https://github.com/django/django

sort by:
Revision Author Date Message Commit Date
6efdf1b [3.1.x] Bumped version for 3.1.11 release. 13 May 2021, 07:16:23 UTC
b7d4a6f [3.1.x] Fixed #32718 -- Relaxed file name validation in FileField. - Validate filename returned by FileField.upload_to() not a filename passed to the FileField.generate_filename() (upload_to() may completely ignored passed filename). - Allow relative paths (without dot segments) in the generated filename. Thanks to Jakub Kleň for the report and review. Thanks to all folks for checking this patch on existing projects. Thanks Florian Apolloner and Markus Holtermann for the discussion and implementation idea. Regression in 0b79eb36915d178aef5c6a7bbce71b1e76d376d3. Backport of b55699968fc9ee985384c64e37f6cc74a0a23683 from main. 13 May 2021, 06:56:06 UTC
9fb9944 [3.1.x] Refs #32718 -- Corrected CVE-2021-31542 release notes. Backport of d1f1417caed648db2f81a1ec28c47bf958c01958 from main. 12 May 2021, 08:43:12 UTC
0688874 [3.1.x] Added CVE-2021-32052 to security archive. Backport of efebcc429f048493d6bc710399e65d98081eafd5 from main 06 May 2021, 08:04:52 UTC
020bb45 [3.1.x] Post-release version bump. 06 May 2021, 07:06:53 UTC
a2407cd [3.1.x] Bumped version for 3.1.10 release. 06 May 2021, 07:04:41 UTC
afb23f5 [3.1.x] Fixed #32713, Fixed CVE-2021-32052 -- Prevented newlines and tabs from being accepted in URLValidator on Python 3.9.5+. In Python 3.9.5+ urllib.parse() automatically removes ASCII newlines and tabs from URLs [1, 2]. Unfortunately it created an issue in the URLValidator. URLValidator uses urllib.urlsplit() and urllib.urlunsplit() for creating a URL variant with Punycode which no longer contains newlines and tabs in Python 3.9.5+. As a consequence, the regular expression matched the URL (without unsafe characters) and the source value (with unsafe characters) was considered valid. [1] https://bugs.python.org/issue43882 and [2] https://github.com/python/cpython/commit/76cd81d60310d65d01f9d7b48a8985d8ab89c8b4 Backport of e1e81aa1c4427411e3c68facdd761229ffea6f6f from main. 06 May 2021, 06:50:52 UTC
fdbf4a7 [3.1.x] Refs CVE-2021-31542 -- Skipped mock AWS storage test on Windows. The validate_file_name() sanitation introduced in 0b79eb36915d178aef5c6a7bbce71b1e76d376d3 correctly rejects the example file name as containing path elements on Windows. This breaks the test introduced in 914c72be2abb1c6dd860cb9279beaa66409ae1b2 to allow path components for storages that may allow them. Test is skipped pending a discussed storage refactoring to support this use-case. Backport of a708f39ce67af174df90c5b5e50ad1976cec7cb8 from main 06 May 2021, 05:42:45 UTC
48b39a8 [3.1.x] Added CVE-2021-31542 to security archive. Backport of 607ebbfba915de2d84eb943aa93654f31817a709 and 62b2e8b37e37a313c63be40e3223ca4e830ebde3 from main 04 May 2021, 09:13:11 UTC
8012441 [3.1.x] Post-release version bump. 04 May 2021, 08:32:07 UTC
8284fd6 [3.1.x] Bumped version for 3.1.9 release. 04 May 2021, 08:25:17 UTC
25d84d6 [3.1.x] Fixed CVE-2021-31542 -- Tightened path & file name sanitation in file uploads. 27 April 2021, 17:12:15 UTC
6b0c7e6 [3.1.x] Added CVE-2021-28658 to security archive. Backport of 1eac8468cbde790fecb51dd055a439f4947d01e9 from main 06 April 2021, 07:46:21 UTC
5b9ca81 [3.1.x] Post-release version bump. 06 April 2021, 06:31:58 UTC
c4928c9 [3.1.x] Bumped version for 3.1.8 release. 06 April 2021, 06:27:37 UTC
cca0d98 [3.1.x] Fixed CVE-2021-28658 -- Fixed potential directory-traversal via uploaded files. Thanks Claude Paroz for the initial patch. Thanks Dennis Brinkrolf for the report. Backport of d4d800ca1addc4141e03c5440a849bb64d1582cd from main. 06 April 2021, 06:25:24 UTC
6eb01cb [3.1.x] Fixed #32576 -- Corrected dumpdata docs for passing model names to the --exclude option. Backport of cf2f6fc558166656f29609e3864df9af81067d0c from main 22 March 2021, 07:45:20 UTC
11d241d [3.1.x] Refs #25735 -- Added tags/exclude_tags arguments to DiscoverRunner docs. Backport of 37044817f9a57126d655f216019e8c8cca7c151b from main. 19 March 2021, 07:11:22 UTC
4a10c31 [3.1.x] Added parallel argument to DiscoverRunner docs. Follow up to cd9fcd4e8073490a52c9e79133ada4661cb7db38. Backport of f099ef3ef53f88160d04d7dcc73859801b05a83e from main. 19 March 2021, 07:09:46 UTC
c528c71 [3.1.x] Corrected DiscoverRunner.build_suite() signature. Follow up to 9012833af857e081b515ce760685b157638efcef. Backport of fc6fba0aa9e4575c9a1c23ad7031eebb1c112868 from main 19 March 2021, 07:08:07 UTC
95ee8fe [3.1.x] Fixed #32560 -- Fixed test runner with --pdb and --buffer on fail/error. Backport of 45814af6197cfd8f4dc72ee43b90ecde305a1d5a from main 17 March 2021, 20:51:51 UTC
b58b214 [3.1.x] Fixed typo in docs/topics/testing/advanced.txt. Backport of 6993e1bf6dff04b6e3ab284b154397b341463b50 from main 17 March 2021, 17:50:24 UTC
0415ac5 [3.1.x] Fixed #32536 -- Added links to BaseDetailView/BaseListView.get() methods in CBV docs. Backport of bc04941bf811d1ea2c79fb7fc20457ed2c7e3410 from main 16 March 2021, 07:04:28 UTC
7c662b7 [3.1.x] Fixed typo in docs/ref/checks.txt. Backport of 50ef9dfac21499ff6c46c2f6a33103e40b60cd4e from main 15 March 2021, 08:42:47 UTC
069c338 [3.1.x] Updated datum directory for PROJ 6 in GIS install instructions. Backport of 4d912e6697784325bc43a6d852fe5a26e6fa235a from main 15 March 2021, 07:21:32 UTC
5ab1b7b [3.1.x] Refs #32483 -- Doc'd caveat about using JSONField key transforms to booleans with QuerySet.values()/values_list() on SQLite. Backport of c6b07627fcb5d1c8d2082714ef5adb63bee6cf4c from master 04 March 2021, 10:31:22 UTC
72e2cbe [3.1.x] Fixed typo in docs/ref/contrib/postgres/fields.txt. Backport of 05bbff82638731a6abfed2fe0ae06a4d429cb32f from master 04 March 2021, 09:44:40 UTC
05066ad [3.1.x] Corrected admin.E023 message in docs. Backport of d1f89c9b9a9b44c4dbfd24fcb5f76f16e973c0a2 from master 04 March 2021, 08:22:01 UTC
350c691 [3.1.x] Updated links to djangoproject.com/code.djangoproject.com repositories. Backport of 2b1de3dd242b473cd084e7ff9b9b10d488dcabad from master 03 March 2021, 08:07:33 UTC
200b71b [3.1.x] Fixed typos in assertQuerysetEqual() docs and 1.6 release notes. Backport of 0c7e880e13b837dd76276c04ebdc338bb76d1379 from master 26 February 2021, 08:12:22 UTC
bdad3eb [3.1.x] Added stub release notes for 3.1.8. Backport of e0f82d7992ad7085dcf4ed096a6ad2e3ad89eaae from master 25 February 2021, 19:30:29 UTC
7fffdc4 [3.1.x] Updated links to DEPs. Backport of 7cc6899d4176539e5d59a2e921b938904d3a8944 from master 25 February 2021, 16:27:54 UTC
3668da8 [3.1.x] Added CVE-2021-23336 to security archive. Backport of ab58f072502e86dfe21b2bd5cccdc5e94dce8d26 from master 19 February 2021, 10:05:36 UTC
87481ea [3.1.x] Post-release version bump. 19 February 2021, 08:40:16 UTC
56f2ccc [3.1.x] Bumped version for 3.1.7 release. 19 February 2021, 08:39:23 UTC
8f6d431 [3.1.x] Fixed CVE-2021-23336 -- Fixed web cache poisoning via django.utils.http.limited_parse_qsl(). 18 February 2021, 09:15:30 UTC
536d117 [3.1.x] Added documentation extlink for bugs.python.org. Backport of d02d60eb0f032c9395199fb73c6cd29ee9bb2646 from master 17 February 2021, 13:26:48 UTC
921ffcb [3.1.x] Fixed #32438 -- Fixed typo in docs/topics/testing/tools.txt. Backport of e412b288455dd3ea6f1d65c8ec5d01751e489976 from master 12 February 2021, 08:21:42 UTC
b1416cb [3.1.x] Fixed #32430 -- Doc'd base class-based views. Backport of 6ee86a12ee29fcd4f3d7c9f1ad6de8cde4637b06 from master 08 February 2021, 16:34:24 UTC
4f5e550 [3.1.x] Fixed #32408 -- Doc'd django.views.generic.detail.BaseDetailView. Backport of de4492fbb1e48f8b258baa182220d4247f345177 from master 08 February 2021, 06:09:09 UTC
efaf9f4 [3.1.x] Fixed backends.postgresql.tests.Tests.test_nodb_cursor_raises_postgres_authentication_failure(). Follow up to 9efe832ee1e5da326e4ee5ed370db963b8fe6624. 05 February 2021, 05:08:08 UTC
5dec57a [3.1.x] Fixed #31550 -- Adjusted ASGI test_file_response for various Windows content types. Backport of 76181308fb02e67794d0cc1471766a5d7e4c877e from master 04 February 2021, 20:58:38 UTC
30b7717 [3.1.x] Corrected typo in advice to new contributors. Backport of e48e78738e224a056df57b7cb08bd48ac0e54f60 from master 04 February 2021, 15:03:26 UTC
526a6f0 [3.1.x] Refs #32412 -- Adjusted link from tutorial to reference docs. The writing code index page is a better location for a newer contributor to land, than the specific patch guidelines subpage. Backport of aa29c57beea7e8e570f8a597ea806ca3e2b3431d from master 04 February 2021, 09:39:22 UTC
fdeca77 [3.1.x] Refs #32412 -- Adjusted beginning of Advice for new contributors. With the goal of guiding folks to the right destination: * Improved wording of tutorial call-out. * Added summary of page purpose. * Added link to Writing code reference doc. Backport of e733c9ac1746cedc78efabff340379f1c9ee47da from master 04 February 2021, 09:39:18 UTC
9efe832 [3.1.x] Fixed #32403 -- Fixed re-raising DatabaseErrors when using only 'postgres' database. Thanks Kazantcev Andrey for the report. Regression in f48f671223a20b161ca819cf7d6298e43b8ba5fe. Backport of f131841c601b9d4884adcdb284b4213c2ad89231 from master 02 February 2021, 20:36:06 UTC
2d560af [3.1.x] Fixed typo in docs/ref/forms/widgets.txt. Backport of f9cfd346f0222d86bfbac26ef5455806965bae6b from master 01 February 2021, 11:05:49 UTC
65d4c59 [3.1.x] Added stub release notes for 3.1.7. Backport of 8d3c3a57174a072479978d60f5ecdb9fd3c2fd23 from master 01 February 2021, 09:55:28 UTC
a930e77 [3.1.x] Added CVE-2021-3281 to security archive. Backport of f749148d62ece28d208ab66b109f858215ba090a from master 01 February 2021, 09:46:17 UTC
69a40b6 [3.1.x] Post-release version bump. 01 February 2021, 08:47:27 UTC
3235a7b [3.1.x] Bumped version for 3.1.6 release. 01 February 2021, 08:33:22 UTC
02e6592 [3.1.x] Fixed CVE-2021-3281 -- Fixed potential directory-traversal via archive.extract(). Thanks Florian Apolloner, Shai Berger, and Simon Charette for reviews. Thanks Wang Baohua for the report. Backport of 05413afa8c18cdb978fcdf470e09f7a12b234a23 from master. 01 February 2021, 08:13:58 UTC
03a8678 [3.1.x] Fixed GeoIPTest.test04_city() failure with the latest GeoIP2 database. Backport of 135c800fe6138d7818501a384c0ebbdc5442762c from master 29 January 2021, 10:03:04 UTC
a271d8c [3.1.x] Modernized custom manager example Since this example was added 15 years ago in a8ccdd0fcd631e8e928ef20547e1fe3e313dc607, the ORM has gained the ability to do the `COUNT(*)` related query, so do it with the ORM to avoid misleading users that raw SQL is only supported from manager methods. Backport of 59e503b6708d41a44f2aa320272de3e2ecb5d65c from master 28 January 2021, 15:02:15 UTC
82e1294 [3.1.x] Fixed #32391 -- Used CSS flex properties for changelist filter. Matched layout adjustment using flex from admin sidebar added in d24ba1be7a53a113d19e2860c03aff9922efec24. Filters would become squashed when viewport was constrained or list display table became too wide. Backport of 269a76714616fd7ad166a14113f3354bab8d9b65 from master 28 January 2021, 14:55:51 UTC
b920945 [3.1.x] Fixed #32388 -- Clarified QuerySet.bulk_update() caveat about duplicates for multiple batches. Backport of 241da3f06ee0c6f436341cda5890b221ac453e3b from master 28 January 2021, 07:07:33 UTC
fa203f1 [3.1.x] Fixed #32348, Refs #29087 -- Corrected tutorial for updated deleting inlines UI. Updated tutorial to match change in 24e540fbd71bd2b0843e751bde61ad0052a811b3 allowing deletion of original extra inlines. Backport of f4272d000af598018247fe9687dac0fd02a29a7c from master 27 January 2021, 07:48:14 UTC
18adc89 [3.1.x] Refs #32372 -- Updated manager name in related objects reference docs. Follow up to 725c549ae7a34d83447201da7190f8d71c7fc2fc. Backport of 2b4b6c8af0aae8785bc1347cf1be2e8e70fd5ff3 from master 22 January 2021, 19:20:04 UTC
cc5ee23 [3.1.x] Fixed #32372 -- Made examples in related objects reference docs consistent. Backport of 725c549ae7a34d83447201da7190f8d71c7fc2fc from master 22 January 2021, 05:53:34 UTC
2a74248 [3.1.x] Fixed #32371 -- Doc'd jquery.init.js dependency for admin widgets. Backport of 7b3ec6bcc8309d5b2003d355fe6f78af89cfeb52 from master 20 January 2021, 21:08:31 UTC
ed616ff [3.1.x] Fixed cross-link in CBV topic documentation. Backport of 7072bff1fd13ea706b2dc0ca10feef755872eb68 from master 14 January 2021, 10:19:29 UTC
fdbcbc3 [3.1.x] Removed unused import in docs/ref/models/expressions.txt. Backport of fdc3d9dcaf87fb0a1350154561053faa331c3b69 from master 12 January 2021, 09:54:03 UTC
1dd159f [3.1.x] Fixed #32313 -- Corrected QuerySet.in_bulk() signature. Backport of 02391bc98c406f3cd5e329d252ec5c4b63cf979e from master 11 January 2021, 07:02:03 UTC
2b443cb [3.1.x] Fixed #32315 -- Doc'd FieldFile.path. Backport of 3eb98743dcaa0b7abd2d5832cba8cc9cb586a964 from master 07 January 2021, 11:53:04 UTC
6d3a623 [3.1.x] Fixed #32310 -- Fixed note about reverse accessors for intermediate table for self-referential ManyToManyField. Backport of 2d6c9b97bc706aab1975f57e814461e90e389bb0 from master 04 January 2021, 21:21:17 UTC
e080bf4 [3.1.x] Post-release version bump. 04 January 2021, 08:01:30 UTC
622e37c [3.1.x] Added stub release notes for 3.1.6. Backport of 966ed414b2adfc9ecc26a9d529dec99d94262cd9 from master 04 January 2021, 07:59:11 UTC
f244d86 [3.1.x] Bumped version for 3.1.5 release. 04 January 2021, 07:47:51 UTC
3bfe6da Added release date for 3.1.5. Backport of 767917ed4901ca076572c7ec6806b91fb7581fdb from master. 04 January 2021, 07:43:07 UTC
f4db2d1 [3.1.x] Refs #28741 -- Doc'd SESSION_COOKIE_DOMAIN requirement with CSRF_USE_SESSIONS. Similar considerations as refs #32065, again adding some nuance to afd375fc343baa46e61036087bc43b3d096bb0ca. Backport of 2e7ba6057cfc82a15a22b6021cd60cf307152e2d from master 04 January 2021, 07:17:46 UTC
a7e2f6c [3.1.x] Fixed typo in docs/ref/templates/builtins.txt. Backport of 3363cf42255b7a960902ab561613460ebe777331 from master 04 January 2021, 06:35:34 UTC
558c100 [3.1.x] Updated CVE URL. Backport of 656b331b13e08e82bbf0b88d39080c5b1a02109c from master 02 January 2021, 11:49:36 UTC
5fdc81d [3.1.x] Fixed #32304 -- Fixed prefixing STATIC_URL and MEDIA_URL by SCRIPT_NAME for absolute URLs with no domain. Thanks Adam Hooper for the report. Regression in c574bec0929cd2527268c96a492d25223a9fd576. Backport of e13b71403bd1568abed237858127677144d43d23 from master 31 December 2020, 12:19:34 UTC
6b4b7da [3.1.x] Fixed #32299 -- Prevented mutating handlers when processing middlewares marking as unused in an async context. Thanks Hubert Bielenia for the report. Backport of 98ad327864aed8df245fd19ea9d2743279e11643 from master 29 December 2020, 08:06:03 UTC
3029e22 [3.1.x] Corrected related fields checks messages in docs. Backport of 72d04e03855536cf36090aedbb7aa8f1c4c8b443 from master 29 December 2020, 08:06:03 UTC
6165e23 [3.1.x] Refs #30367 -- Changed remaining "pip install" to "python -m pip install" in docs. Backport of 429d089d0a8fbd400e0c010708df4f0d16218970 from master. 23 December 2020, 16:23:35 UTC
e5273bc [3.1.x] Removed forms-MAX_NUM_FORMS POST data in docs The field is ignored server-side and only exists as a client-side convenience. Removing it slightly simplifies the documentation and avoids some distractions. Added note:: for MIN_NUM_FORMS/MAX_NUM_FORMS in Understanding the management form section. Co-authored-by: Carlton Gibson <carlton.gibson@noumenal.es> Backport of d3b3eb860dc140c56022704672e7f54fa8a0c648 from master 23 December 2020, 16:19:00 UTC
db1d188 [3.1.x] Corrected code-block directives in docs/ref/models/meta.txt. Backport of fe886eee36be8022f34cfe59aa61ff1c21fe01d9 from master 21 December 2020, 06:58:56 UTC
2332a05 [3.1.x] Fixed typo in docs/ref/files/storage.txt. Backport of 1190af5071775249b57c33f4d27d6c6481949d75 from master 21 December 2020, 06:35:48 UTC
915fe98 [3.1.x] Updated isort URL to new location. Backport of 28d998a41c92bdac8eeae6509ecc87ed044b30d0 from master 20 December 2020, 10:01:16 UTC
b044b41 [3.1.x] Refs #30181 -- Corrected note about storing None in the cache. Backport of d23dad5778b3610a5f870b4757ba628780924dd1 from master 17 December 2020, 09:39:21 UTC
da42df9 [3.1.x] Fixed #32273 -- Doc'd AdminSite.unregister(). Backport of bebd4cfa8f5e0d2dff2de5e50d86e849a40f4bb2 from master 16 December 2020, 07:10:44 UTC
1fb9979 [3.1.x] Fixed typo in docs/ref/forms/widgets.txt. Thanks rgs258 for the report. Backport of 0ecc70b15aa3831c3945f55c1139ae15900b6104 from master 15 December 2020, 20:14:06 UTC
3d28bee [3.1.x] Corrected formatting in settings docs. Backport of 0ed6f3ba4b9d883ad0d961c6e65c455c3379e1b9 from master 15 December 2020, 11:09:38 UTC
5d41fd2 [3.1.x] Added backticks to code literals in various docs. Backport of 550297d20d085bc5a440d905cd3cb2e286588ca8 from master 15 December 2020, 06:21:53 UTC
092a25d [3.1.x] Removed redundant sentence in 'check' management command docs. Backport of 187e088b48449a9d3535c85e407f070a4ebc94ef from master 14 December 2020, 05:32:30 UTC
50f436b [3.1.x] Corrected docs regarding attributes required for logging in to the admin. Regression in 939dcff24f8e97d114595b102fb12348da482135. Backport of 991dce4fc5b656e04af08a595181bd576f2bd857 from master 11 December 2020, 22:14:12 UTC
a891e1b [3.1.x] Fixed #32252 -- Fixed __isnull=True on key transforms on SQLite and Oracle. __isnull=True on key transforms should not match keys with NULL values. Backport of 8d7085e0fd004af5431389f3d903aba6220d7957 from master 11 December 2020, 10:18:15 UTC
ce7f8c2 [3.1.x] Adjusted formatting of ngettext docs code examples. Backport of 62f477d1712575f831e96e6868ed1d96030601be from master 08 December 2020, 11:13:01 UTC
d3e3d63 [3.1.x] Added stub release notes for 3.1.5. Backport of adb40d217ec57ade46b1394cfbf3c513dc669445 from master 01 December 2020, 06:19:22 UTC
68646e7 [3.1.x] Post-release version bump. 01 December 2020, 06:01:24 UTC
fa206fe [3.1.x] Bumped version for 3.1.4 release. 01 December 2020, 05:32:31 UTC
0313af7 [3.1.x] Added release date for 3.1.4. Backport of 670261b8d6d8196943013ebe9698f99fd9dde43c from master 01 December 2020, 05:25:27 UTC
51fa5a9 [3.1.x] Fixed #32232 -- Fixed typo in docs/ref/contrib/admin/actions.txt. Backport of 55fabc53373a8c7ef31d8c4cffd2a07be0a88c2e from master 30 November 2020, 09:08:11 UTC
2ab8b5f [3.1.x] Refs #32230 -- Fixed LayerMapping example in GeoDjango tutorial. LayerMapping.data_source doesn't support pathlib.Path(). Regression in 26554cf5d1e96db10d0d5f4b69683a22fb82fdf8. Follow up to e46ca51c249677c52e04db28fc0c60ae1948b3b2. 28 November 2020, 08:22:34 UTC
3a70c36 [3.1.x] Refs #32230 -- Fixed DataSource example in GeoDjango tutorial. DataSource.ds_input doesn't support pathlib.Path(). Regression in 26554cf5d1e96db10d0d5f4b69683a22fb82fdf8. Backport of e46ca51c249677c52e04db28fc0c60ae1948b3b2 from master 27 November 2020, 06:00:30 UTC
a7935fe [3.1.x] Fixed #32203 -- Fixed QuerySet.values()/values_list() crash on key transforms with non-string values on SQLite. Thanks Gordon Wrigley for the report. Backport of fe6e5824218bab7cf47dee112d68325b338f9947 from master 25 November 2020, 19:30:38 UTC
a2abeb3 [3.1.x] Refs #32203 -- Added tests for QuerySet.values()/values_list() on key transforms with non-trivial values. Backport of 7408c4cd157ae18971302a2baf7aacce7c204a09 from master 25 November 2020, 19:30:30 UTC
97bfe0c [3.1.x] Fixed #32224 -- Avoided suppressing connection errors in supports_json_field on SQLite. Regression in 6789ded0a6ab797f0dcdfa6ad5d1cfa46e23abcd. Thanks Juan Garcia Alvite for the report. Backport of f5e5aac59ebbcea46b98d37834915de0f43d7cc8 from master 25 November 2020, 11:21:29 UTC
a582ef8 [3.1.x] Added test for filtering JSONField key transforms with quoted strings. Backport of bec415b290b68c07adcd9c67631b6573666d76be from master 25 November 2020, 05:55:39 UTC
back to top