit 2ee447fb5f.

That commit introduced a regression (#21882) and didn't really
do what it was supposed to: while it did delay the evaluation
of lazy objects passed to mark_safe(), they weren't actually
marked as such so they could end up being escaped twice.

Refs #21882.

Backport of a878bf9b09 from master.
2014-02-05 21:32:17 +01:00
Anssi Kääriäinen fd3fa851b5 [1.6.x] Fixed #21748 -- join promotion for negated AND conditions
Made sure Django treats case .filter(NOT (a AND b)) the same way as
.filter((NOT a OR NOT b)) for join promotion.

Heavily modified backpatch of 35cecb1ebd
from master.

Conflicts:

	django/db/models/sql/query.py
	tests/queries/tests.py
2014-02-04 19:06:37 +02:00
Anssi Kääriäinen 0f272629ca [1.6.x] Fixed #21413 -- resolve_columns fields misalignment
Backpatch of 9918c11114 from master.

Conflicts:

	django/db/models/sql/compiler.py
	tests/model_inheritance_regress/tests.py
2014-02-04 15:21:13 +02:00
Shai Berger 5f42c02195 [1.6.x] Made Oracle introspect FloatFields correctly
Broke InspectDBTestCase.test_field_types in two:
- a test_number_field_types, which now passes on Oracle too
- a test_field_types, for all non-numeric fields, which is still expected to fail

Also made some pep8 fixes in the tests file. Refs #19884

Thanks Tim Graham for review.

Backport of e9d12ba from master
2014-01-30 01:26:42 +02:00
Anssi Kääriäinen e47b90e48f [1.6.x] Fixed #21787 -- regression in MTI .exclude() queries
Backpatch of 78a2617703 from master.
2014-01-24 10:18:57 +02:00
Aymeric Augustin 18d75e0792 [1.6.x] Fixed a test that was failing with PostGIS.
Fixed #21452 again.
2014-01-12 21:39:36 +01:00
Aymeric Augustin cb4a000adb [1.6.x] Fixed #21452 -- Non-autocommit connections to PostgreSQL.
When settings.DATABASES['default']['AUTOCOMMIT'] = False, the connection
wasn't in autocommit mode but Django pretended it was.

Thanks Anssi for analysing this issue.

Refs #17062.

Backport of 1afe7488 from master
2014-01-12 18:47:03 +01:00
Aymeric Augustin b79bf9c7a9 [1.6.x] Fixed a test isolation issue. Refs #17062.
This test could change settings.DATABASES['default']['TIME_ZONE'] and
didn't restore the previous value.

Backport of 1c24096f from master.
2014-01-12 18:45:45 +01:00
Florian Apolloner 865723f267 [1.6.x] Fixed set literals for python 2.6 2014-01-01 15:56:42 +01:00
Loic Bistuer 3fd16e6261 [1.6.x] Fixed #21581 -- Fixed a number of issues with collectstatic.
When STATIC_ROOT wasn't set, collectstatic --clear would delete
every files within the current directory and its descendants.

This patch makes the following changes:

Prevent collectstatic from running if STATIC_ROOT isn't set.

Fixed an issue that prevented collectstatic from displaying the
destination directory.

Changed the warning header to notify when the command is run
in dry-run mode.

Backport of 4befb3015c from master
2013-12-31 15:04:22 -05:00
Florian Apolloner d18f99dfc7 [1.6.x] Changed console and filebackend to use msg.as_bytes to output the data as it would get send via smtp.
Backport of c988745cca from master.
2013-12-31 12:09:52 +01:00
Florian Apolloner 7c674dd1f1 [1.6.x] Introduced as_bytes for SafeMIMEText (and other SafeMIME-classes).
This is to provide a consistent interface (namely bytes) for the smtp
backend which after all sends bytes over the wire; encoding with as_string
yields different results since mails as unicode are not really specified.

as_string stays for backwardscompatibilty mostly and some debug outputs.
But keep in mind that the output doesn't match as_bytes!

Backport of 5dfd824d38 from master.
2013-12-31 12:05:59 +01:00
Florian Apolloner ed167e53a5 [1.6.x] Worked around a bug in python 3.3.3. Refs #21093
Backport of 280c1a65cc from master.
2013-12-28 16:01:40 +01:00
Ludwik Trammer c558a43fd6 [1.6.x] Fixed #21473 -- Limited language preservation to logout
Current language is no longer saved to session by LocaleMiddleware
on  every response (the behavior introduced in #14825).
Instead language stored in session is reintroduced into new session
after logout.
2013-12-11 15:49:27 +01:00
Claude Paroz d32637d81b [1.6.x] Fixed #21510 -- Readded search reset link in changelist search bar
Thanks moritz.pfeiffer at alp-phone.ch for the report and
Tim Graham for the initial patch.
Backport of c7c647419c from master.
2013-12-11 15:32:10 +01:00
Claude Paroz 45c0d2e1ce [1.6.x] Fixed #21551 -- Reenabled loading fixtures from subdirectory
This was a regression in Django 1.6 that was only partially
restored in 839940f27f.
Thanks Jonas Haag for the report.
Backport of 41ebc4838d from master.
2013-12-07 10:48:34 +01:00
Claude Paroz 34c4b93c84 [1.6.x] Fixed #21568 -- Added missing ModelMultipleChoiceField to_python method
Thanks dibrovsd at gmail.com for the report and Simon Charette
for the review.
Backport of 8a9c8bb90 from master.
2013-12-07 10:21:05 +01:00
Baptiste Mispelon 5a4884a978 [1.6.x] Fixed #21530 -- Prevent AttributeError in default URLconf detection code.
Thanks to @dmyerscoug for the report and original patch
and to @alasdairnicol for the added tests.

Backport of a020dd0a99 from master.
2013-12-07 03:30:07 +01:00
Alasdair Nicol 87433c30c7 [1.6.x] Fixed #21538 -- Added numpy to test/requirements/base.txt
Thanks Tim Graham for the report

Backport of c75dd664cf from master
2013-12-02 13:38:46 -05:00
Tim Graham adb8c563ed [1.6.x] Fixed incorrect type for max_length.
Backport of 3b60ffa334 from master
2013-12-01 14:26:42 -05:00