Before, `order_by()` treated a period in a field name as a sign that it
was requested via `.extra(order_by=...)` and thus should be passed
through as raw table and column names, even if `extra()` was not used.
Since periods are permitted in aliases, this meant user-controlled
aliases could force the `order_by()` clause to resolve to a raw table
and column pair instead of the actual target field for the alias.
In practice, only `FilteredRelation` was affected, as the other
expressions we tested, e.g. `F`, aggressively optimize away the ordering
expressions into ordinal positions, e.g. ORDER BY 2, instead of ORDER BY
"table".column.
Thanks Solomon Kebede for the report, and Simon Charette and Jake Howard
for reviews.
Backport of 69065ca869 from main.
Control characters in FilteredRelation column aliases could be used for
SQL injection attacks. This affected QuerySet.annotate(), aggregate(),
extra(), values(), values_list(), and alias() when using dictionary
expansion with **kwargs.
Thanks Solomon Kebede for the report, and Simon Charette, Jacob Walls,
and Natalia Bidart for reviews.
Backport of e891a84c7e from main.
The `TruncateHTMLParser` used `deque.remove()` to remove tags from the
stack when processing end tags. With crafted input containing many
unmatched end tags, this caused repeated full scans of the tag stack,
leading to quadratic time complexity.
The fix uses LIFO semantics, only removing a tag from the stack when it
matches the most recently opened tag. This avoids linear scans for
unmatched end tags and reduces complexity to linear time.
Refs #30686 and 6ee37ada32.
Thanks Seokchan Yoon for the report, and Jake Howard and Jacob Walls for
reviews.
Backport of a33540b3e2 from main.
Regression in 94680437a4. Refs #27222.
During INSERT operations, `field.pre_save()` is called to prepare values
for db insertion. The `add` param must be `True` for `auto_now_add`
fields to be populated. The regression commit passed `False`, causing
`auto_now_add` fields to remain `None` when used by other fields, such
as `upload_to` callables.
Thanks Ran Benita for the report.
Backport of fe189dc43a from main.
Removed flex-wrap from .changelist-form-container and added min-width to the
main content container to ensure proper layout behavior.
Regression in 6ea3319079.
Backport of e92d1e3b78 from main.
Regression in a16eedcf9c.
The UNNEST strategy is affected by the same problem bulk_update has wrt/
to silent data truncation due to its usage of db_type which always returns
a parametrized subtype.
Backport of d6ae2ed868 from main.
There was unresolved discussion regarding whether to set
ClearableFileInput.use_fieldset to True or False when use_fieldset was
introduced in Django 4.1, since the clear checkbox appears only
sometimes. Although using <fieldset> is likely desirable, since the
primary motivation in #35892 was just to improve markup in the admin,
and a deprecation path was not provided for general form usage, future
work is deferred to #36828.
Regression in 4187da258f.
Thanks Tim Graham, Antoliny, and David Smith for triage.
Coerce lazy route values to `str` at match time to support prefix and
endpoint matching when using `gettext_lazy()` route paths.
Regression in f920937c8a.
Thanks to Andrea Angelini for the report, and to Jake Howard and Jacob
Walls for reviews.
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
Backport of 7bf3ac3ee2 from main.
Moved nonce generation in ``django.utils.csp.LazyNonce`` to a function
to avoid infinite recursion in ``SimpleLazyObject.__repr__`` for
unevaluated instances.
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
Backport of 165c359996 from main.
It isn't safe to set display: flex on <fieldset>, because on Safari this
interferes with display: block on child divs.
Thanks Paulo Coutinho for the report and Antoliny for the review.
Regression in 4187da258f.
Backport of 1eac2659a1 from main.
The project state is cached, so when it was calculated in #27100
during the pre-migrate stage, it was no longer calculated on forward
migrations. Backward migrations still calculate it.
Backport of 0def695e3c from main.
Regression in f9a44cc0fa.
Now that ManyToManyField is no longer concrete the decision of whether or not
it should be altered, which is also relied on by field renaming, should take
into consideration name changes even if it doesn't have a column associated
with it, as auto-created many-to-many relationship table names are a base of it.
Note that there is room for optimization here where a rename can be entirely
avoided if ManyToManyField.db_table remains stable between .name changes, just
like we do with Field.db_column remaining stable, but since this is a
regression and meant to be backported the current patch focuses on correctness
over further improvements.
Thanks Josik for the report.
Co-authored-by: Simon Charette <charette.s@gmail.com>
Backport of 6cc1231285 from main.
It is often necessary to reset the cache between tests, or after
preparing test state, when using content types. Django's test suite
already does this when needed, but users will need to do similar in
their own tests.
Backport of 37eb890969 from main.
1. Added imports and setup for clarity.
2. Removed adding `<` and `>` to Content-ID, as `make_msgid()` already
includes them.
3. Removed `$` from reference in HTML, and instead stripped `<>` there, as
required by HTML `cid:` references.
- Corrected work_factor description and its requirements.
- Added block_size description.
- Changed parallelism description to mention computations, rather than
threads (currently it's not multithreaded.)
- For all of the above, added standard scrypt terminology (N, r, p).
- Mentioned that in multithreaded implementations, parallelism also
influences the memory requirements.
Backport of 0ca3a06611 from main
