summaryrefslogtreecommitdiff
path: root/www/py-django
AgeCommit message (Collapse)AuthorFilesLines
2017-12-04py-django: updated to 1.11.8adam3-8/+11
Django 1.11.8 fixes several bugs in 1.11.7: * Reallowed, following a regression in Django 1.10, AuthenticationForm to raise the inactive user error when using ModelBackend. * Added support for QuerySet.values() and values_list() for union(), difference(), and intersection() queries. * Fixed incorrect index name truncation when using a namespaced db_table. * Made QuerySet.iterator() use server-side cursors on PostgreSQL after values() and values_list(). * Fixed crash on SQLite and MySQL when ordering by a filtered subquery that uses nulls_first or nulls_last. * Made query lookups for CICharField, CIEmailField, and CITextField use a citext cast. * Fixed a regression in caching of a GenericForeignKey when the referenced model instance uses multi-table inheritance. * Fixed “Cannot change column ‘x’: used in a foreign key constraint” crash on MySQL with a sequence of AlterField and/or RenameField operations in a migration
2017-11-02py-django: updated to 1.11.7adam2-7/+7
1.11.7: Bugfixes * Prevented cache.get_or_set() from caching None if the default argument is a callable that returns None. * Fixed the Basque DATE_FORMAT string. * Made QuerySet.reverse() affect nulls_first and nulls_last. * Fixed unquoted table names in Subquery SQL when using OuterRef
2017-10-06py-django: update to 1.11.6adam2-7/+7
Bugfixes: * Made the CharField form field convert whitespace-only values to the empty_value when strip is enabled. * Fixed crash when using the name of a model’s autogenerated primary key (id) in an Index’s fields. * Fixed a regression in Django 1.9 where a custom view error handler such as handler404 that accesses csrf_token could cause CSRF verification failures on other pages
2017-09-06Django 1.11.5:adam2-7/+7
CVE-2017-12794: Possible XSS in traceback section of technical 500 debug page¶ In older versions, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn’t affect most production sites since you shouldn’t run with DEBUG = True (which makes this page accessible) in your production settings. Bugfixes: Fixed GEOS version parsing if the version has a commit hash at the end (new in GEOS 3.6.2). Added compatibility for cx_Oracle 6. Fixed select widget rendering when option values are tuples. Django 1.11 inadvertently changed the sequence and trigger naming scheme on Oracle. This causes errors on INSERTs for some tables if 'use_returning_into': False is in the OPTIONS part of DATABASES. The pre-1.11 naming scheme is now restored. Unfortunately, it necessarily requires an update to Oracle tables created with Django 1.11.[1-4]. Use the upgrade script in 28451 comment 8 to update sequence and trigger names to use the pre-1.11 naming scheme. Added POST request support to LogoutView, for equivalence with the function-based logout() view. Omitted pages_per_range from BrinIndex.deconstruct() if it’s None. Fixed a regression where SelectDateWidget localized the years in the select box. Fixed a regression in 1.11.4 where runserver crashed with non-Unicode system encodings on Python 2 + Windows. Fixed a regression in Django 1.10 where changes to a ManyToManyField weren’t logged in the admin change history and prevented ManyToManyField initial data in model forms from being affected by subsequent model changes. Fixed non-deterministic results or an AssertionError crash in some queries with multiple joins. Fixed a regression in contrib.auth’s login() and logout() views where they ignored positional arguments
2017-09-04Follow some redirects.wiz1-3/+3
2017-08-02Django 1.11.4:adam2-11/+10
Bugfixes: Fixed a regression in 1.11.3 on Python 2 where non-ASCII format values for date/time widgets results in an empty value in the widget’s HTML. Fixed QuerySet.union() and difference() when combining with a queryset raising EmptyResultSet. Fixed a regression in pickling of LazyObject on Python 2 when the wrapped object doesn’t have __reduce__(). Fixed crash in runserver’s autoreload with Python 2 on Windows with non-str environment variables. Corrected Field.has_changed() to return False for disabled form fields: BooleanField, MultipleChoiceField, MultiValueField, FileField, ModelChoiceField, and ModelMultipleChoiceField. Fixed QuerySet.count() for union(), difference(), and intersection() queries.. Fixed ClearableFileInput rendering as a subwidget of MultiWidget. Custom clearable_file_input.html widget templates will need to adapt for the fact that context values checkbox_name, checkbox_id, is_initial, input_text, initial_text, and clear_checkbox_label are now attributes of widget rather than appearing in the top-level context. Fixed queryset crash when using a GenericRelation to a proxy model
2017-07-03Changes 1.11.3:adam2-7/+7
Bugfixes Removed an incorrect deprecation warning about a missing renderer argument if a Widget.render() method accepts **kwargs. Fixed a regression causing Model.__init__() to crash if a field has an instance only descriptor. Fixed an incorrect DisallowedModelAdminLookup exception when using a nested reverse relation in list_filter. Fixed admin’s FieldListFilter.get_queryset() crash on invalid input. Fixed invalid HTML for a required AdminFileWidget. Fixed model initialization to set the name of class-based model indexes for models that only inherit models.Model. Fixed crash in admin’s inlines when a model has an inherited non-editable primary key. Fixed QuerySet.union(), intersection(), and difference() when combining with an EmptyQuerySet. Prevented Paginator’s unordered object list warning from evaluating a QuerySet. Fixed the value of redirect_field_name in LoginView’s template context. It’s now an empty string (as it is for the original function-based login() view) if the corresponding parameter isn’t sent in a request (in particular, when the login page is accessed directly). Prevented attribute values in the django/forms/widgets/attrs.html template from being localized so that numeric attributes (e.g. max and min) of NumberInput work correctly. Removed casting of the option value to a string in the template context of the CheckboxSelectMultiple, NullBooleanSelect, RadioSelect, SelectMultiple, and Select widgets. In Django 1.11.1, casting was added in Python to avoid localization of numeric values in Django templates, but this made some use cases more difficult. Casting is now done in the template using the |stringformat:'s' filter. Prevented a primary key alteration from adding a foreign key constraint if db_constraint=False. Fixed UnboundLocalError crash in RenameField with nonexistent field. Fixed a regression preventing a model field’s limit_choices_to from being evaluated when a ModelForm is instantiated.
2017-06-02Django 1.11.2 release notesadam2-7/+7
Django 1.11.2 adds a minor feature and fixes several bugs in 1.11.1. Also, the latest string translations from Transifex are incorporated. Minor feature: * The new LiveServerTestCase.port attribute reallows the use case of binding to a specific port following the bind to port zero change in Django 1.11. Bugfixes: * Added detection for GDAL 2.1 and 2.0, and removed detection for unsupported versions 1.7 and 1.8. * Changed contrib.gis to raise ImproperlyConfigured rather than GDALException if gdal isn’t installed, to allow third-party apps to catch that exception. * Fixed django.utils.http.is_safe_url() crash on invalid IPv6 URLs. * Fixed regression causing pickling of model fields to crash. * Fixed django.contrib.auth.authenticate() when multiple authentication backends don’t accept a positional request argument. * Fixed introspection of index field ordering on PostgreSQL. * Fixed a regression where Model._state.adding wasn’t set correctly on multi-table inheritance parent models after saving a child model. * Allowed DjangoJSONEncoder to serialize django.utils.deprecation.CallableBool. * Relaxed the validation added in Django 1.11 of the fields in the defaults argument of QuerySet.get_or_create() and update_or_create() to reallow settable model properties. * Fixed MultipleObjectMixin.paginate_queryset() crash on Python 2 if the InvalidPage message contains non-ASCII. * Prevented Subquery from adding an unnecessary CAST which resulted in invalid SQL. * Corrected detection of GDAL 2.1 on Windows. * Made date-based generic views return a 404 rather than crash when given an out of range date. * Fixed a regression where file_move_safe() crashed when moving files to a CIFS mount. * Moved the ImageField file extension validation added in Django 1.11 from the model field to the form field to reallow the use case of storing images without an extension
2017-05-08Changes 1.11.1:adam3-9/+11
Allowed disabling server-side cursors on PostgreSQL Bugfixes: Made migrations respect Index’s name argument. If you created a named index with Django 1.11, makemigrations will create a migration to recreate the index with the correct name. Fixed a crash when using a __icontains lookup on a ArrayField. Fixed a crash when using a two-tuple in EmailMessage’s attachments argument. Fixed QuerySet.filter() crash when it references the name of a OneToOneField primary key. Fixed empty POST data table appearing instead of “No POST data” in HTML debug page. Restored BoundFields without any choices evaluating to True. Prevented SessionBase.cycle_key() from losing session data if _session_cache isn’t populated. Fixed layout of ReadOnlyPasswordHashWidget (used in the admin’s user change page). Allowed prefetch calls on managers with custom ModelIterable subclasses. Fixed change password link in the contrib.auth admin for el, es_MX, and pt translations. Restored the output of the class attribute in the <ul> of widgets that use the multiple_input.html template. This fixes ModelAdmin.radio_fields with admin.HORIZONTAL. Fixed crash in BaseGeometryWidget.subwidgets(). Fixed exception reraising in ORM query execution when cursor.execute() fails and the subsequent cursor.close() also fails. Fixed a regression where CheckboxSelectMultiple, NullBooleanSelect, RadioSelect, SelectMultiple, and Select localized option values. Corrected the stack level of unordered queryset pagination warnings. Fixed a regression causing incorrect queries for __in subquery lookups when models use ForeignKey.to_field. Fixed crash when overriding the template of django.views.static.directory_index(). Fixed a regression in formset min_num validation with unchanged forms that have initial data. Prepared for cx_Oracle 6.0 support. Updated the contrib.postgres SplitArrayWidget to use template-based widget rendering. Fixed crash in BaseGeometryWidget.get_context() when overriding existing attrs. Prevented AddIndex and RemoveIndex from mutating model state. Prevented migrations from dropping database indexes from Meta.indexes when changing Field.db_index to False. Fixed a regression in choice ordering in form fields with grouped and non-grouped options. Fixed crash in BaseInlineFormSet._construct_form() when using save_as_new. Fixed a regression where Model._state.db wasn’t set correctly on multi-table inheritance parent models after saving a child model. Corrected the return type of ArrayField(CITextField()) values retrieved from the database. Fixed QuerySet.prefetch_related() crash when fetching relations in nested Prefetch objects. Prevented hiding GDAL errors if it’s not installed when using contrib.gis. (It’s a required dependency as of Django 1.11.) Fixed a regression causing __in lookups on a foreign key to fail when using the foreign key’s parent model as the lookup
2017-04-05Changes 1.11:adam3-41/+122
As always, the release notes cover the medley of new features in detail, but a few highlights are: * Class-based model indexes for creating database indexes. * Template-based widget rendering to ease customizing form widgets. * Subquery expressions to create explicit subqueries using the ORM.
2017-03-12Changes 1.10.6:adam2-7/+7
Bugfixes: * Fixed ClearableFileInput’s “Clear” checkbox on model form fields where the model field has a default. * Fixed RequestDataTooBig and TooManyFieldsSent exceptions crashing rather than generating a bad request response. * Fixed a crash on Oracle and PostgreSQL when subtracting DurationField or IntegerField from DateField. * Fixed query expression date subtraction accuracy on PostgreSQL for differences larger than a month. * Fixed a GDALException raised by GDALClose on GDAL ≥ 2.0.
2017-01-07Changes 1.10.5:adam2-7/+7
Bugfixes * Fixed a crash in the debug view if request.user can’t be retrieved, such as if the database is unavailable. * Fixed occasional missing plural forms in JavaScriptCatalog. * Fixed a regression in the timesince and timeuntil filters that caused incorrect results for dates in a leap year. * Fixed a regression where collectstatic overwrote newer files in remote storages.
2017-01-03Use "${MV} || ${TRUE}" and "${RM} -f" consistently in post-install targets.jperkin1-3/+3
2016-12-02Changes 1.10.4:adam2-7/+7
Bugfixes * Quoted the Oracle test user’s password in queries to fix the “ORA-00922: missing or invalid option” error when the password starts with a number or special character. * Fixed incorrect app_label / model_name arguments for allow_migrate() in makemigrations migration consistency checks. * Made Model.delete(keep_parents=True) preserve parent reverse relationships in multi-table inheritance. * Fixed a QuerySet.update() crash on SQLite when updating a DateTimeField with an F() expression and a timedelta. * Prevented LocaleMiddleware from redirecting on URLs that should return 404 when using prefix_default_language=False. * Prevented an unnecessary index from being created on an InnoDB ForeignKey when the field was added after the model was created.
2016-11-06Update to 1.10.3wen3-45/+124
Approved by: joerg@(maintainer) Upstream changelog is too long, please visit: https://github.com/django/django/tree/master/docs/releases
2016-11-02Update to 1.9.11(security update)wen2-7/+7
Upstream changes: Django 1.9.11 release notes November 1, 2016 Django 1.9.11 fixes two security issues in 1.9.10. User with hardcoded password created when running tests on Oracle DNS rebinding vulnerability when DEBUG=True
2016-10-21Update to 1.9.10(security update)wen2-7/+7
Upstream changes: Django 1.9.10 release notes September 26, 2016 Django 1.9.10 fixes a security issue in 1.9.9. CSRF protection bypass on a site with Google Analytics An interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection. The parser for request.COOKIES is simplified to better match the behavior of browsers and to mitigate this attack. request.COOKIES may now contain cookies that are invalid according to RFC 6265 but are possible to set via document.cookie.
2016-08-28Remove unnecessary PLIST_SUBST and FILES_SUBST that are now providedwiz1-3/+1
by the infrastructure. Mark a couple more packages as not ready for python-3.x.
2016-08-04Changes 1.9.9:adam2-7/+7
Bugfixes: * Fixed invalid HTML in template postmortem on the debug page * Fixed some GIS database function crashes on MySQL 5.7
2016-07-19Django 1.9.8 fixes a security issue and several bugs in 1.9.7.adam3-11/+9
Unsafe usage of JavaScript’s Element.innerHTML could result in XSS in the admin’s add/change related popup. Element.textContent is now used to prevent execution of the data. The debug view also used innerHTML. Although a security issue wasn’t identified there, out of an abundance of caution it’s also updated to use textContent. Bugfixes: * Fixed missing varchar/text_pattern_ops index on CharField and TextField respectively when using AddField on PostgreSQL. * Fixed makemessages crash on Python 2 with non-ASCII file names.
2016-06-06Changes 1.9.7:adam2-7/+7
Bugfixes: * Removed the need for the request context processor on the admin login page to fix a regression in 1.9. * Fixed translation of password validators’ help_text in forms. * Fixed a regression causing the cached template loader to crash when using lazy template names. * Fixed on_commit callbacks execution order when callbacks make transactions. * Fixed HStoreField to raise a ValidationError instead of crashing on non-dictionary JSON input. * Fixed dbshell crash on PostgreSQL with an empty database name. * Fixed a regression in queries on a OneToOneField that has to_field and primary_key=True.
2016-05-07Changes 1.9.6:adam3-52/+16
Bugfixes: --------- Added support for relative path redirects to the test client and to SimpleTestCase.assertRedirects() because Django 1.9 no longer converts redirects to absolute URIs. Fixed TimeField microseconds round-tripping on MySQL and SQLite. Prevented makemigrations from generating infinite migrations for a model field that references a functools.partial. Fixed a regression where SessionBase.pop() returned None rather than raising a KeyError for nonexistent values. Fixed a regression causing the cached template loader to crash when using template names starting with a dash. Restored conversion of an empty string to null when saving values of GenericIPAddressField on SQLite and MySQL. Fixed a makemessages regression where temporary .py extensions were leaked in source file paths
2016-04-08Changes 1.9.5:adam2-9/+7
Made MultiPartParser ignore filenames that normalize to an empty string to fix crash in MemoryFileUploadHandler on specially crafted user input. Fixed a race condition in BaseCache.get_or_set(). It now returns the default value instead of False if there’s an error when trying to add the value to the cache. Fixed data loss on SQLite where DurationField values with fractional seconds could be saved as None. The forms in contrib.auth no longer strip trailing and leading whitespace from the password fields. The change requires users who set their password to something with such whitespace after a site updated to Django 1.9 to reset their password. It provides backwards-compatibility for earlier versions of Django. Fixed a memory leak in the cached template loader. Fixed a regression that caused collectstatic --clear to fail if the storage doesn’t implement path(). Fixed a crash when using a reverse lookup with a subquery when a ForeignKey has a to_field set to something other than the primary key. Fixed a regression in CommonMiddleware that caused spurious warnings in logs on requests missing a trailing slash. Restored the functionality of the admin’s raw_id_fields in list_editable. Fixed a regression with abstract model inheritance and explicit parent links. Fixed a migrations crash on SQLite when renaming the primary key of a model containing a ForeignKey to 'self'. Fixed JSONField inadvertently escaping its contents when displaying values after failed form validation.
2016-03-06Django 1.9.4 fixes a regression on Python 2 in the 1.9.3 security release ↵adam3-189/+279
where utils.http.is_safe_url() crashes on bytestring URLs.
2016-02-05Changes 1.8.9:adam2-7/+7
Fixed a regression that caused the “user-tools” items to display on the admin’s logout page. Fixed a crash in the translations system when the current language has no translations. Fixed a regression that caused the incorrect day to be selected when opening the admin calendar widget for timezones from GMT+0100 to GMT+1200. Fixed a regression in 1.8.8 causing incorrect index handling in migrations on PostgreSQL when adding db_index=True or unique=True to a CharField or TextField that already had the other specified, or when removing one of them from a field that had both, or when adding unique=True to a field already listed in unique_together. Fixed a crash when using an __in lookup inside a Case expression. Fixed a crash when using a reverse OneToOneField in ModelAdmin.readonly_fields. Fixed a regression in Django 1.8.5 that broke copying a SimpleLazyObject with copy.copy(). Fixed the contrib.gis map widgets when using USE_THOUSAND_SEPARATOR=True.
2016-01-03Changes 1.8.8:adam2-7/+7
Fixed incorrect unique_together field name generation by inspectdb. Corrected __len query lookup on ArrayField for empty arrays. Restored the ability to use custom formats from formats.py with django.utils.formats.get_format() and the date template filter. Fixed a state bug when migrating a SeparateDatabaseAndState operation backwards. Fixed missing varchar/text_pattern_ops index on CharField and TextField respectively when using AlterField on PostgreSQL. Fixed a state bug when using an AlterModelManagers operation. Fixed a regression which prevented using a language not in Django’s default language list (LANGUAGES). django.views.decorators.cache.never_cache() now sends more persuasive headers (added no-cache, no-store, must-revalidate to Cache-Control) to better prevent caching. This fixes a problem where a page refresh in Firefox cleared the selected entries in the admin’s filter_horizontal and filter_vertical widgets, which could result in inadvertent data loss if a user didn’t notice that and then submitted the form. Fixed a regression in the admin which ignored line breaks in read-only fields instead of converting them to <br>. Made loaddata skip disabling and enabling database constraints when it doesn’t load any fixtures. Fixed a crash in QuerySet.values()/values_list() after an annotate() and order_by() when values()/values_list() includes a field not in the order_by()
2015-11-26Changes 1.8.7:adam3-8/+11
* Fixed settings leak possibility in date template filter * Bug fixes
2015-11-06Django 1.8.6 adds official support for Python 3.5 and fixes several bugs in ↵adam3-8/+11
1.8.5: Fixed a regression causing ModelChoiceField to ignore prefetch_related() on its queryset. Allowed “mode=memory” in SQLite test database name if supported. Fixed system check crash on ForeignKey to abstract model. Fixed incorrect queries when you have multiple ManyToManyFields on different models that have the same field name, point to the same model, and have their reverse relations disabled. Allowed filtering over a RawSQL annotation. Made the Concat database function idempotent on SQLite. Avoided a confusing stack trace when starting runserver with an invalid INSTALLED_APPS setting. Made deferred models use their proxied model’s _meta.apps for caching and retrieval. This prevents any models generated in data migrations using QuerySet.defer() from leaking to test and application code. Fixed a typo in the name of the strictly_above PostGIS lookup. Fixed crash with contrib.postgres.forms.SplitArrayField and IntegerField on invalid value. Added a helpful error message when Django and South migrations exist in the same directory. Fixed a regression in URLValidator that allowed URLs with consecutive dots in the domain section (like http://example..com/) to pass. Fixed a crash with GenericRelation and BaseModelAdmin.to_field_allowed.
2015-11-04Add SHA512 digests for distfiles for www categoryagc1-1/+2
Problems found locating distfiles: Package haskell-cgi: missing distfile haskell-cgi-20001206.tar.gz Package nginx: missing distfile array-var-nginx-module-0.04.tar.gz Package nginx: missing distfile encrypted-session-nginx-module-0.04.tar.gz Package nginx: missing distfile headers-more-nginx-module-0.261.tar.gz Package nginx: missing distfile nginx_http_push_module-0.692.tar.gz Package nginx: missing distfile set-misc-nginx-module-0.29.tar.gz Package nginx-devel: missing distfile echo-nginx-module-0.58.tar.gz Package nginx-devel: missing distfile form-input-nginx-module-0.11.tar.gz Package nginx-devel: missing distfile lua-nginx-module-0.9.16.tar.gz Package nginx-devel: missing distfile nginx_http_push_module-0.692.tar.gz Package nginx-devel: missing distfile set-misc-nginx-module-0.29.tar.gz Package php-owncloud: missing distfile owncloud-8.2.0.tar.bz2 Otherwise, existing SHA1 digests verified and found to be the same on the machine holding the existing distfiles (morden). All existing SHA1 digests retained for now as an audit trail.
2015-10-08Changes 1.8.5:adam2-6/+6
Made the development server’s autoreload more robust. Fixed AssertionError in some delete queries with a model containing a field that is both a foreign and primary key. Fixed AssertionError in some complex queries. Fixed a migrations crash with GenericForeignKey. Made translation.override() clear the overridden language when a translation isn’t initially active. Fixed crash when using a value in ModelAdmin.list_display that clashed with a reverse field on the model. Fixed autocompletion for options of non-argparse management commands. Alphabetized ordering of imports in from django.db import migrations, models statement in newly created migrations. Fixed migrations crash on MySQL when adding a text or a blob field with an unhashable default. Changed Count queries to execute COUNT(*) instead of COUNT('*') as versions of Django before 1.8 did. This may fix a performance regression on some databases. Fixed custom queryset chaining with values() and values_list(). Moved the unsaved model instance assignment data loss check on reverse relations to Model.save(). Readded inline foreign keys to form instances when validating model formsets. Allowed using ORM write methods after disabling autocommit with set_autocommit(False). Fixed the manage.py test --keepdb option on Oracle. Fixed incorrect queries with multiple many-to-many fields on a model with the same ‘to’ model and with related_name set to ‘+’. Fixed pickling a SimpleLazyObject wrapping a mode
2015-08-24Changes 1.8.4:adam3-7/+10
* Denial-of-service possibility in logout() view by filling session store. * Bugfixes: - Added the ability to serialize values from the newly added UUIDField. - Added a system check warning if the old TEMPLATE_* settings are defined in addition to the new TEMPLATES setting. - Fixed QuerySet.raw() so InvalidQuery is not raised when using the db_column name of a ForeignKey field with primary_key=True. - Prevented an exception in TestCase.setUpTestData() from leaking the transaction. - Fixed has_changed() method in contrib.postgres.forms.HStoreField. - Fixed the recording of squashed migrations when running the migrate command. - Moved the unsaved model instance assignment data loss check to Model.save() to allow easier usage of in-memory models. - Prevented varchar_patterns_ops and text_patterns_ops indexes for ArrayField.
2015-07-17Changes 1.8.3:adam3-1151/+300
* Denial-of-service possibility by filling session store * Header injection possibility since validators accept newlines in input * Denial-of-service possibility in URL validation * Bugfixes
2015-04-13Removing python26. EOL'd quite some ago and discussed a couple times onrodent1-2/+1
tech-pkg@ and pkgsrc-users@.
2015-03-19Changes 1.7.7:adam2-6/+6
* Fix for Denial-of-service possibility with strip_tags() * Mitigated possible XSS attack via user-supplied redirect URLs
2015-03-09Changes 1.7.6:adam2-6/+6
These releases address a security issue in the Django admin. * Issue: XSS attack via properties in ModelAdmin.readonly_fields * Advisory: HTML escaping when calling template filters from Python code
2015-02-26Changes 1.7.5:adam3-7/+13
Bugfixes: * Reverted a fix that prevented a migration crash when unapplying contrib.contenttypes’s or contrib.auth’s first migration (24075) due to severe impact on the test performance (24251) and problems in multi-database setups (24298). * Fixed a regression that prevented custom fields inheriting from ManyToManyField from being recognized in migrations (24236). * Fixed crash in contrib.sites migrations when a default database isn’t used (24332). * Added the ability to set the isolation level on PostgreSQL with psycopg2 ≥ 2.4.2 (24318). It was advertised as a new feature in Django 1.6 but it didn’t work in practice. * Formats for the Azerbaijani locale (az) have been added.
2015-01-28Changes 1.7.4:adam2-6/+6
* Fixed a migration crash when unapplying contrib.contenttypes’s or contrib.auth’s first migration. * Made the migration’s RenameModel operation rename ManyToManyField tables. * Fixed a migration crash on MySQL when migrating from a OneToOneField to a ForeignKey. * Prevented the static.serve view from producing ResourceWarnings in certain circumstances. * Fixed schema check for ManyToManyField to look for internal type instead of checking class instance, so you can write custom m2m-like fields with the same behaviour.
2015-01-14Fixed securify issues:adam2-6/+6
* WSGI header spoofing via underscore/dash conflation * Mitigated possible XSS attack via user-supplied redirect URLs * Denial-of-service attack against django.views.static.serve * Database denial-of-service with ModelMultipleChoiceField
2015-01-06Python 2.6 is no longer supported.joerg1-1/+2
2015-01-03Django 1.7.2 fixes several bugs in 1.7.1.adam6-280/+764
Additionally, Django’s vendored version of six, django.utils.six, has been upgraded to the latest release (1.9.0).
2014-11-23Changes 1.6.8:adam2-6/+6
This release fixes a couple regressions in the 1.6.6 security release. Bugfixes Allowed related many-to-many fields to be referenced in the admin Allowed inline and hidden references to admin fields
2014-08-23Changes 1.6.6:adam2-6/+6
Security fixes: * Issue: reverse() can generate URLs pointing to other hosts (CVE-2014-0480) * Issue: file upload denial of service (CVE-2014-0481) * Issue: RemoteUserMiddleware session hijacking (CVE-2014-0482) * Issue: data leakage via querystring manipulation in admin (CVE-2014-0483)
2014-05-20Changes 1.6.5:adam2-6/+6
These releases address a caching issue which might lead to cache poisoning and an incorrect validation of safe redirect targets. Since these issues will affect the majority of users we strongly encourage everyone to upgrade.
2014-05-09Mark packages that are not ready for python-3.3 also not ready for 3.4,wiz1-2/+2
until proven otherwise.
2014-05-03Changes 1.6.4:adam2-6/+6
Shortly after last week's security releases were issued, we received reports of a potential regression in using reverse() with views created by functools.partial. We were able to confirm the bug, and test and commit a fix for it.
2014-04-22Changes 1.6.3:adam2-6/+6
These releases address an unexpected code-execution issue, a caching issue which can expose CSRF tokens and a MySQL typecasting issue. While these issues present limited risk and may not affect all Django users, we encourage all users to evaluate their own risk and upgrade as soon as possible.
2014-02-09Changes 1.6.2:adam2-6/+6
Prevented the base geometry object of a prepared geometry to be garbage collected, which could lead to crash Django. Fixed a crash when executing the changepassword command when the user object representation contained non-ASCII characters. The collectstatic command will raise an error rather than default to using the current working directory if STATIC_ROOT is not set. Combined with the --clear option, the previous behavior could wipe anything below the current working directory. Fixed mail encoding on Python 3.3.3+. Fixed an issue where when settings.DATABASES['default']['AUTOCOMMIT'] = False, the connection wasn’t in autocommit mode but Django pretended it was. Fixed a regression in multiple-table inheritance exclude() queries. Added missing items to django.utils.timezone.__all__. Fixed a field misalignment issue with select_related() and model inheritance. Fixed join promotion for negated AND conditions. Oracle database introspection now works with boolean and float fields. Fixed an issue where lazy objects weren’t actually marked as safe when passed through mark_safe() and could end up being double-escaped
2014-01-30Judging from the documentation, this prefers py-sqlite3 nowadays,wiz1-3/+2
which has the advantage of being available for python-3.x. (default-off option, so no PKGREVISION++)
2014-01-25Mark packages as not ready for python-3.x where applicable;wiz1-1/+3
either because they themselves are not ready or because a dependency isn't. This is annotated by PYTHON_VERSIONS_INCOMPATIBLE= 33 # not yet ported as of x.y.z or PYTHON_VERSIONS_INCOMPATIBLE= 33 # py-foo, py-bar respectively, please use the same style for other packages, and check during updates. Use versioned_dependencies.mk where applicable. Use REPLACE_PYTHON instead of handcoded alternatives, where applicable. Reorder Makefile sections into standard order, where applicable. Remove PYTHON_VERSIONS_INCLUDE_3X lines since that will be default with the next commit. Whitespace cleanups and other nits corrected, where necessary.
2014-01-18Use versioned_dependencies.mk for flup.wiz1-5/+3
generated by cgit v1.2.3 (git 2.39.1) at 2024-10-13 04:49:34 +0000