https://github.com/django/django

sort by:
Revision Author Date Message Commit Date
9ff23eb [1.4.x] Bumped version for 1.4.22 release. 18 August 2015, 12:39:59 UTC
575f59f [1.4.x] Fixed DoS possiblity in contrib.auth.views.logout() Refs #20936 -- When logging out/ending a session, don't create a new, empty session. Previously, when logging out, the existing session was overwritten by a new sessionid instead of deleting the session altogether. This behavior added overhead by creating a new session record in whichever backend was in use: db, cache, etc. This extra session is unnecessary at the time since no session data is meant to be preserved when explicitly logging out. Backport of 393c0e24223c701edeb8ce7dc9d0f852f0c081ad, 088579638b160f3716dc81d194be70c72743593f, and 2dee853ed4def42b7ef1b3b472b395055543cc00 from master Thanks Florian Apolloner and Carl Meyer for review. This is a security fix. 18 August 2015, 12:35:42 UTC
8b0d639 [1.4.x] Added stub release notes for security releases. 18 August 2015, 12:35:33 UTC
3b32497 [1.4.x] Fixed #25119 -- Disabled wheel support. 13 July 2015, 23:57:52 UTC
3df6495 [1.4.x] Post-release version bump. 08 July 2015, 20:01:55 UTC
622a115 [1.4.x] Bumped version for 1.4.21 release. 08 July 2015, 11:39:43 UTC
1ba1cdc [1.4.x] Prevented newlines from being accepted in some validators. This is a security fix; disclosure to follow shortly. Thanks to Sjoerd Job Postmus for the report and draft patch. 08 July 2015, 11:38:06 UTC
2e47f3e [1.4.x] Fixed #19324 -- Avoided creating a session record when loading the session. The session record is now only created if/when the session is modified. This prevents a potential DoS via creation of many empty session records. This is a security fix; disclosure to follow shortly. 08 July 2015, 11:38:06 UTC
c570a5e [1.4.x] Added security release note stubs. 08 July 2015, 11:38:06 UTC
91a395f [1.4.x] Backported .gitignore and .hgignore from master. 01 July 2015, 14:41:23 UTC
664ad12 [1.4.x] Added link to download page to find supported versions. Backport of 8c4827ec1d44fee05db189766174c115795a495e from master 04 April 2015, 12:00:44 UTC
b2a7878 [1.4.x] Post-release version bump. 19 March 2015, 00:22:09 UTC
5388692 [1.4.x] Bumped version for 1.4.20 release. 18 March 2015, 12:43:42 UTC
2342693 [1.4.x] Made is_safe_url() reject URLs that start with control characters. This is a security fix; disclosure to follow shortly. 18 March 2015, 12:39:37 UTC
3b20558 [1.4.x] Added stub release notes for security releases. 18 March 2015, 12:39:12 UTC
785e57e [1.4.x] Fix an encoding preamble so the tests pass on 2.7.9. It seems there was a change in the parsing of encoding preambles in Python 2.7.9, compared to previous 2.7.x Pythons. This is a backport of the only piece of e520a73eeea6b185b719901ab9985ecef00e5664 that's needed to prevent an import failure under 2.7.9. 07 February 2015, 03:20:02 UTC
e60557c [1.4.x] Fixed #24238 -- Removed unused WSGIRequestHandler.get_environ() Also moved the test as it wasn't running. 28 January 2015, 17:32:15 UTC
4376d6e [1.4.x] Post-release version bump. 27 January 2015, 17:26:26 UTC
7dd4c52 [1.4.x] Bumped version for 1.4.19 release. 27 January 2015, 16:55:02 UTC
1e39d0f [1.4.x] Fixed #24158 -- Allowed GZipMiddleware to work with streaming responses Backport of django.utils.text.compress_sequence and fix for django.middleware.gzip.GZipMiddleware when using iterators as response.content. 27 January 2015, 00:22:47 UTC
9435474 [1.4.x] Designated Django 1.8 as the next LTS. Backport of c38db4d7e072e9a5002cb4897d9104e5eaa292ed from master 19 January 2015, 17:09:43 UTC
99e6ac7 [1.4.x] Fixed a static view test on Windows. Backport of a6f144fd4fee0090de3a99b1f50a4142722e7946 from master 14 January 2015, 18:57:59 UTC
4296a1d [1.4.x] Post-release version bump. 13 January 2015, 19:16:07 UTC
bd9dcd2 [1.4.x] Bumped version for 1.4.18 release. 13 January 2015, 18:14:08 UTC
88b7957 [1.4.x] Added dates to release notes. 13 January 2015, 18:10:54 UTC
d020da6 [1.4.x] Prevented views.static.serve() from using large memory on large files. This is a security fix. Disclosure following shortly. 05 January 2015, 18:43:54 UTC
4c241f1 [1.4.x] Fixed is_safe_url() to handle leading whitespace. This is a security fix. Disclosure following shortly. 05 January 2015, 18:43:32 UTC
4f6fffc [1.4.x] Stripped headers containing underscores to prevent spoofing in WSGI environ. This is a security fix. Disclosure following shortly. Thanks to Jedediah Smith for the report. 05 January 2015, 18:43:15 UTC
113a898 [1.4.x] Added stub release notes for security releases. 05 January 2015, 18:42:52 UTC
2fd8054 [1.4.x] Fixed #24081 -- Downgraded six to 1.8.0. This reverts commit a25c444bc701b496f2b05f57fc3ec42cdac9dd85. six 1.9+ requires Python 2.6 so this commit restores Python 2.5 compatibility. 05 January 2015, 18:41:06 UTC
032ffad [1.4.x] Removed wheel generation from Makefile. 03 January 2015, 03:01:51 UTC
52136af [1.4.x] Post-release version bump. 03 January 2015, 02:49:44 UTC
592187e [1.4.x] Bumped version for 1.4.17 release. 03 January 2015, 02:07:00 UTC
35dc639 [1.4.x] Added dates to release notes. Backport of 15cd71ed24945ff7be5716580603fd65c0d45ef7 from master 03 January 2015, 00:23:14 UTC
a25c444 [1.4.x] Updated six to 1.9.0. Backport of 52f0b2b62262743d5f935ddae29428e661b5d8ea from master 02 January 2015, 18:38:58 UTC
5940da1 [1.4.x] Fixed #23754 -- Always allowed reference to the primary key in the admin This change allows dynamically created inlines "Add related" button to work correcly as long as their associated foreign key is pointing to the primary key of the related model. Thanks to amorce for the report, Julien Phalip for the initial patch, and Collin Anderson for the review. Backport of f9c4e14aeca7df79991bca8ac2d743953cbd095c from master 25 November 2014, 19:04:56 UTC
c83b024 [1.4.x] Removed thread customizations of six which are now built-in. Backport of 7ef81b5cdd4c8eda12aa7786484a0bfde00aaaa4 from master 13 November 2014, 10:36:21 UTC
a1dcd82 [1.4.x] Updated six to 1.8.0. Backport of 81477c91f6 from master 05 November 2014, 02:30:21 UTC
486b6ca [1.4.x] Post-release version bump. 22 October 2014, 17:33:07 UTC
151d6db [1.4.x] Bump version numbers for bugfix release. 22 October 2014, 16:36:19 UTC
a92e386 [1.4.x] Added release dates to release notes. Backport of 9dc782b631 from master 22 October 2014, 16:25:45 UTC
643374b [1.4.x] Fixed #23631 -- Removed outdated note on MySQL timezone support. Thanks marfire for the report. Backport of 9db3653670 from master 10 October 2014, 19:22:46 UTC
f58392d [1.4.x] Fixed #23604 -- Allowed related m2m fields to be references in the admin. Thanks Simon Charette for review. Backport of a24cf21722 from master 06 October 2014, 13:08:45 UTC
df657a7 [1.4.x] Required numpy < 1.9 for tests; refs #23489. Backport of 4743a94429 from stable/1.7.x 29 September 2014, 23:47:33 UTC
3132eda [1.4.x] Fixed #23499 -- Error in built-in template tag "now" documentation Backport of ab8248361e0a7b4fc7684eaaa5891e16b8562683 from master. 17 September 2014, 07:26:45 UTC
ba2be27 [1.4.x] Fixed #20036 -- Improved GEOS version string parsing Thanks chikiro.spam at gmail.com for the report. 11 September 2014, 18:54:33 UTC
065caaf [1.4.x] Fixed #23431 -- Allowed inline and hidden references to admin fields. This fixes a regression introduced by the 53ff096982 security fix. Thanks to @a1tus for the report and Tim for the review. refs #23329. Backport of 342ccbd from master 08 September 2014, 18:22:29 UTC
7808584 [1.4.x] Added dates to release notes. Backport of 0fd23545db from master 03 September 2014, 01:36:44 UTC
89157fe [1.4.x] Post release version bump. 03 September 2014, 01:07:29 UTC
0517f49 [1.4.x] Bump version numbers for bugfix release. 02 September 2014, 20:43:24 UTC
4685026 [1.4.x] Fixed #23329 -- Allowed inherited and m2m fields to be referenced in the admin. Thanks to Trac alias Markush2010 and ross for the detailed reports. Backport of 3cbb759 from master 28 August 2014, 02:12:37 UTC
8adc56c [1.4.x] Fixed spelling mistake in file docs. Backport of a3e88e64a4 from master 26 August 2014, 13:45:06 UTC
27c682f [1.4.x] Bumped version number post-release. 20 August 2014, 20:36:42 UTC
e484df7 [1.4.x] Added dates to release notes. 20 August 2014, 20:33:50 UTC
4fce019 [1.4.x] Bump version numbers for security release. 20 August 2014, 20:00:40 UTC
027bd34 [1.4.x] Prevented data leakage in contrib.admin via query string manipulation. This is a security fix. Disclosure following shortly. 11 August 2014, 20:01:41 UTC
c9e3b99 [1.4.x] Fixed #23066 -- Modified RemoteUserMiddleware to logout on REMOTE_USE change. This is a security fix. Disclosure following shortly. 11 August 2014, 16:15:06 UTC
30042d4 [1.4.x] Fixed #23157 -- Removed O(n) algorithm when uploading duplicate file names. This is a security fix. Disclosure following shortly. 11 August 2014, 14:14:06 UTC
c2fe731 [1.4.x] Prevented reverse() from generating URLs pointing to other hosts. This is a security fix. Disclosure following shortly. 11 August 2014, 13:04:23 UTC
4d5e972 [1.4.x] Added release note stub for 1.4.14. 11 August 2014, 12:47:06 UTC
88cb7aa [1.4.x] Added a warning that remove_tags() output shouldn't be considered safe. Backport of 7efce77de2 from master 11 August 2014, 11:11:30 UTC
399052d [1.4.x] Noted that django-jython requires Django 1.7. Backport of 72e98d5c16 from stable/1.6.x 08 August 2014, 16:47:31 UTC
d23d19c [1.4.x] Fixed #23239 -- Clarified a phrase in the contrib.markup docs. Backport of e0fb48c254 from stable/1.5.x 06 August 2014, 12:30:49 UTC
bc03817 [1.4.x] Fixed #23149 -- Clarified note on HTTPOnly in cookie-based session docs Backport of e26366da44bb343e7a95d01ff0dd18b8026c2802 from master. 02 August 2014, 17:01:23 UTC
778a555 [1.4.x] Added tests/requirements/py2.txt. This follows the convention used in other branches so we don't need a special case in the build script for 1.4. 25 July 2014, 13:46:15 UTC
aa9c45c [1.4.x] Revert "Fixed #13794 -- Fixed to_field usage in BaseInlineFormSet." This reverts commit b44519072e8a0ef56a0ae9e6e4a1fb04273eb0eb. stable/1.4.x branch is in security-fixes-only mode. 15 July 2014, 00:09:38 UTC
b445190 [1.4.x] Fixed #13794 -- Fixed to_field usage in BaseInlineFormSet. Thanks sebastien at clarisys.fr for the report and gautier for the patch. Backport of 5e2c4a4bd1 from master 14 July 2014, 15:38:00 UTC
d29f3b9 [1.4.x] Fixed #22859 -- Improved crossDomain technique in CSRF example. Thanks flisky for the report. Backport of 0be4d64487 from master 18 June 2014, 18:38:30 UTC
d39fcff [1.4.x] Minor edits to latest release notes. Backport of 860d31ac7a3bdd4b27db8b34b110b3d801ddaf8a from master 15 May 2014, 11:17:54 UTC
37d6821 Bumped version numbers post-release. 14 May 2014, 16:24:08 UTC
53b98b5 Bumped version numbers for release. 14 May 2014, 16:09:51 UTC
fe5b3e3 Added release notes for 1.4.13. 14 May 2014, 16:07:32 UTC
7feb54b [1.4.x] Added additional checks in is_safe_url to account for flexible parsing. This is a security fix. Disclosure following shortly. 12 May 2014, 13:46:40 UTC
28e2330 [1.4.x] Dropped fix_IE_for_vary/attach. This is a security fix. Disclosure following shortly. 12 May 2014, 13:46:22 UTC
e181261 [1.4.x] Added dates to release notes of today's release. Backport of 68d264059abb21b96c4fe68bf4d99520268a451c from master 28 April 2014, 23:07:51 UTC
48a4729 [1.4.x] Post release version bump. 28 April 2014, 23:03:36 UTC
b1b680c [1.4.x] Bump version numbers for 1.4.12 bugfix release. 28 April 2014, 20:28:15 UTC
b91c385 [1.4.x] Fixed #22486 -- Restored the ability to reverse views created using functools.partial. Regression in 8b93b31. Thanks rcoup for the report. Backport of 3c06b2f2a3 from master 23 April 2014, 13:22:02 UTC
1edb163 [1.4.x] Post release version bump. 22 April 2014, 15:50:20 UTC
194159b [1.4.x] Bump version numbers for 1.4.11 security release. 21 April 2014, 22:38:26 UTC
8010908 [1.4.x] Added information on resolved security issues to release notes. Backport of c07f3e60c2d455e36ba4ac339d4283d32bbc3814 from master 21 April 2014, 22:31:44 UTC
aa80f49 [1.4.x] Fixed queries that may return unexpected results on MySQL due to typecasting. This is a security fix. Disclosure will follow shortly. Backport of 75c0d4ea3ae48970f788c482ee0bd6b29a7f1307 from master 21 April 2014, 22:31:44 UTC
1170f28 [1.4.x] Prevented leaking the CSRF token through caching. This is a security fix. Disclosure will follow shortly. Backport of c083e3815aec23b99833da710eea574e6f2e8566 from master 21 April 2014, 22:31:44 UTC
c1a8c42 [1.4.x] Fixed a remote code execution vulnerabilty in URL reversing. Thanks Benjamin Bach for the report and initial patch. This is a security fix; disclosure to follow shortly. Backport of 8b93b31487d6d3b0fcbbd0498991ea0db9088054 from master 21 April 2014, 22:31:44 UTC
ca3927d [1.4.x] Corrected the section identifier for MySQL unicode reference. Backport of b2514c02e1 from master 21 April 2014, 17:21:14 UTC
83420e7 [1.4.x] Fixed random aggregation_regress test_more_more_more() failure The cause was assuming that an unordered queryset returns the values always in the same order. Backport of 33dd8f544205be923e2a06106909ebcd3583526b 19 April 2014, 17:01:52 UTC
f2a9f71 [1.4.x] Updated six to 1.6.1. Backport of 2ec82c7387db071278201796208808de84c90dbf from master 24 March 2014, 11:35:13 UTC
f108b1f [1.4.x] Clarified striptags documentation The fact that striptags cannot guarantee to really strip all non-safe HTML content was not clear enough. Also see: https://www.djangoproject.com/weblog/2014/mar/22/strip-tags-advisory/ Partial backport (doc-only) of 6ca6c36f82 from master. 22 March 2014, 10:19:58 UTC
b8713ee [1.4.x] Fixed #21195 -- Clarifed usage of template_name in tutorial part 4. Backport of b66a51ad545ac726ef98966cbc35ee7aefdff8cd from master. 05 March 2014, 21:35:37 UTC
74181c0 [1.4.x] Added release note stub for 1.4.11. Backport of dfa28981ce from master. 26 January 2014, 22:50:12 UTC
257f852 [1.4.x] Fixed #21823 -- Upgraded six to 1.5.2 Backport of 780ae7e9f8 from master. 26 January 2014, 20:52:39 UTC
8505752 [1.4.x] Fixed #21869 -- Fixed docs building with Sphinx 1.2.1. Thanks tragiclifestories for the report. Backport of e1d18b9d2e from master 24 January 2014, 14:05:59 UTC
03d9b9e [1.4.x] Added a note about LTS releases. Backport of a44cbca2a5f1388c6511dad48443877fa660845a from master. 19 January 2014, 17:46:57 UTC
1036e3e [1.4.x] Fixed #20052 -- Discouraged use of Jython given the current state of django-jython. Thanks Josh Juneau (maintainer of django-jython) for the review. Backport of a67e327db5 from master 17 January 2014, 14:29:57 UTC
2c1d92b Updated six to version 1.4.1 This is not a bugfix. But six only exists on Django 1.4.x branch to help with future compatibility, so it is helpful if it keeps up with latest Django. 02 January 2014, 12:39:00 UTC
474e7dd [1.4.x] Fixed #21594 -- Added note about model formsets deleting objects. This behavior has been fixed in 65e03a424e. refs #10284. Backport of de1d5d5df5 from stable/1.6.x. 11 December 2013, 19:49:22 UTC
2d4f399 [1.4.x] Fixed #21558 -- Support building CHM files. Thanks Michał Pasternak. Backport of cd9e85ec from master. 04 December 2013, 15:52:30 UTC
2312686 [1.4.x] Fixed #21538 -- Added numpy to test/requirements/base.txt Thanks Tim Graham for the report Backport of c75dd664c from master 02 December 2013, 18:45:56 UTC
8e8584f [1.4.x] Removed obsolete deprecation notes. 23 November 2013, 13:47:09 UTC
46755c5 [1.4.x] Fix #20054: Removed links to modwsgi.org. Backport of 957fcd0c9fc605bbb69e03296aede3b0bac5a8d2 from master. 22 November 2013, 08:16:50 UTC
back to top