33644 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Jacob Walls	b2407e4d7d	Fixed #35305 -- Avoided recreating constraints on fields renamed via db_column.	2025-06-23 14:06:14 +02:00
Tim Graham	54402a7529	Removed @skipIfDBFeature silencing of nonexistent features. ... Follow up to f5df7ed7e6.	2025-06-21 14:51:34 +02:00
Tim Graham	f5df7ed7e6	Removed @skipUnlessDBFeature silencing of nonexistent features. ... This was added in 46c7707e50 but is obsolete now that gis_tests are discovered separately. It's error-prone to ignore mistyped names.	2025-06-20 17:16:22 +02:00
Jacob Walls	8ede411a81	Fixed #36152 -- Deprecated use of "%" in column aliases. ... Unintentional support existed only on SQLite and Oracle.	2025-06-20 08:25:22 +02:00
Jacob Walls	56f468681a	Refs #35038 -- Reduced CreateModel/AlterConstraint operations when optimizing migrations.	2025-06-19 12:22:23 +02:00
Jake Howard	bc1bfe12b6	Clarified that only latest dependency versions are valid for security reports.	2025-06-18 11:04:34 -03:00
haileyajohnson	22506b2c16	Fixed #36465, Refs #35816 -- Disallowed '+' and '-' characters in template variable names. ... Regression in 5183f7c287. Thank you to Jon Banafato and Baptiste Mispelon for the report.	2025-06-18 14:04:39 +02:00
Lukas Komischke	db4d65f8be	Fixed #36467 -- Removed leading whitespaces from Set-Cookie header values in WSGIHandler. ... This also aligned the Set-Cookie logic in the WSGIHandler and ASGIHandler. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>	2025-06-18 11:25:14 +02:00
Sarah Boyce	1cd91d5d4b	Refs #36467 -- Added test for Set-Cookie header values in ASGIHandler.	2025-06-18 11:25:14 +02:00
michalpokusa	1520870c4a	Fixed #36437 -- Improved accessibility of messages in admin.	2025-06-18 08:37:44 +02:00
Clifford Gama	74b31cd26b	Fixed #32770 -- Added system check to ensure django.contrib.postgres is installed when using its features. ... Added postgres.E005 to validate 'django.contrib.postgres' is in INSTALLED_APPS when using: * PostgreSQL-specific fields (ArrayField, HStoreField, range fields, SearchVectorField), * PostgreSQL indexes (PostgresIndex and all subclasses), and * ExclusionConstraint The check provides immediate feedback during system checks rather than failing later with obscure runtime and database errors. Thanks to Simon Charette and Sarah Boyce for reviews.	2025-06-18 08:36:49 +02:00
nessita	8c56e93975	Refs #36009 -- Added GitHub action workflow to run tests with latest stable postgis version.	2025-06-17 15:25:47 -03:00
nessita	0f60102444	Added guidance on AI-assisted security reports to docs/internals/security.txt. ... Co-authored-by: Shai Berger <shai@platonix.com> Co-authored-by: Mike Edmunds <medmunds@gmail.com>	2025-06-17 11:45:03 -03:00
Natalia	d6e0c71017	Refs #36380 -- Replaced mocked logging assertions in tests/backends/tests.py.	2025-06-16 17:41:24 -03:00
Natalia	1a03a984ab	Fixed #36380 -- Deferred SQL formatting when running tests with --debug-sql. ... Thanks to Jacob Walls for the report and previous iterations of this fix, to Simon Charette for the logging formatter idea, and to Tim Graham for testing and ensuring that 3rd party backends remain compatible. This partially reverts d8f093908c. Refs #36112, #35448. Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>	2025-06-16 17:41:24 -03:00
Clifford Gama	104cbfd44b	Fixed #36453 -- Made When.condition resolve with for_save=False. ... Value(None, JSONField()) when used in When.condition incorrectly resolved with for_save=True, resulting in the value being serialized as SQL NULL instead of JSON null. Regression in c1fa3fdd04. Thanks to Thomas McKay for the report, and to David Sanders and Simon Charettes for the review. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>	2025-06-16 10:40:29 +02:00
Jake Howard	12c1557060	Fixed #36447 -- Selected preferred media type based on quality. ... When matching which entry in the `Accept` header should be used for a given media type, the specificity matters. However once those are resolved, only the quality matters when selecting preference. Regression in c075508b4d. Thank you to Anders Kaseorg for the report.	2025-06-16 09:25:25 +02:00
Sarah Boyce	8e2249bc79	Corrected jsonfield fieldlookup references.	2025-06-13 09:50:56 +02:00
Colleen Dunlap	830e69a868	Fixed #36433 -- Fixed constraint validation crash when condition uses a ForeignKey attname. ... Regression in e44e8327d3. Thank you to Jacob Walls for the report. Co-authored-by: Simon Charette <charette.s@gmail.com>	2025-06-13 08:50:25 +02:00
Tim Graham	3306b7283b	Refs #35676 -- Added supports_table_check_constraints skip to model_forms tests.	2025-06-13 08:11:04 +02:00
Claude Paroz	f2f6046c0f	Fixed #25706 -- Refactored geometry widgets to remove inline JavaScript. ... Refactored GIS-related JavaScript initialization to eliminate inline scripts from templates. Added support for specifying a base layer using the new `base_layer_name` attribute on `BaseGeometryWidget`, allowing custom map tile providers via user-defined JavaScript. As a result, the `gis/openlayers-osm.html` template was removed. Thanks Sarah Boyce for reviews. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>	2025-06-12 17:35:14 -03:00
Sulove Bista	e80b33ae4d	Fixed #36463 -- Fixed grammar in docs/intro/contributing.txt.	2025-06-12 15:14:15 -03:00
ruvilonix	f5cb757a67	Fixed #36454 -- Fixed typo in docs/intro/tutorial08.txt.	2025-06-12 09:55:30 +02:00
viliam mihalik	bd65e82831	Fixed #36442 -- Cloned FilteredRelation before rename_prefix_from_q.	2025-06-12 08:36:54 +02:00
Clifford Gama	95a5c9b794	Made minor grammar and punctuation fixes in docs/topics/migrations.txt.	2025-06-11 12:52:26 -03:00
Adam Johnson	75cd4fc8e3	Removed default value for app_configs in system check functions. ... The documentation[0] encourages users to write functions without a default for `app_configs`, and checks are always passed the argument. [0] https://docs.djangoproject.com/en/5.2/topics/checks/	2025-06-11 12:46:28 -03:00
Jericho Serrano	1960ecd879	Fixed #36421 -- Made test_msgfmt_error_including_non_ascii compatible with msgfmt 0.25.	2025-06-11 17:09:16 +02:00
junghwan16	091f66e51a	Fixed #36425 -- Standardized integer fields descriptions.	2025-06-11 09:59:00 +02:00
Sarah Boyce	2714bc3f2c	Added follow-up to CVE-2025-48432 to security archive.	2025-06-10 15:08:30 +02:00
Sarah Boyce	7fcc7b1a0c	Added stub release notes for 5.2.4.	2025-06-10 12:29:28 +02:00
nakano	aafe320712	Fixed #36448 -- Fixed GeoDjango spelling in test_commands.py docstrings.	2025-06-10 09:50:21 +02:00
Jacob Walls	76e1ca77bc	Refs #373 -- Doc'd that on_delete is ignored for ForeignObject.	2025-06-10 09:44:40 +02:00
Jacob Walls	5942754769	Fixed #36449 -- Fixed field types in example model using ForeignObject.	2025-06-10 09:44:40 +02:00
Mariusz Felisiak	f5441e42da	Refs #36419 -- Fixed BulkUpdateTests.test_json_field_sql_null() crash on Oracle. ... Follow up to c1fa3fdd04.	2025-06-10 08:40:47 +02:00
Jacob Walls	a68e8565cd	Refs #34378, #36143, #36416 -- Fixed isolation of LookupTests.test_in_bulk_preserve_ordering_with_batch_size(). ... `max_query_params` is a property, so it must be patched on the class.	2025-06-09 17:40:22 -03:00
Natalia	cf5f36bf90	Fixed #36446 -- Restored "q" in internal MediaType.params property. ... The "q" key was removed while addressing ticket #36411. Despite `MediaType.params` is undocumented and considered internal, it was used in third-party projects (Zulip reported breakage), so this work restored the `q` key in `params`. Thanks Anders Kaseorg for the report. Regression in c075508b4d.	2025-06-09 17:37:40 -03:00
Jacob Walls	8fd21b0da3	Refs #10785 -- Added missing __hash__() method to custom pk test model.	2025-06-09 18:32:55 +02:00
Clifford Gama	c1fa3fdd04	Fixed #36419 -- Ensured for_save was propagated when resolving expressions. ... The for_save flag wasn't properly propagated when resolving expressions, which prevented get_db_prep_save() from being called in some cases. This affected fields like JSONField where None would be saved as JSON null instead of SQL NULL. Regression in 00c690efbc. Thanks to David Sanders and Simon Charette for reviews. Co-authored-by: Adam Johnson <me@adamj.eu>	2025-06-06 17:40:35 +02:00
Jake Howard	9579517552	Refs CVE-2025-48432 -- Prevented log injection in remaining response logging. ... Migrated remaining response-related logging to use the `log_response()` helper to avoid potential log injection, to ensure untrusted values like request paths are safely escaped. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>	2025-06-06 09:05:32 -03:00
Natalia	ff835f439c	Refs CVE-2025-48432 -- Made SuspiciousOperation logging use log_response() for consistency.	2025-06-06 09:05:32 -03:00
Natalia	9d72e7daf7	Refactored logging_tests to reuse assertions for log records.	2025-06-06 09:05:32 -03:00
Sarah Boyce	b762a6ab3c	Updated translations from Transifex. ... Forwardport of 5901cfe591 from stable/5.2.x.	2025-06-06 13:57:27 +02:00
Tim Graham	cf1a80fc2d	Added validation to BaseSpatialFeatures.has_<Func>_function.	2025-06-05 22:18:56 +02:00
Adam Johnson	f0a87895ff	Fixed #36435 -- Made CaptureQueriesContext restore reset_queries conditionally.	2025-06-05 13:49:39 +02:00
Adam Johnson	9a3f3b8499	Refs #36435 -- Tidied tests for CaptureQueriesContext and assertNumQueries. ... Avoided repeatedly templating the URL and hoisted Person creation to setUpTestData in AssertNumQueriesContextManagerTests to repeat the same pattern as in CaptureQueriesContextManagerTests.	2025-06-05 13:49:39 +02:00
ontowhee	68c9f7e0b7	Fixed #36407 -- Ensured default value is cast in Case expressions used in ORDER BY clause. ... Thanks to deceze for the report. Thanks to Sarah Boyce for the test. Thanks to Simon Charette for the investigation and review.	2025-06-05 09:52:56 +02:00
Natalia	51923c576a	Added CVE-2025-48432 to security archive.	2025-06-04 10:57:51 -03:00
Natalia	1f19c36e2d	Added stub release notes for 5.2.3.	2025-06-04 10:55:33 -03:00
Natalia	a07ebec559	Fixed CVE-2025-48432 -- Escaped formatting arguments in log_response(). ... Suitably crafted requests containing a CRLF sequence in the request path may have allowed log injection, potentially corrupting log files, obscuring other attacks, misleading log post-processing tools, or forging log entries. To mitigate this, all positional formatting arguments passed to the logger are now escaped using "unicode_escape" encoding. Thanks to Seokchan Yoon (https://ch4n3.kr/) for the report. Co-authored-by: Carlton Gibson <carlton@noumenal.es> Co-authored-by: Jake Howard <git@theorangeone.net>	2025-06-04 08:33:30 -03:00
Simon Charette	08187c94ed	Fixed #36432 -- Fixed a prefetch_related crash on related target subclass queryset. ... Regression in 626d77e52a. Refs #36116. Thanks Cornelis Poppema for the excellent report.	2025-06-04 10:46:49 +02:00