33613 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Jacob Walls	76e1ca77bc	Refs #373 -- Doc'd that on_delete is ignored for ForeignObject.	2025-06-10 09:44:40 +02:00
Jacob Walls	5942754769	Fixed #36449 -- Fixed field types in example model using ForeignObject.	2025-06-10 09:44:40 +02:00
Mariusz Felisiak	f5441e42da	Refs #36419 -- Fixed BulkUpdateTests.test_json_field_sql_null() crash on Oracle. ... Follow up to c1fa3fdd04.	2025-06-10 08:40:47 +02:00
Jacob Walls	a68e8565cd	Refs #34378, #36143, #36416 -- Fixed isolation of LookupTests.test_in_bulk_preserve_ordering_with_batch_size(). ... `max_query_params` is a property, so it must be patched on the class.	2025-06-09 17:40:22 -03:00
Natalia	cf5f36bf90	Fixed #36446 -- Restored "q" in internal MediaType.params property. ... The "q" key was removed while addressing ticket #36411. Despite `MediaType.params` is undocumented and considered internal, it was used in third-party projects (Zulip reported breakage), so this work restored the `q` key in `params`. Thanks Anders Kaseorg for the report. Regression in c075508b4d.	2025-06-09 17:37:40 -03:00
Jacob Walls	8fd21b0da3	Refs #10785 -- Added missing __hash__() method to custom pk test model.	2025-06-09 18:32:55 +02:00
Clifford Gama	c1fa3fdd04	Fixed #36419 -- Ensured for_save was propagated when resolving expressions. ... The for_save flag wasn't properly propagated when resolving expressions, which prevented get_db_prep_save() from being called in some cases. This affected fields like JSONField where None would be saved as JSON null instead of SQL NULL. Regression in 00c690efbc. Thanks to David Sanders and Simon Charette for reviews. Co-authored-by: Adam Johnson <me@adamj.eu>	2025-06-06 17:40:35 +02:00
Jake Howard	9579517552	Refs CVE-2025-48432 -- Prevented log injection in remaining response logging. ... Migrated remaining response-related logging to use the `log_response()` helper to avoid potential log injection, to ensure untrusted values like request paths are safely escaped. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>	2025-06-06 09:05:32 -03:00
Natalia	ff835f439c	Refs CVE-2025-48432 -- Made SuspiciousOperation logging use log_response() for consistency.	2025-06-06 09:05:32 -03:00
Natalia	9d72e7daf7	Refactored logging_tests to reuse assertions for log records.	2025-06-06 09:05:32 -03:00
Sarah Boyce	b762a6ab3c	Updated translations from Transifex. ... Forwardport of 5901cfe591 from stable/5.2.x.	2025-06-06 13:57:27 +02:00
Tim Graham	cf1a80fc2d	Added validation to BaseSpatialFeatures.has_<Func>_function.	2025-06-05 22:18:56 +02:00
Adam Johnson	f0a87895ff	Fixed #36435 -- Made CaptureQueriesContext restore reset_queries conditionally.	2025-06-05 13:49:39 +02:00
Adam Johnson	9a3f3b8499	Refs #36435 -- Tidied tests for CaptureQueriesContext and assertNumQueries. ... Avoided repeatedly templating the URL and hoisted Person creation to setUpTestData in AssertNumQueriesContextManagerTests to repeat the same pattern as in CaptureQueriesContextManagerTests.	2025-06-05 13:49:39 +02:00
ontowhee	68c9f7e0b7	Fixed #36407 -- Ensured default value is cast in Case expressions used in ORDER BY clause. ... Thanks to deceze for the report. Thanks to Sarah Boyce for the test. Thanks to Simon Charette for the investigation and review.	2025-06-05 09:52:56 +02:00
Natalia	51923c576a	Added CVE-2025-48432 to security archive.	2025-06-04 10:57:51 -03:00
Natalia	1f19c36e2d	Added stub release notes for 5.2.3.	2025-06-04 10:55:33 -03:00
Natalia	a07ebec559	Fixed CVE-2025-48432 -- Escaped formatting arguments in log_response(). ... Suitably crafted requests containing a CRLF sequence in the request path may have allowed log injection, potentially corrupting log files, obscuring other attacks, misleading log post-processing tools, or forging log entries. To mitigate this, all positional formatting arguments passed to the logger are now escaped using "unicode_escape" encoding. Thanks to Seokchan Yoon (https://ch4n3.kr/) for the report. Co-authored-by: Carlton Gibson <carlton@noumenal.es> Co-authored-by: Jake Howard <git@theorangeone.net>	2025-06-04 08:33:30 -03:00
Simon Charette	08187c94ed	Fixed #36432 -- Fixed a prefetch_related crash on related target subclass queryset. ... Regression in 626d77e52a. Refs #36116. Thanks Cornelis Poppema for the excellent report.	2025-06-04 10:46:49 +02:00
Jake Howard	c075508b4d	Fixed #36411 -- Made HttpRequest.get_preferred_type() consider media type parameters. ... HttpRequest.get_preferred_type() did not account for parameters in Accept header media types (e.g., "text/vcard; version=3.0"). This caused incorrect content negotiation when multiple types differed only by parameters, reducing specificity as per RFC 7231 section 5.3.2 (https://datatracker.ietf.org/doc/html/rfc7231.html#section-5.3.2). This fix updates get_preferred_type() to treat media types with parameters as distinct, allowing more precise and standards-compliant matching. Thanks to magicfelix for the report, and to David Sanders and Sarah Boyce for the reviews.	2025-06-03 16:10:41 -03:00
Jacob Walls	26313bc219	Fixed #36416 -- Made QuerySet.in_bulk() account for composite pks in id_list.	2025-06-03 18:45:15 +03:00
myoungjinGo-BE	953095d1e6	Fixed #36060 -- Prevented IntegrityError in bulk_create() with order_with_respect_to.	2025-06-03 17:27:33 +03:00
Blayze	90429625a8	Fixed #36423 -- Prevented filter_horizontal buttons from intercepting form submission. ... In the admin's filter_horizontal widget, optional action buttons like "Choose all", "Remove all", etc. were changed from `<a>` to `<button>` elements in #34619, but without specifying `type="button"`. As a result, when pressing Enter while focused on a form input, these buttons could be triggered and intercept form submission. Explicitly set `type="button"` on these control buttons to prevent them from acting as submit buttons. Thanks Antoliny Lee for the quick triage and review. Regression in 857b1048d5.	2025-06-02 22:25:14 -03:00
Natalia	1a74434399	Added stub release notes and release date for 5.2.2, 5.1.10, and 4.2.22.	2025-05-28 10:03:06 -03:00
Clifford Gama	ad28db666e	Removed redundant redefinition of variable in tests/test_utils/tests.py.	2025-05-27 18:20:07 -03:00
Tim Graham	e29272bbbd	Removed unreachable check for None in TruncBase.convert_value().	2025-05-27 09:02:54 -03:00
Jason Judkins	1307b8a1cb	Fixed #36402, Refs #35980 -- Updated built package name in reusable apps tutorial for PEP 625.	2025-05-26 12:33:29 -03:00
Nick Pope	b373721af0	Fixed flakiness in file_storage.tests.CustomStorageTests.test_file_get_accessed_time. ... Two separate calls to look up access time can result in sub-second differences which cause the test to fail. Also made the equivalent tests for ctime and mtime have the same changes to ensure that they won't flake in the same way in future.	2025-05-23 11:23:47 -03:00
Adam Johnson	c2615a0500	Fixed #36405 -- Fixed Aggregate.order_by using OuterRef. ... co-authored-by: Simon Charette <charette.s@gmail.com>	2025-05-23 16:15:59 +02:00
Adam Johnson	b8e5a8a9a2	Fixed #36404 -- Fixed Aggregate.filter using OuterRef. ... Regression in a76035e925. Thank you to Simon Charette for the review. co-authored-by: Simon Charette <charette.s@gmail.com>	2025-05-23 15:17:20 +02:00
Adam Zapletal	d2732c30af	Fixed typo in docs/ref/forms/renderers.txt.	2025-05-23 11:19:59 +02:00
Simon Charette	ec7f0bcf79	Refs #35444 -- Adjusted multi-args distinct aggregate test ordering expectations. ... Unless an explicit order_by is specified for the test the ordering of the aggregation results is undefined.	2025-05-23 11:19:31 +02:00
Sarah Boyce	1704c49a9b	Fixed #36390 -- Deprecated RemoteUserMiddleware subclasses missing aprocess_request(). ... Regression in 50f89ae850. Thank you to shamoon for the report and Natalia Bidart for the review.	2025-05-23 10:22:36 +02:00
Natalia	ad6f998898	Added helpers in csrf_tests and logging_tests to assert logs from log_response().	2025-05-22 15:39:31 -03:00
Natalia	8970468159	Refs #26688 -- Added tests for log_response() internal helper.	2025-05-22 15:39:31 -03:00
nessita	8c27911386	Refs #35829 -- Made cosmetic edits to django/contrib/admin/static/admin/img/README.md.	2025-05-20 08:57:11 -03:00
ontowhee	ddb8529415	Fixed #34262 -- Added support for AnyValue for SQLite, MySQL, Oracle, and Postgresql 16+. ... Thanks Simon Charette for the guidance and review. Thanks Tim Schilling for the documentation review. Thanks David Wobrock for investigation and solution proposals.	2025-05-20 10:01:42 +02:00
Jacob Walls	f603ece016	Fixed typo in docs/releases/6.0.txt.	2025-05-19 15:09:09 -03:00
Colleen Dunlap	802baf5da5	Fixed #36388 -- Made QuerySet.union() return self when called with no arguments. ... Regression in 9cb8baa0c4. Thank you to Antoine Humeau for the report and Simon Charette for the review.	2025-05-19 10:34:14 +02:00
Samuel Cormier-Iijima	1ba5fe19ca	Fixed #36348 -- Fixed handling multiple nested url()s in ManifestStaticFilesStorage. ... Signed-off-by: Samuel Cormier-Iijima <samuel@cormier-iijima.com>	2025-05-16 15:56:17 +02:00
Jacob Walls	994dc6d8a1	Fixed #36392 -- Raised ValueError when subquery referencing composite pk selects too many columns.	2025-05-16 08:19:38 +02:00
Simon Charette	e03e5c751c	Fixed #33312 -- Raised explicit exception when copying deferred model instances. ... Previously save() would crash with an attempted forced update message, and both save(force_insert=True) and bulk_create() would crash with DoesNotExist errors trying to retrieve rows with an empty primary key (id IS NULL). Implementing deferred field model instance copying might be doable in certain cases (e.g. when all the deferred fields are db generated) but that's not trivial to implement in a backward compatible way. Thanks Adam Sołtysik for the report and test and Clifford for the review.	2025-05-16 08:13:57 +02:00
Mariusz Felisiak	0b2ed4f7c8	Refs #35844 -- Skipped selenium and geoip2 requirement in Windows for Python 3.14+. ... Follow up to d6925f0d6b.	2025-05-15 19:52:51 +02:00
Tim Graham	883ce03e43	Refs #34488 -- Made test files path resolution independent of current working directory in ClearableFileInput selenium tests.	2025-05-15 13:02:00 -03:00
antoliny0919	a79c411147	Added missing import in docs/ref/contrib/admin/index.txt.	2025-05-15 15:48:00 +02:00
Jacob Walls	e52100a250	Fixed incorrect spacing in docs/ref/contrib/postgres/fields.txt.	2025-05-15 09:22:10 -03:00
Pablo Bengoechea	87ab54b488	Fixed #35829 -- Updated admin icons using Font Awesome Free version 6.7.2. ... Co-authored-by: Stefan <96178532+stefan6419846@users.noreply.github.com>	2025-05-15 09:09:27 -03:00
nessita	d6925f0d6b	Refs #35844 -- Skipped argon2-cffi requirement in Windows for Python 3.14+.	2025-05-14 22:43:22 +02:00
Timothy McCurrach	24693a144f	Fixed #35852 -- Fixed intcomma locale-aware formatting of string number representations.	2025-05-14 16:04:04 +02:00
antoliny0919	8bc3dd8727	Fixed #35507 -- Improved accessibility of search and filter elements in the admin changelist.	2025-05-14 16:03:01 +02:00