0
0
mirror of https://github.com/django/django.git synced 2024-12-01 15:42:04 +01:00
Commit Graph

7588 Commits

Author SHA1 Message Date
Tim Graham
baf2542c4f Fixed DoS possibility in ModelMultipleChoiceField.
This is a security fix. Disclosure following shortly.

Thanks Keryn Knight for the report and initial patch.
2015-01-13 13:03:06 -05:00
Tim Graham
a3bebfdc34 Ensured views.static.serve() doesn't use large memory on large files.
This issue was fixed in master by refs #24072.
2015-01-13 13:03:06 -05:00
Tim Graham
69b5e66738 Fixed is_safe_url() to handle leading whitespace.
This is a security fix. Disclosure following shortly.
2015-01-13 13:03:06 -05:00
Carl Meyer
316b8d4974 Stripped headers containing underscores to prevent spoofing in WSGI environ.
This is a security fix. Disclosure following shortly.

Thanks to Jedediah Smith for the report.
2015-01-13 13:03:05 -05:00
Tim Graham
958aeda4b5 Added stub release notes for security releases. 2015-01-13 13:03:05 -05:00
Collin Anderson
e7771ec380 Fixed bad model example in admin docs. 2015-01-13 11:53:03 -05:00
Michał Modzelewski
65246de7b1 Fixed #24031 -- Added CASE expressions to the ORM. 2015-01-12 18:15:34 -05:00
Tim Graham
5d7217dce3 Fixed typo in docs/release/1.8.txt & added word for spelling check. 2015-01-12 17:53:32 -05:00
Josh Smeaton
21b858cb67 Fixed #24060 -- Added OrderBy Expressions 2015-01-13 09:39:55 +11:00
Claude Paroz
f48e2258a9 Fixed #24133 -- Replaced formatting syntax in success_url placeholders
Thanks Laurent Payot for the report, and Markus Holtermann, Tim Graham
for the reviews.
2015-01-12 22:51:22 +01:00
Aymeric Augustin
79deb6a071 Accounted for multiple template engines in template responses. 2015-01-12 21:01:34 +01:00
Aymeric Augustin
a3e783fe11 Deprecated passing a Context to a generic Template.render.
A deprecation path is required because the return type of
django.template.loader.get_template changed during the
multiple template engines refactor.

test_csrf_token_in_404 was incorrect: it tested the case when the
hardcoded template was rendered, and that template doesn't depend on the
CSRF token. This commit makes it test the case when a custom template is
rendered.
2015-01-12 21:01:34 +01:00
Collin Anderson
26a92619f6 Fixed #24124 -- Changed context_processors in the default settings.py 2015-01-12 13:17:44 -05:00
Ng Zhi An
8f5d6c77b6 Fixed #23878 -- Moved Query and Prefetch documentation 2015-01-12 11:35:20 -05:00
Pavel Shpilev
a7c256cb54 Fixed #9893 -- Allowed using a field's max_length in the Storage. 2015-01-12 09:09:18 -05:00
Marc Tamlyn
b5c1a85b50 Fixed #24118 -- Added --debug-sql option for tests.
Added a --debug-sql option for tests and runtests.py which outputs the
SQL logger for failing tests. When combined with --verbosity=2, it also
outputs the SQL for passing tests.

Thanks to Berker, Tim, Markus, Shai, Josh and Anssi for review and
discussion.
2015-01-12 08:16:08 +00:00
Ola Sitarska
d563e3be68 Fixed #23913 -- Deprecated the = comparison in if template tag. 2015-01-11 15:21:01 -05:00
Tim Graham
28de5cd4de Fixed spelling errors in docs. 2015-01-11 13:24:13 -05:00
Markus Holtermann
be158e3625 Refs #24110 -- Added a more descriptive release note and fixed a spelling mistake. 2015-01-11 00:30:47 +01:00
Markus Holtermann
fdc2cc9487 Fixed #24110 -- Rewrote migration unapply to preserve intermediate states 2015-01-10 23:14:15 +01:00
Aymeric Augustin
d89019a84d Improved template ugrading docs.
Recommending Template(template_code) was dumb. Described alternatives.
2015-01-10 21:11:58 +01:00
Aymeric Augustin
f01306a6d8 Updated templates API reference.
Accounted for multiple template engines and made a few small fixes.
2015-01-10 20:17:22 +01:00
Aymeric Augustin
4797af2bb8 Updated custom template tags how-to.
Accounted for multiple template engines and made a few small fixes.
2015-01-10 20:17:22 +01:00
Aymeric Augustin
3d495cfd77 Added release notes and upgrade instructions for templates. 2015-01-10 20:17:20 +01:00
Aymeric Augustin
ee8d5b91e9 Wrote main documentation for templates. 2015-01-10 20:16:19 +01:00
Aymeric Augustin
6c392bb2c0 Moved doc on the DTL's syntax to the ref/ section.
This makes room for a more general introduction about templating.

Updated some links to point to the new location, but kept those that
didn't talk specifically about the DTL.
2015-01-10 19:41:14 +01:00
Simon Charette
07988744b3 Fixed #13165 -- Added edit and delete links to admin foreign key widgets.
Thanks to Collin Anderson for the review and suggestions and Tim for the
final review.
2015-01-10 12:24:52 -05:00
Marc Tamlyn
48ad288679 Fixed #24001 -- Added range fields for PostgreSQL.
Added support for PostgreSQL range types to contrib.postgres.

- 5 new model fields
- 4 new form fields
- New validators
- Uses psycopg2's range type implementation in python
2015-01-10 16:18:19 +00:00
Serafeim Papastefanos
74f02557e0 Fixed #23967 -- Added formats for Greek 2015-01-10 11:10:26 -05:00
Claude Paroz
d7bc37d611 Fixed #24097 -- Prevented AttributeError in redirect_to_login
Thanks Peter Schmidt for the report and the initial patch.
Thanks to ​Oktay Sancak for writing the original failing test and
Alvin Savoy for supporting contributing back to the community.
2015-01-10 10:05:02 +01:00
Josh Smeaton
f5c3a8bff5 Added Josh Smeaton bio to team 2015-01-10 13:48:37 +11:00
Markus Holtermann
e174cce9dc Added my bio to the core team. 2015-01-10 00:53:09 +01:00
Tim Graham
7102b99653 Added best practices for versionadded/changed annotations. 2015-01-09 13:23:29 -05:00
Loic Bistuer
8f4877c89d Fixed #22583 -- Allowed RunPython and RunSQL to provide hints to the db router.
Thanks Markus Holtermann and Tim Graham for the review.
2015-01-10 00:30:48 +07:00
Markus Holtermann
c8bac4b556 Fixed #24098 -- Added no-op attributes to RunPython and RunSQL
Thanks Loïc Bistuer and Tim Graham for the discussion and review.
2015-01-09 10:31:32 -05:00
Tim Graham
67d6a8c4e6 Fixed #24108 -- Updated Wilson's bio due to new Django Project Web site design. 2015-01-09 10:25:57 -05:00
Thomas Chaumeny
8fb7a0987c Fixed a typo in 1.8 release notes. 2015-01-09 07:38:11 -05:00
Sylvain Fankhauser
c1493879d9 Fixed a typo in 1.8 release notes. 2015-01-08 16:02:18 -05:00
Tim Graham
13e4156518 Fixed a typo in 1.8 release notes. 2015-01-08 15:12:40 -05:00
Anssi Kääriäinen
0c7633178f Fixed #24020 -- Refactored SQL compiler to use expressions
Refactored compiler SELECT, GROUP BY and ORDER BY generation.
While there, also refactored select_related() implementation
(get_cached_row() and get_klass_info() are now gone!).

Made get_db_converters() method work on expressions instead of
internal_type. This allows the backend converters to target
specific expressions if need be.

Added query.context, this can be used to set per-query state.

Also changed the signature of database converters. They now accept
context as an argument.
2015-01-08 14:07:54 -05:00
Claude Paroz
543df07720 Fixed #24073 -- Returned None for get_language when translations are deactivated
This fixes a regression caused by f7c287fca9. Thanks Markus Holtermann
for identifying the regression.
2015-01-08 17:43:07 +01:00
Aymeric Augustin
eaa1a22341 Added a request argument to render_to_string.
This is for consistency with Template.render.

It adds a little bit of knowledge about HTTP requests in
django.template.loader but I think consistency trumps purity.
2015-01-07 21:54:22 +01:00
Claude Paroz
f7c287fca9 Fixed #24073 -- Deactivated translations when leave_locale_alone is False
Thanks Tim Graham and Markus Holtermann for the reviews.
2015-01-07 20:11:24 +01:00
Claude Paroz
2c0f64b5f6 Updated migration docs to match changes from a159b1fac 2015-01-07 20:10:30 +01:00
Josh Smeaton
5a4ac4ead9 Fixed #24078 -- Removed empty strings from GenericIPAddressField 2015-01-07 08:08:36 -05:00
Tim Graham
9b057b51ce Added 'loopback' to spelling word list. 2015-01-06 20:02:03 -05:00
Daniel Pyrathon
fb48eb0581 Fixed #12663 -- Formalized the Model._meta API for retrieving fields.
Thanks to Russell Keith-Magee for mentoring this Google Summer of
Code 2014 project and everyone else who helped with the patch!
2015-01-06 19:25:12 -05:00
Danilo Bargen
2e65d56156 Fixed #20003 -- Improved and extended URLValidator
This adds support for authentication data (`user:password`) in URLs,
IPv6 addresses, and unicode domains.

The test suite has been improved by adding test URLs from
http://mathiasbynens.be/demo/url-regex (with a few adjustments,
like allowing local and reserved IPs).

The previous URL validation regex failed this test suite on 13
occasions, the validator was updated based on
https://gist.github.com/dperini/729294.
2015-01-06 14:04:25 -05:00
Tim Graham
6288fccfda Updated release instructions with latest process. 2015-01-06 13:51:19 -05:00
Claude Paroz
e0080cf577 Fixed #24083 -- Corrected is_bound nature in forms topic docs
Thanks ajenhl Trac user for the report.
2015-01-06 08:56:53 +01:00