12010 Commits

Author SHA1 Message Date
Mariusz Felisiak
f9c7d48fdd [4.0.x] Fixed CVE-2022-23833 -- Fixed DoS possiblity in file uploads.
Thanks Alan Ryan for the report and initial patch.

Backport of fc18f36c4ab94399366ca2f2007b3692559a6f23 from main.
2022-02-01 07:44:49 +01:00
Markus Holtermann
0142204606 [4.0.x] Fixed CVE-2022-22818 -- Fixed possible XSS via {% debug %} template tag.
Thanks Keryn Knight for the report.

Backport of 394517f07886495efcf79f95c7ee402a9437bd68 from main.

Co-authored-by: Adam Johnson <me@adamj.eu>
2022-02-01 07:43:45 +01:00
Kirill Safronov
6928227dff [4.0.x] Fixed #33480 -- Fixed makemigrations crash when renaming field of renamed model.
Regression in aa4acc164d1247c0de515c959f7b09648b57dc42.

Backport of 97a72744681d0993b50dee952cf32cdf9650ad9f from main
2022-02-01 07:33:22 +01:00
Mariusz Felisiak
aff79be03a [4.0.x] Fixed #33468 -- Fixed QuerySet.aggregate() after annotate() crash on aggregates with default.
Thanks Adam Johnson for the report.
Backport of 71e7c8e73712419626f1c2b6ec036e8559a2d667 from main
2022-01-31 11:34:29 +01:00
Mariusz Felisiak
7c2d4d943b [4.0.x] Fixed #33462 -- Fixed migration crash when altering type of primary key with MTI and foreign key.
This prevents duplicated operations when altering type of primary key
with MTI and foreign key. Previously, a foreign key to the base model
was added twice, once directly and once by the inheritance model.

Thanks bcail for the report.

Regression in 325d7710ce9f6155bb55610ad6b4580d31263557.
Backport of e972620ada4f9ed7bc57f28e133e85c85b0a7b20 from main
2022-01-27 18:52:35 +01:00
Fabian Büchler
b32080219e [4.0.x] Fixed #33449 -- Fixed makemigrations crash on models without Meta.order_with_respect_to but with _order field.
Regression in aa4acc164d1247c0de515c959f7b09648b57dc42.

Backport of eeff1787b0aa23016e4844c0f537d5093a95a356 from main
2022-01-21 08:46:14 +01:00
Keryn Knight
c8a6bf951b [4.0.x] Fixed #33426 -- Fixed ResolverMatch.__repr_() for class-based views.
Regression in 7c08f26bf0439c1ed593b51b51ad847f7e262bc1.

Backport of f4b06a3cc1e54888ff86f36a1f9a3ddf21292314 from main
2022-01-10 18:39:59 +01:00
Keryn Knight
2ea0321058 [4.0.x] Fixed #33425 -- Fixed view name for CBVs on technical 404 debug page.
Regression in 0c0b87725bbcffca3bc3a7a2c649995695a5ae3b.

Backport of 2a66c102d9c674fadab252a28d8def32a8b626ec from main
2022-01-08 14:54:10 +01:00
David
c959aa99aa [4.0.x] Fixed #33419 -- Restored marking forms.Field.help_text as HTML safe.
Regression in 456466d932830b096d39806e291fe23ec5ed38d5.

Thanks Matt Westcott for the report.

Backport of 4c60c3edff4312303e1021fca47ed52c2152d285 from main
2022-01-07 16:12:15 +01:00
Petter Friberg
11475958f6 [4.0.x] Fixed #33410 -- Fixed recursive capturing of callbacks by TestCase.captureOnCommitCallbacks().
Regression in d89f976bddb49fb168334960acc8979c3de991fa.

Backport of bc174e6ea0ce676c5a7f467bda9739e6ef6b6186 from main
2022-01-07 16:12:01 +01:00
Florian Apolloner
e1592e0f26 [4.0.x] Fixed CVE-2021-45452 -- Fixed potential path traversal in storage subsystem.
Thanks to Dennis Brinkrolf for the report.
2022-01-04 10:10:14 +01:00
Florian Apolloner
2a8ec7f546 [4.0.x] Fixed CVE-2021-45116 -- Fixed potential information disclosure in dictsort template filter.
Thanks to Dennis Brinkrolf for the report.

Co-authored-by: Adam Johnson <me@adamj.eu>
2022-01-04 10:10:14 +01:00
Florian Apolloner
df79ef03ac [4.0.x] Fixed CVE-2021-45115 -- Prevented DoS vector in UserAttributeSimilarityValidator.
Thanks Chris Bailey for the report.

Co-authored-by: Adam Johnson <me@adamj.eu>
2022-01-04 10:10:14 +01:00
Mariusz Felisiak
b5f60ef5a7 [4.0.x] Refs #32355 -- Bumped required psycopg2 version to 2.8.4.
psycopg2 2.8.4 is the first release to support Python 3.8.
Backport of ca04659b4b3f042c1bc7e557c25ed91e3c56c745 from main
2021-12-22 20:33:49 +01:00
Simon Charette
7e6a2e3b45 [4.0.x] Fixed #33366 -- Fixed case handling with swappable setting detection in migrations autodetector.
The migration framework uniquely identifies models by case insensitive
labels composed of their app label and model names and so does the app
registry in most of its methods (e.g. AppConfig.get_model) but it
wasn't the case for get_swappable_settings_name() until this change.

This likely slipped under the radar for so long and only regressed in
b9df2b74b98b4d63933e8061d3cfc1f6f39eb747 because prior to the changes
related to the usage of model states instead of rendered models in the
auto-detector the exact value settings value was never going through a
case folding hoop.

Thanks Andrew Chen Wang for the report and Keryn Knight for the
investigation.

Backport of 43289707809c814a70f0db38ca4f82f35f43dbfd from main
2021-12-17 10:00:33 +01:00
Mariusz Felisiak
c1d2e8b9b8 [4.0.x] Fixed #33350 -- Reallowed using cache decorators with duck-typed HttpRequest.
Regression in 3fd82a62415e748002435e7bad06b5017507777c.

Thanks Terence Honles for the report.
Backport of 40165eecc40f9e223702a41a0cb0958515bb1f82 from main
2021-12-16 20:14:17 +01:00
Jeremy Lainé
3b03bce122 [4.0.x] Fixed #33361 -- Fixed Redis cache backend crash on booleans.
Backport of 2f33217ea2cad688040dd6044cdda946c62e5b65 from main
2021-12-14 08:46:16 +01:00
Baptiste Mispelon
15031852c5 [4.0.x] Fixed #33346 -- Fixed SimpleTestCase.assertFormsetError() crash on a formset named "form".
Thanks OutOfFocus4 for the report.

Regression in 456466d932830b096d39806e291fe23ec5ed38d5.

Backport of cb383753c0e0eb52306e1024d32a782549c27e61 from main.
2021-12-08 21:13:00 +01:00
Mariusz Felisiak
01c0fb9d19 [4.0.x] Updated asgiref dependency for 4.0 release series.
Backport of 513441240f874dd0b6187c0c6aaa3e8eccd8ddbe from main
2021-12-07 09:55:18 +01:00
Florian Apolloner
20b9ad36ff [4.0.x] Fixed #30530, CVE-2021-44420 -- Fixed potential bypass of an upstream access control based on URL paths.
Thanks Sjoerd Job Postmus and TengMA(@te3t123) for reports.

Backport of d4dcd5b9dd9e462fec8220e33e3e6c822b7e88a6 from main.
2021-12-07 06:29:34 +01:00
Mariusz Felisiak
4c5215ab03
[4.0.x] Updated translations from Transifex.
This also fixes related i18n tests.

Co-authored-by: Claude Paroz <claude@2xlibre.net>
2021-12-06 20:29:53 +01:00
Hannes Ljungberg
fed7f992ac [4.0.x] Fixed #33335 -- Made model validation ignore functional unique constraints.
Regression in 3aa545281e0c0f9fac93753e3769df9e0334dbaa.

Thanks Hervé Le Roy for the report.

Backport of 1eaf38fa87384fe26d1abf6e389d6df1600d4d8c from main
2021-12-06 13:28:54 +01:00
Mariusz Felisiak
7bde53a7ae [4.0.x] Refs #33333 -- Fixed PickleabilityTestCase.test_annotation_with_callable_default() crash on Oracle.
Grouping by LOBs is not allowed on Oracle. This moves a binary field to
a separate model.
Backport of d3a64bea51676fcf8a0ae593cf7b103939e12c87 from main
2021-12-04 15:55:31 +01:00
Mariusz Felisiak
2c20883cb0 [4.0.x] Fixed #33333 -- Fixed setUpTestData() crash with models.BinaryField on PostgreSQL.
This makes models.BinaryField pickleable on PostgreSQL.

Regression in 3cf80d3fcf7446afdde16a2be515c423f720e54d.

Thanks Adam Zimmerman for the report.

Backport of 2c7846d992ca512d36a73f518205015c88ed088c from main.
2021-12-03 11:58:55 +01:00
Can Sarigol
d54aa49a7d [4.0.x] Fixed #33279 -- Fixed handling time zones with "-" sign in names.
Thanks yakimka for the report.

Regression in fde9b7d35e4e185903cc14aa587ca870037941b1.

Backport of 661316b066923493ff91d6d2aa92e463f595a6b1 from main.
2021-11-12 11:14:08 +01:00
Mariusz Felisiak
45de30dc69 [4.0.x] Refs #33263 -- Added warning to BaseDeleteView when delete() method is overridden.
Follow up to 3a45fea0832c5910acee6e0d29f230f347a50462.
Backport of 6bc437c0d82675ebe6aa92c8e249892205c316ef from main
2021-11-09 09:04:12 +01:00
Mariusz Felisiak
b7b3bbc835 [4.0.x] Fixed #33253 -- Reverted "Fixed #32319 -- Added ES module support to ManifestStaticFilesStorage."
This reverts commit 91e21836f667c784a8a63ab1f18d81f553e679cb.

`export` and `import` directives have several syntax variants and not
all of them were properly covered.

Thanks Hervé Le Roy for the report.
Backport of ba9ced3e9a643a05bc521f0a2e6d02e3569de374 from main
2021-11-05 12:11:59 +01:00
Carlton Gibson
499384b6d1 [4.0.x] Fixed #33237 -- Fixed detecting source maps in ManifestStaticFilesStorage for multiline files.
Switched regex to multiline mode in order to match per-line, rather
than against the whole file.

Thanks to Joseph Abrahams for the report.

Regression in 781b44240a06f0c868254f40f36ce46c927f56d1.

Backport of 4816dc942860caf076c7c85ea9dbfa8bfab212ff from main
2021-11-04 21:41:25 +01:00
Mariusz Felisiak
e2fe0429ab [4.0.x] Fixed #33234 -- Fixed autodetector crash for proxy models inheriting from non-model class.
Regression in aa4acc164d1247c0de515c959f7b09648b57dc42.

Thanks Kevin Marsh for the report.
Backport of dab48b7482295956973879d15bfd4d3bb0718772 from main
2021-11-02 15:35:52 +01:00
David Wobrock
ea00a0843e [4.0.x] Fixed #31503 -- Made autodetector remove unique/index_together before altering fields.
Backport of 0314593fe8e7dc685bbb6585eee40e755588864e from main
2021-10-25 10:45:35 +02:00
Hasan Ramezani
c9ebe4ca4e [4.0.x] Fixed #33205 -- Made call_command() raise TypeError when dest with multiple arguments is passed.
Backport of c1e4111c74ee9d9f48cbee5a5b7c40289203c93d from main
2021-10-25 10:09:06 +02:00
Mariusz Felisiak
a2e1cdc8ca [4.0.x] Fixed #33215 -- Confirmed support for GEOS 3.10.
Backport of 9231526af4b9825583b0d3cb943f88109fd30551 from main
2021-10-21 20:25:28 +02:00
Vinay Karanam
354bbf1fd2 [4.0.x] Fixed #33043 -- Made method_decorator() preserve wrapper assignments.
Regression in f434f5b84f7fcea9a76a551621ecce70786e2899.

Backport of 8806e8809e023017e6958b9fa0bbd960938e0a91 from main
2021-10-20 18:52:10 +02:00
David Smith
5d62beb61a [4.0.x] Refs #32956 -- Capitalized HTTP/HTTPS in comments, docs, and docstrings.
Backport of 7ef0bc922c0a78667ed8cbf5f85845b627ccbdf8 from main
2021-10-20 09:11:04 +02:00
David Smith
6aa917383f [4.0.x] Refs #32956 -- Changed docs to treat the acronym HTTP phonetically.
Backport of 69b0736fad1d1f0197409ca025b7bcdf5666ae62 from main
2021-10-19 06:33:00 +02:00
Hannes Ljungberg
00aa3e0b9b [4.0.x] Fixed #33194 -- Fixed migrations when altering a field with functional indexes/unique constraints on SQLite.
This adjusts Expressions.rename_table_references() to only update alias
when needed.

Regression in 83fcfc9ec8610540948815e127101f1206562ead.

Co-authored-by: Simon Charette <charettes@users.noreply.github.com>

Backport of 86971c40909430a798e4e55b140004c4b1fb02ff from main
2021-10-18 09:36:21 +02:00
Mariusz Felisiak
6a16d53039 [4.0.x] Refs #32074 -- Removed usage of deprecated asyncore and smtpd modules.
asyncore and smtpd modules were deprecated in Python 3.10.
Backport of 569a33579c3cca5f801c544d9b52a34e3c779424 from main
2021-10-15 09:58:53 +02:00
Martin Svoboda
dd8945d361 [4.0.x] Fixed #33008 -- Fixed prefetch_related() for deleted GenericForeignKeys.
Thanks Simon Charette for the implementation idea.

Backport of cc4cb95beff0b75ec169add7e94cc481624a41e6 from main
2021-10-14 13:07:24 +02:00
Mariusz Felisiak
8ab95364b5 [4.0.x] Refs #27131 -- Removed SMTPBackendTests.test_server_login().
test_server_login() was a regression test for a crash when passing
Unicode strings to SMTP server using CRAM-MD5 method on Python 2.
Python 2 is no longer supported and test_server_login() passes even
without FakeSMTPChannel.smtp_AUTH() because
smtplib.SMTPAuthenticationError is raised when AUTH is not implemented.
Backport of cdad96e6330cd31185f7496aaf8eb316f2773d6d from main
2021-10-14 11:37:53 +02:00
Christophe Henry
048fbf9c89 [4.0.x] Fixed #33178 -- Made createsuperuser validate required fields passed in options in interactive mode.
Backport of b1b26b37aff0c80d6abdf15c5ffdf0440a9a1d6a from main.
2021-10-12 08:43:56 +02:00
Christophe Henry
b55df4c74a [4.0.x] Refs #21755 -- Fixed createsuperuser crash for required foreign keys passed in options in interactive mode.
Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>

Backport of 4ff500f2948bfc332b3f4159021cad06e91943d3 from main
2021-10-12 07:43:17 +02:00
Mariusz Felisiak
224fa0bc7d [4.0.x] Refs #29628, Refs #33178 -- Made createsuperuser validate password against required fields passed in options.
Backport of da266b3c5ca4bb7581d7a3cc51bc820e78cf64f0 from main
2021-10-12 07:41:51 +02:00
Christophe Henry
f2a59630f4 [4.0.x] Fixed #33151 -- Fixed createsuperuser crash for many-to-many required fields in non-interactive mode.
Backport of df2d2bc95c451c6366fd522a5a1e6ed84f459f31 from main
2021-10-07 13:11:18 +02:00
Maxim Milovanov
f6c7e75cdf [4.0.x] Fixed #33156 -- Used sessionStorage to preserve quick filter for admin's navigation sidebar.
Backport of 1c802ca2a9d3c66fb723695fe7ea597fb4802402 from main
2021-10-06 09:02:45 +02:00
Nick Pope
fbcd7df120 [4.0.x] Fixed SpGistIndex tests on PostgreSQL 14+.
Backport of dd26362f6312e7ba7b04099b5285d8e1d2900e63 from main
2021-10-01 09:43:32 +02:00
Daniel Hahler
81bb0ae221 [4.0.x] Fixed #33160 -- Avoided suppressing query errors in _nodb_cursor() on PostgreSQL.
Backport of 98c8bf1ceeab5c68751c83555f82cff1a9120a67 from main
2021-10-01 07:24:45 +02:00
Aljaž Košir
0a49276065 [4.0.x] Fixed #33155 -- Made ModelChoiceIteratorValue instances hashable.
Backport of 7b8beeee3d45cafd7bec7ff3ee0e4371e142c36d from main
2021-09-30 12:09:24 +02:00
Mariusz Felisiak
93a42d43a6 [4.0.x] Fixed #33159 -- Reverted "Fixed #32970 -- Changed WhereNode.clone() to create a shallow copy of children."
This reverts commit e441847ecae99dd1ccd0d9ce76dbcff51afa863c.

A shallow copy is not enough because querysets can be reused and
evaluated in nested nodes, which shouldn't mutate JOIN aliases.

Thanks Michal Čihař for the report.
Backport of 903aaa35e5ceaa33bfc9b19b7f6da65ce5a91dd4 from main
2021-09-30 11:26:53 +02:00
David Wobrock
b2a0978610 [4.0.x] Fixed #33018 -- Fixed annotations with empty queryset.
Thanks Simon Charette for the review and implementation idea.

Backport of dd1fa3a31b4680c0d3712e6ae122b878138580c7 from main
2021-09-29 20:53:16 +02:00
David Wobrock
aab76433ed [4.0.x] Fixed #33141 -- Renamed Expression.empty_aggregate_value to empty_result_set_value.
Backport of ad36a198a12df4dff65992191b3eb0a474e2daac from main
2021-09-29 20:52:59 +02:00