7315 Commits

Author SHA1 Message Date
Claude Paroz
78f4830056 [1.9.x] Fixed #26308 -- Prevented crash with binary URLs in is_safe_url()
This fixes a regression introduced by c5544d28923.
Thanks John Eskew for the reporti and Tim Graham for the review.
Backport of ada7a4aef from master.
2016-03-04 21:15:44 +01:00
Alasdair Nicol
6679cdd92c [1.9.x] Fixed #26303 -- Updated links to mod_wsgi docs.
Backport of 8c42cf0cbd87f344748423f235938dd6ade03f55 from master
2016-03-01 19:22:54 -05:00
Florian Apolloner
af7d09b0c5 [1.9.x] Fixed CVE-2016-2513 -- Fixed user enumeration timing attack during login.
This is a security fix.
2016-03-01 11:38:49 -05:00
Mark Striemer
fc6d147a63 [1.9.x] Fixed CVE-2016-2512 -- Prevented spoofing is_safe_url() with basic auth.
This is a security fix.
2016-03-01 11:38:49 -05:00
Simon Charette
48cf751640 [1.9.x] Fixed #26186 -- Documented how app relative relationships of abstract models behave.
This partially reverts commit bc7d201bdbaeac14a49f51a9ef292d6312b4c45e.

Thanks Tim for the review.

Refs #25858.

Backport of 0223e213dd690b6b6e0669f836a20efb10998c83 from master
2016-02-29 22:13:54 -05:00
Simon Charette
ba6f83ec95 [1.9.x] Fixed #26286 -- Prevented content type managers from sharing their cache.
This should prevent managers methods from returning content type instances
registered to foreign apps now that these managers are also attached to models
created during migration phases.

Thanks Tim for the review.

Refs #23822.

Backport of 3938b3ccaa85f1c366909a4839696007726a09da from master
2016-02-26 16:22:17 -05:00
Ivan Tsouvarev
cd46947ddb [1.9.x] Fixed #26280 -- Fixed cached template loader crash when loading nonexistent template.
Backport of 8890c533e0b53cb0021bd5faf15668430cd3075a from master
2016-02-26 08:02:34 -05:00
Jon Dufresne
04780e8a25 [1.9.x] Fixed #26267 -- Fixed BoundField to reallow slices of subwidgets.
Backport of b41268135995cef46d40e550f9301fab20cf330d from master
2016-02-24 07:03:24 -05:00
Tim Graham
3fedfc452f [1.9.x] Fixed #26253 -- Fixed crashing deprecation shims in SimpleTemplateResponse.
Thanks David Reitter for the report and initial patch.
2016-02-22 17:07:07 -05:00
Tim Graham
07ffee6411 [1.9.x] Fixed #26204 -- Reallowed dashes in top-level domains for URLValidator.
Thanks Shai Berger for the review.

Backport of b1afebf882db5296cd9dcea26ee66d5250922e53 from master
2016-02-18 19:51:29 -05:00
Akshesh
0d2b97ca18 [1.9.x] Fixed #26219 -- Fixed crash when filtering by Decimal in RawQuery.
Backport of fdccc02576ae5a524338f65e629948604d80b4c8 from master
2016-02-17 14:00:38 -05:00
Berker Peksag
f78892f2de [1.9.x] Refs #19353 -- Added tests for using custom user models with built-in auth forms.
Also updated topics/auth/customizing.txt to reflect that subclasses of
UserCreationForm and UserChangeForm can be used with custom user models.

Thanks Baptiste Mispelon for the initial documentation.

Backport of f0425c72601f466c6a71518749c6d15b94945514 from master
2016-02-17 10:42:54 -05:00
Claude Paroz
205cafd01e [1.9.x] Fixed #26215 -- Fixed RangeField/ArrayField serialization with None values
Also added tests for HStoreField and JSONField.
Thanks Aleksey Bukin for the report and Tim Graham for the initial patch and
the review.
Backport of 928c12eb1 from master.
2016-02-16 21:09:16 +01:00
Alexey Kotlyarov
765e6c411c [1.9.x] Fixed #26212 -- Made forms.FileField and translation.lazy_number() picklable.
Backport of b59f963ad2a49322725b20fac71661bd49643443 from master
2016-02-15 11:45:44 -05:00
Berker Peksag
33b5bb7930 [1.9.x] Fixed #26126 -- Fixed transient failure of test_max_age_expiration
Backport of b17a9150a0c3a132e82b53755ede62a45f897875 from master
2016-02-15 09:26:58 -05:00
Anssi Kääriäinen
1d9ee181fe [1.9.x] Fixed #26196 -- Made sure __in lookups use to_field as default.
Thanks Simon Charette for the test.

Backport of 46ecfb9b3a11a360724e3375ba78c33c46d6a992 from master
2016-02-11 11:09:55 -05:00
Anssi Kääriäinen
25496f0f7b [1.9.x] Fixed #26153 -- Reallowed Q-objects in ForeignObject.get_extra_descriptor_filter().
Backport of 353aecbf8c1a8cc6f3985149e2895d49e53dfc1c from master
2016-02-11 09:00:38 -05:00
Simon Charette
58723722e9 Fixed #26162 -- Checked query name clashes of hidden relationships.
Although reverse accessor clashes should be skipped query name can't be hidden.

Thanks to Ian Foote and Tim Graham for the review.
2016-02-08 10:31:01 -05:00
Tim Graham
6b689a505c [1.9.x] Fixed #26177 -- Fixed a PostgreSQL crash with TIME_ZONE=None and USE_TZ=False.
Backport of 97eb3356b2a7488c8d0ca0e47ef3e538852d44a2 from master
2016-02-08 07:41:56 -05:00
Blake Griffith
daa80aceec [1.9.x] Changed gypsy to manouche in docs and tests.
"Gypsy" is considered a slur by the Romani people whom it refers to.
"manouche jazz" is used in place of "gypsy jazz" and is an accepted
term for the same genre of music.

Backport of 5fdbd9e36c861cb9f2cdb255a1bf693de8876f6b from master
2016-02-03 09:48:01 -05:00
Buddy Lindsey, Jr
3a063b0dcc [1.9.x] Fixed #26155 -- Skipped URL checks if no ROOTURL_CONF setting.
Backport of 731bdfe68ae8dd332702b1838db44f0efe433e2e from master
2016-02-01 14:00:08 -05:00
Myk Willis
adbca5e4db [1.9.x] Fixed incorrect permissions check for admin's "Save as new".
This is a security fix.
2016-02-01 12:05:08 -05:00
Tim Graham
01db3249e5 [1.9.x] Fixed #26129 -- Made invalid forms display initial values of disabled fields.
Backport of 04564eb74d2d92eaf88b22ab8cec7ef45978111e from master
2016-01-29 08:08:04 -05:00
Tim Graham
efd8554815 [1.9.x] Fixed #20415 -- Ensured srid isn't localized in OpenLayers JavaScript.
Backport of 19d1cb14519186902d7e27813bf2643fe3f7cfa3 from master
2016-01-28 18:02:10 -05:00
Tim Graham
61452616ba [1.9.x] Fixed #26147 -- Relaxed expected values in GIS tests to account for database/library differences.
Backport of 5aa53286758fbb1fb864a5efda38718a2ca96759 from master
2016-01-28 14:38:27 -05:00
Yoong Kang Lim
ca6830c49f [1.9.x] Added a missing test method in tests/migrations/test_writer.py.
Backport of 5453aa66cfdf228f40dc1997d811ca986de405a3 from master
2016-01-28 10:38:57 -05:00
Claude Paroz
ca6ab72bb7 [1.9.x] Fixed #26138 -- Ensured geometry_field's geometry is always serialized
Thanks Bernd Schlapsi for the report.
Backport of 54236a2c1c from master.
2016-01-28 08:52:28 +01:00
Ben Kraft
dee5896b55 [1.9.x] Fixed #26122 -- Fixed copying a LazyObject
Shallow copying of `django.utils.functional.LazyObject` or its subclasses has
been broken in a couple of different ways in the past, most recently due to
35355a4.

Backport of 13023ba86746980aace2341ba32a9419e7567751 from master
2016-01-26 06:57:27 -05:00
Preston Timmons
218cc71073 [1.9.x] Fixed #25848 -- Set template origin on each node.
Prior to 55f12f8709, the template origin was available on each node via
`self.token.source[0]`. This behavior was removed when debug handling was
simplified, but 3rd-party debugging tools still depend on its presence.
This updates the Parser to set origin on individual nodes. This enables the
source template to be determined even when template extending or including is
used.

Backport of cfda1fa3f8d95f0f4a369da9021dbd770e5fa44a from master
2016-01-26 06:23:51 -05:00
Simon Charette
645fddcd4e [1.9.x] Refs #24919 -- Used the documented way of disabling migrations per app.
Backport of 477274acb46b2f07666e9f84dea2e65ea6b63ad3 from master
2016-01-25 22:02:51 -05:00
Simon Charette
abdbf00815 [1.9.x] Fixed #26135 -- Adjusted the migration questioner's handling of disabled apps.
This was causing an issue when calling the `migrate` command in a test case with
the `available_apps` attribute pointing to an application with migrations
disabled using the `MIGRATION_MODULES` setting.

Thanks to Tim Graham for the review.

Refs #24919

Backport of 4dcaa5871b70859952c6f9c437dfe1b5f10509f2 from master
2016-01-25 22:02:45 -05:00
Chris Lamb
3306106fb1 [1.9.x] Fixed #25968 -- Changed project/app templates to use a "py-tpl" suffix.
Debian packages unconditionally byte-compile .py files on installation and
do not silence errors by design. Therefore, we need a way of shipping these
invalid .py files without a .py extension but ensuring that when we
template them, they end up as .py.

We don't special-case .py files so that the all the TemplateCommand
command-line options (eg. extra_files and extensions) still work entirely
as expected and it may even be useful for other formats too.

Backport of abc0777b63057e2ff97eee2ff184356051e14c47 from master
2016-01-25 12:44:14 -05:00
Mingun Pak
74db1378d5 [1.9.x] Fixed typos in test comments.
Backport of 4c912d184d5ba2ae7355fd8dacb70a0366b8f23b from master
2016-01-23 12:46:14 -05:00
Tim Graham
1aee5e8582 [1.9.x] Fixed #26116 -- Corrected schema's test_alter_implicit_id_to_explicit.
AUTOINCREMENT is dropped converting an AutoField to IntegerField
which isn't the point of this test. MySQL would warn or error about
this.

Backport of b49cc8664306f8b44e9e12ebb9e43791d508ec74 from master
2016-01-22 13:08:46 -05:00
Luke Plant
b5c4972283 [1.9.x] Changed action="." to action="" in tests and docs.
`action="."` strips query parameters from the URL which is not usually what
you want. Copy-paste coding of these examples could lead to difficult to
track down bugs or even data loss if the query parameter was meant to alter
the scope of a form's POST request.

Backport of 77974a684a2e874bccd8bd9e0939ddcb367a8ed2 from master
2016-01-21 14:00:06 -05:00
Alexander Gaevsky
be3169d6ed [1.9.x] Fixed #26060 -- Fixed crash with reverse OneToOneField in ModelAdmin.readonly_fields.
Backport of 9a33d3d76497d9e198de942ee1236c452231262f from master
2016-01-21 13:22:02 -05:00
Tim Graham
c9d1d5593b [1.9.x] Refs #26092 -- Added @skipUnlessDBFeature to a test.
Backport of fb4272f0e6bbdaa3e19ed5fde59fdb5ab5a33baf from master
2016-01-21 08:07:09 -05:00
Aymeric Augustin
cfe4ba6e90 [1.9.x] Fixed #26063 -- Crash when passing > 2000 params.
If SQLITE_MAX_VARIABLE_NUMBER (default = 999) is changed at compile time
to be greater than SQLITE_MAX_COLUMN (default = 2000), which Debian does
by setting the former to 250000, Django raised an exception on queries
containing more than 2000 parameters when DEBUG = True.

Backport of f91b5a7e4b from master
2016-01-21 10:48:47 +01:00
Anssi Kääriäinen
05e8fa83c3 [1.9.x] Fixed #26092 -- Fixed QuerySet.order_by() regression with an M2M through model.
Backport of ee596888e1149864e7828f5cf63c0eda395744c3 from master
2016-01-20 19:16:18 -05:00
chemary
076d459110 [1.9.x] Fixed #26094 -- Fixed CSRF behind a proxy (settings.USE_X_FORWARDED_PORT=True).
Backport of 2d28144c9519f4e4397c70f045c2b1d31437bf69 from master
2016-01-20 18:23:55 -05:00
Alberto Avila
16a52cff32 [1.9.x] Refs #26071 -- Added test for __in lookup in a Case expression.
Forwardport of 5b3c66d8b64add684489f5010e43de73e7acdd04 from stable/1.8.x
2016-01-13 08:53:01 -05:00
pp
1cbc556bce [1.9.x] Added missing period to "etc.".
Backport of b34ff66e5bae3760273255fa5b2525eb21a5eb63 from master
2016-01-11 18:05:56 -05:00
Simon Charette
27ef6403c8 [1.9.x] Fixed #25858 -- Bound abstract model application relative relationships.
Thanks to Karl Hobley for the report and Markus, Shai, Aymeric for their input
and Tim for the review.

Backport of bc7d201bdbaeac14a49f51a9ef292d6312b4c45e from master
2016-01-11 14:08:50 -05:00
Alexander Gaevsky
cb96d0c92a [1.9.x] Added a test for adding a UUID pk object using the "Add related" admin popup.
Follow up to refs #25997 but this case wasn't broken.

Backport of 5052f79df45d843d1e44dcc47152ed503220098f from master
2016-01-08 18:54:40 -05:00
Tim Graham
3d324b9614 [1.9.x] Fixed #26034 -- Fixed incorrect index handling on PostgreSQL on Char/TextField with unique=True and db_index=True.
Thanks Simon Charette for review.

Backport of 56aaae58a746eb39d5e92ba60f59f4c750a8e1a8 from master
2016-01-08 14:20:53 -05:00
Tim Graham
20c8cc2bf5 [1.9.x] Added a helper function in schema tests.
Backport of 54d3ba84066301b9cdbbd657620c0f1e5c2422c0 from master
2016-01-08 14:16:22 -05:00
Alexander Gaevsky
a839d71d85 [1.9.x] Fixed #25997 -- Removed redundant escaping in admin's edit related model popup. 2016-01-08 11:06:56 -05:00
Claude Paroz
fe6d5689f2 [1.9.x] Fixed #26046 -- Fixed a crash with translations and Django-unknown language code
Thanks Jens Lundstrom for the report and Tim Graham for the review.
Backport of 632a9f21bc from master.
2016-01-06 20:33:26 +01:00
Scott Pashley
a7b69c8657 [1.9.x] Fixed #26035 -- Prevented user-tools from appearing on admin logout page.
Backport of 7cc2efc2d6916c05a0a5cb0c0e67f5405d8f6a03 from master
2016-01-06 13:52:25 -05:00
Tim Graham
2b17ac2469 [1.9.x] Skipped a dateformat test on Windows as needed.
Refs 1014ba026e879e56e0f265a8d9f54e6f39843348

Backport of 2765adc8dcbaa41662af9000c4de2820418bf0a2 from master
2016-01-05 13:12:09 -05:00