[1.8.x] Added CVE-2018-7536,7 to the security release archive.

Backport of 5bbbdd26d1ea4f3bb164ad64b0d0d458d8bfdd02 from master

.gitignore

@@ -6,6 +6,8 @@ MANIFEST
 dist/
 docs/_build/
 docs/locale/
+node_modules/
 tests/coverage_html/
 tests/.coverage
 build/
+tests/report/

.hgignore

@@ -8,6 +8,8 @@ MANIFEST
 dist/
 docs/_build/
 docs/locale/
+node_modules/
 tests/coverage_html/
 tests/.coverage
 build/
+tests/report/

.tx/config

@@ -52,6 +52,11 @@ file_filter = django/contrib/messages/locale/<lang>/LC_MESSAGES/django.po
 source_file = django/contrib/messages/locale/en/LC_MESSAGES/django.po
 source_lang = en
 
+[django.contrib-postgres]
+file_filter = django/contrib/postgres/locale/<lang>/LC_MESSAGES/django.po
+source_file = django/contrib/postgres/locale/en/LC_MESSAGES/django.po
+source_lang = en
+
 [django.contrib-redirects]
 file_filter = django/contrib/redirects/locale/<lang>/LC_MESSAGES/django.po
 source_file = django/contrib/redirects/locale/en/LC_MESSAGES/django.po

AUTHORS

@@ -17,6 +17,7 @@ answer newbie questions, and generally made Django that much better:
     Ahmad Al-Ibrahim
     ajs <adi@sieker.info>
     Akis Kesoglou <akiskesoglou@gmail.com>
+    Aksel Ethem <aksel.ethem@gmail.com>
     alang@bright-green.com
     Alasdair Nicol <http://al.sdair.co.uk/>
     Albert Wang <aywang31@gmail.com>
@@ -280,6 +281,7 @@ answer newbie questions, and generally made Django that much better:
     Ian Clelland <clelland@gmail.com>
     Ian G. Kelly <ian.g.kelly@gmail.com>
     Ian Holsman <http://feh.holsman.net/>
+    Ian Lee <IanLee1521@gmail.com>
     Ibon <ibonso@gmail.com>
     Idan Gazit <idan@gazit.me>
     Igor Kolar <ike@email.si>
@@ -309,6 +311,7 @@ answer newbie questions, and generally made Django that much better:
     Jason Yan <tailofthesun@gmail.com>
     Javier Mansilla <javimansilla@gmail.com>
     Jay Parlar <parlar@gmail.com>
+    Jay Wineinger <jay.wineinger@gmail.com>
     J. Clifford Dyer <jcd@sdf.lonestar.org>
     jcrasta@gmail.com
     jdetaeye
@@ -338,6 +341,7 @@ answer newbie questions, and generally made Django that much better:
     john@calixto.net
     John D'Agostino <john.dagostino@gmail.com>
     John Huddleston <huddlej@wwu.edu>
+    John Moses <moses.john.r@gmail.com>
     John Paulett <john@paulett.org>
     John Shaffer <jshaffer2112@gmail.com>
     Jökull Sólberg Auðunsson <jokullsolberg@gmail.com>
@@ -430,11 +434,13 @@ answer newbie questions, and generally made Django that much better:
     Marian Andre <django@andre.sk>
     Marijn Vriens <marijn@metronomo.cl>
     Mario Gonzalez <gonzalemario@gmail.com>
+    Mariusz Felisiak <felisiak.mariusz@gmail.com>
     Mark Biggers <biggers@utsl.com>
     mark@junklight.com
     Mark Lavin <markdlavin@gmail.com>
     Mark Sandstrom <mark@deliciouslynerdy.com>
     Markus Holtermann <https://markusholtermann.eu>
+    Marten Kenbeek <marten.knbk+django@gmail.com>
     martin.glueck@gmail.com
     Martin Green
     Martin Kosír <martin@martinkosir.net>
@@ -452,6 +458,7 @@ answer newbie questions, and generally made Django that much better:
     Matt Deacalion Stevens <matt@dirtymonkey.co.uk>
     Matt Dennenbaum
     Matthew Flanagan <http://wadofstuff.blogspot.com>
+    Matthew Somerville <matthew-github@dracos.co.uk>
     Matthew Tretter <m@tthewwithanm.com>
     Matthias Kestenholz <mk@406.ch>
     Matthias Pronk <django@masida.nl>
@@ -491,6 +498,7 @@ answer newbie questions, and generally made Django that much better:
     mitakummaa@gmail.com
     mmarshall
     Moayad Mardini <moayad.m@gmail.com>
+    Moritz Sichert <moritz.sichert@googlemail.com>
     Morten Bagai <m@bagai.com>
     msaelices <msaelices@gmail.com>
     msundstr
@@ -511,6 +519,7 @@ answer newbie questions, and generally made Django that much better:
     Niclas Olofsson <n@niclasolofsson.se>
     Nicola Larosa <nico@teknico.net>
     Nicolas Lara <nicolaslara@gmail.com>
+    Nicolas Noé <nicolas@niconoe.eu>
     Niran Babalola <niran@niran.org>
     Nis Jørgensen <nis@superlativ.dk>
     Nowell Strite <http://nowell.strite.org/>
@@ -602,6 +611,7 @@ answer newbie questions, and generally made Django that much better:
     schwank@gmail.com
     Scot Hacker <shacker@birdhouse.org>
     Scott Barr <scott@divisionbyzero.com.au>
+    Scott Pashley <github@scottpashley.co.uk>
     scott@staplefish.com
     Sean Brant
     Sebastian Hillig <sebastian.hillig@gmail.com>
@@ -648,6 +658,7 @@ answer newbie questions, and generally made Django that much better:
     Terry Huang <terryh.tp@gmail.com>
     thebjorn <bp@datakortet.no>
     Thejaswi Puthraya <thejaswi.puthraya@gmail.com>
+    Thijs van Dien <thijs@vandien.net>
     Thomas Chaumeny <t.chaumeny@gmail.com>
     Thomas Güttler <hv@tbz-pariv.de>
     Thomas Kerpe <thomas@kerpe.net>
@@ -705,10 +716,12 @@ answer newbie questions, and generally made Django that much better:
     Wilson Miner <wminer@gmail.com>
     wojtek
     Xia Kai <http://blog.xiaket.org/>
+    Yann Fouillat <gagaro42@gmail.com>
     Yann Malet
     Yasushi Masuda <whosaysni@gmail.com>
     ye7cakf02@sneakemail.com
     ymasuda@ethercube.com
+    Yoong Kang Lim <yoongkang.lim@gmail.com>
     Zachary Voase <zacharyvoase@gmail.com>
     Zach Thompson <zthompson47@gmail.com>
     Zain Memon

MANIFEST.in

@@ -18,20 +18,9 @@ recursive-include django/contrib/*/locale *
 recursive-include django/contrib/admin/templates *
 recursive-include django/contrib/admin/static *
 recursive-include django/contrib/admindocs/templates *
-recursive-include django/contrib/auth/fixtures *
 recursive-include django/contrib/auth/templates *
-recursive-include django/contrib/auth/tests/templates *
-recursive-include django/contrib/flatpages/fixtures *
-recursive-include django/contrib/flatpages/tests/templates *
-recursive-include django/contrib/gis/gdal/tests/data *
 recursive-include django/contrib/gis/static *
 recursive-include django/contrib/gis/templates *
-recursive-include django/contrib/gis/tests/data *
-recursive-include django/contrib/gis/tests/distapp/fixtures *
-recursive-include django/contrib/gis/tests/geoapp/fixtures *
-recursive-include django/contrib/gis/tests/geogapp/fixtures *
-recursive-include django/contrib/gis/tests/relatedapp/fixtures *
 recursive-include django/contrib/sitemaps/templates *
-recursive-include django/contrib/sitemaps/tests/templates *
 recursive-exclude * __pycache__
 recursive-exclude * *.py[co]

README.rst

@@ -33,8 +33,8 @@ To get more help:
 
 To contribute to Django:
 
-* Check out https://www.djangoproject.com/community/ for information about
-  getting involved.
+* Check out https://docs.djangoproject.com/en/dev/internals/contributing/ for
+  information about getting involved.
 
 To run Django's test suite:
 

django/__init__.py

@@ -1,6 +1,6 @@
 from django.utils.version import get_version
 
-VERSION = (1, 8, 0, 'alpha', 0)
+VERSION = (1, 8, 20, 'alpha', 0)
 
 __version__ = get_version(VERSION)
 

django/apps/config.py

@@ -1,10 +1,9 @@
-from importlib import import_module
 import os
+from importlib import import_module
 
 from django.core.exceptions import AppRegistryNotReady, ImproperlyConfigured
-from django.utils.module_loading import module_has_submodule
 from django.utils._os import upath
-
+from django.utils.module_loading import module_has_submodule
 
 MODELS_MODULE_NAME = 'models'
 
@@ -110,9 +109,6 @@ class AppConfig(object):
 
         # If we're reaching this point, we must attempt to load the app config
         # class located at <mod_path>.<cls_name>
-
-        # Avoid django.utils.module_loading.import_by_path because it
-        # masks errors -- it reraises ImportError as ImproperlyConfigured.
         mod = import_module(mod_path)
         try:
             cls = getattr(mod, cls_name)

django/apps/registry.py

@@ -1,13 +1,13 @@
-from collections import Counter, defaultdict, OrderedDict
 import os
 import sys
 import threading
 import warnings
+from collections import Counter, OrderedDict, defaultdict
 
 from django.core.exceptions import AppRegistryNotReady, ImproperlyConfigured
 from django.utils import lru_cache
-from django.utils.deprecation import RemovedInDjango19Warning
 from django.utils._os import upath
+from django.utils.deprecation import RemovedInDjango19Warning
 
 from .config import AppConfig
 
@@ -213,7 +213,7 @@ class Apps(object):
                 warnings.warn(
                     "Model '%s.%s' was already registered. "
                     "Reloading models is not advised as it can lead to inconsistencies, "
-                    "most notably with related models." % (model_name, app_label),
+                    "most notably with related models." % (app_label, model_name),
                     RuntimeWarning, stacklevel=2)
             else:
                 raise RuntimeError(
@@ -344,7 +344,7 @@ class Apps(object):
             for model in self.get_models(include_auto_created=True):
                 model._meta._expire_cache()
 
-    ### DEPRECATED METHODS GO BELOW THIS LINE ###
+    # ### DEPRECATED METHODS GO BELOW THIS LINE ###
 
     def load_app(self, app_name):
         """

django/bin/django-2to3.py

@@ -1,9 +0,0 @@
-#!/usr/bin/env python
-
-# This works exactly like 2to3, except that it uses Django's fixers rather
-# than 2to3's built-in fixers.
-
-import sys
-from lib2to3.main import main
-
-sys.exit(main("django.utils.2to3_fixes"))

django/bin/profiling/gather_profile_stats.py

@@ -1,38 +0,0 @@
-#!/usr/bin/env python
-
-"""
-gather_profile_stats.py /path/to/dir/of/profiles
-
-Note that the aggregated profiles must be read with pstats.Stats, not
-hotshot.stats (the formats are incompatible)
-"""
-
-from hotshot import stats
-import os
-import pstats
-import sys
-
-
-def gather_stats(p):
-    profiles = {}
-    for f in os.listdir(p):
-        if f.endswith('.agg.prof'):
-            path = f[:-9]
-            prof = pstats.Stats(os.path.join(p, f))
-        elif f.endswith('.prof'):
-            bits = f.split('.')
-            path = ".".join(bits[:-3])
-            prof = stats.load(os.path.join(p, f))
-        else:
-            continue
-        print("Processing %s" % f)
-        if path in profiles:
-            profiles[path].add(prof)
-        else:
-            profiles[path] = prof
-        os.unlink(os.path.join(p, f))
-    for (path, prof) in profiles.items():
-        prof.dump_stats(os.path.join(p, "%s.agg.prof" % path))
-
-if __name__ == '__main__':
-    gather_stats(sys.argv[1])

django/bin/unique-messages.py

@@ -1,30 +0,0 @@
-#!/usr/bin/env python
-
-import os
-import sys
-
-
-def unique_messages():
-    basedir = None
-
-    if os.path.isdir(os.path.join('conf', 'locale')):
-        basedir = os.path.abspath(os.path.join('conf', 'locale'))
-    elif os.path.isdir('locale'):
-        basedir = os.path.abspath('locale')
-    else:
-        print("This script should be run from the Django Git tree or your project or app tree.")
-        sys.exit(1)
-
-    for (dirpath, dirnames, filenames) in os.walk(basedir):
-        for f in filenames:
-            if f.endswith('.po'):
-                sys.stderr.write('processing file %s in %s\n' % (f, dirpath))
-                pf = os.path.splitext(os.path.join(dirpath, f))[0]
-                cmd = 'msguniq "%s.po"' % pf
-                stdout = os.popen(cmd)
-                msg = stdout.read()
-                with open('%s.po' % pf, 'w') as fp:
-                    fp.write(msg)
-
-if __name__ == "__main__":
-    unique_messages()

django/conf/__init__.py

@@ -13,7 +13,7 @@ import warnings
 
 from django.conf import global_settings
 from django.core.exceptions import ImproperlyConfigured
-from django.utils.deprecation import RemovedInDjango20Warning
+from django.utils.deprecation import RemovedInDjango110Warning
 from django.utils.functional import LazyObject, empty
 from django.utils import six
 
@@ -115,11 +115,11 @@ class Settings(BaseSettings):
         if ('django.contrib.auth.middleware.AuthenticationMiddleware' in self.MIDDLEWARE_CLASSES and
                 'django.contrib.auth.middleware.SessionAuthenticationMiddleware' not in self.MIDDLEWARE_CLASSES):
             warnings.warn(
-                "Session verification will become mandatory in Django 2.0. "
+                "Session verification will become mandatory in Django 1.10. "
                 "Please add 'django.contrib.auth.middleware.SessionAuthenticationMiddleware' "
                 "to your MIDDLEWARE_CLASSES setting when you are ready to opt-in after "
                 "reading the upgrade considerations in the 1.8 release notes.",
-                RemovedInDjango20Warning
+                RemovedInDjango110Warning
             )
 
         if hasattr(time, 'tzset') and self.TIME_ZONE:

django/conf/global_settings.py

@@ -34,7 +34,7 @@ INTERNAL_IPS = ()
 ALLOWED_HOSTS = []
 
 # Local time zone for this installation. All choices can be found here:
-# http://en.wikipedia.org/wiki/List_of_tz_zones_by_name (although not all
+# https://en.wikipedia.org/wiki/List_of_tz_zones_by_name (although not all
 # systems may support all possibilities). When USE_TZ is True, this is
 # interpreted as the default user time zone.
 TIME_ZONE = 'America/Chicago'

django/conf/locale/__init__.py

@@ -33,7 +33,7 @@ LANG_INFO = {
         'bidi': True,
         'code': 'az',
         'name': 'Azerbaijani',
-        'name_local': 'azərbaycan dili',
+        'name_local': 'Azərbaycanca',
     },
     'be': {
         'bidi': False,

django/conf/locale/az/formats.py

@@ -0,0 +1,35 @@
+# -*- encoding: utf-8 -*-
+# This file is distributed under the same license as the Django package.
+#
+from __future__ import unicode_literals
+
+# The *_FORMAT strings use the Django date format syntax,
+# see http://docs.djangoproject.com/en/dev/ref/templates/builtins/#date
+DATE_FORMAT = 'j E Y г.'
+TIME_FORMAT = 'G:i'
+DATETIME_FORMAT = 'j E Y г. G:i'
+YEAR_MONTH_FORMAT = 'F Y г.'
+MONTH_DAY_FORMAT = 'j F'
+SHORT_DATE_FORMAT = 'd.m.Y'
+SHORT_DATETIME_FORMAT = 'd.m.Y H:i'
+FIRST_DAY_OF_WEEK = 1  # Monday
+
+# The *_INPUT_FORMATS strings use the Python strftime format syntax,
+# see http://docs.python.org/library/datetime.html#strftime-strptime-behavior
+DATE_INPUT_FORMATS = [
+    '%d.%m.%Y',  # '25.10.2006'
+    '%d.%m.%y',  # '25.10.06'
+]
+DATETIME_INPUT_FORMATS = [
+    '%d.%m.%Y %H:%M:%S',     # '25.10.2006 14:30:59'
+    '%d.%m.%Y %H:%M:%S.%f',  # '25.10.2006 14:30:59.000200'
+    '%d.%m.%Y %H:%M',        # '25.10.2006 14:30'
+    '%d.%m.%Y',              # '25.10.2006'
+    '%d.%m.%y %H:%M:%S',     # '25.10.06 14:30:59'
+    '%d.%m.%y %H:%M:%S.%f',  # '25.10.06 14:30:59.000200'
+    '%d.%m.%y %H:%M',        # '25.10.06 14:30'
+    '%d.%m.%y',              # '25.10.06'
+]
+DECIMAL_SEPARATOR = ','
+THOUSAND_SEPARATOR = '\xa0'  # non-breaking space
+NUMBER_GROUPING = 3

django/conf/locale/fa/formats.py

@@ -12,13 +12,13 @@ YEAR_MONTH_FORMAT = 'F Y'
 MONTH_DAY_FORMAT = 'j F'
 SHORT_DATE_FORMAT = 'Y/n/j'
 SHORT_DATETIME_FORMAT = 'Y/n/j،‏ G:i'
-# FIRST_DAY_OF_WEEK =
+FIRST_DAY_OF_WEEK = 6
 
 # The *_INPUT_FORMATS strings use the Python strftime format syntax,
 # see http://docs.python.org/library/datetime.html#strftime-strptime-behavior
 # DATE_INPUT_FORMATS =
 # TIME_INPUT_FORMATS =
 # DATETIME_INPUT_FORMATS =
-DECIMAL_SEPARATOR = ','
-THOUSAND_SEPARATOR = '.'
+DECIMAL_SEPARATOR = '.'
+THOUSAND_SEPARATOR = ','
 # NUMBER_GROUPING =

django/conf/locale/is/formats.py

@@ -21,4 +21,4 @@ SHORT_DATE_FORMAT = 'j.n.Y'
 # DATETIME_INPUT_FORMATS =
 DECIMAL_SEPARATOR = ','
 THOUSAND_SEPARATOR = '.'
-# NUMBER_GROUPING =
+NUMBER_GROUPING = 3