Simon Charette 0bd57a879a [3.1.x] Fixed CVE-2021-35042 -- Prevented SQL injection in QuerySet.order_by().
Regression introduced in 513948735b799239f3ef8c89397592445e1a0cd5
by marking the raw SQL column reference feature for deprecation in
Django 4.0 while lifting the column format validation.

In retrospective the validation should have been kept around and the
user should have been pointed at using RawSQL expressions during the
deprecation period.

The main branch is not affected because the raw SQL column reference
support has been removed in 06eec3197009b88e3a633128bbcbd76eea0b46ff
per the 4.0 deprecation life cycle.

Thanks Joel Saunders for the report.
2021-07-01 08:36:17 +02:00
..
2021-02-25 17:27:54 +01:00
2017-05-24 09:13:26 -04:00

The documentation in this tree is in plain text files and can be viewed using any text file viewer.

It uses ReST (reStructuredText), and the Sphinx documentation system. This allows it to be built into other forms for easier viewing and browsing.

To create an HTML version of the docs:

  • Install Sphinx (using python -m pip install Sphinx or some other method).
  • In this docs/ directory, type make html (or make.bat html on Windows) at a shell prompt.

The documentation in _build/html/index.html can then be viewed in a web browser.