Commit Graph

14123 Commits

Author SHA1 Message Date
varunkasyap
ef4715ef69 [6.0.x] Fixed #36733 -- Escaped attributes in Stylesheet.__str__().
Thanks Mustafa Barakat for the report, Baptiste Mispelon for
the triage, and Jake Howard for the review.

Backport of e05f2a7569 from main.
2025-11-18 17:16:27 -05:00
Georgi Yanchev
569f455b58 [6.0.x] Fixed #36141 -- Checked for applied replaced migrations recursively.
Regression in 64b1ac7292.
Backport of b07298a73a from main.
2025-11-18 08:11:36 -05:00
Adam Johnson
5ae8659cb5 [6.0.x] Fixed #36730 -- Fixed constraint validation crash for excluded FK attnames.
Regression in e44e8327d3.

Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>

Backport of abfa4619fb from main
2025-11-13 10:04:40 +01:00
Jacob Walls
a26b660cff Refs #36680 -- Avoided manipulating PATH in AdminScriptTestCase.
This mostly reverts 6436ec3210,
which was fragile. Instead, if black is present, we use it to format the
expected and actual results, instead of hard-coding the expected
formatted value.

Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2025-11-10 14:14:22 -05:00
Mehraz Hossain Rumman
ca82428442 [6.0.x] Fixed #36710 -- Fixed a regression in urlize for multipart domain names.
Thanks Mehraz Hossain Rumman for the report and Bruno Alla for the triage.

Regression in a9fe98d5bd.
Backport of 125b63ca74 from main.
2025-11-05 17:06:23 -05:00
Jacob Walls
a3f3a81f33 [6.0.x] Refs CVE-2025-64459 -- Avoided propagating invalid arguments to Q on dictionary expansion.
Backport of 3c3f463577 from main.
2025-11-05 09:30:12 -03:00
Jacob Walls
06dd38324a [6.0.x] Fixed CVE-2025-64459 -- Prevented SQL injections in Q/QuerySet via the _connector kwarg.
Thanks cyberstan for the report, Sarah Boyce, Adam Johnson, Simon
Charette, and Jake Howard for the reviews.

Backport of 98e642c691 from main.
2025-11-05 09:29:44 -03:00
Jacob Walls
6e13348436 [6.0.x] Fixed CVE-2025-64458 -- Mitigated potential DoS in HttpResponseRedirect/HttpResponsePermanentRedirect on Windows.
Thanks Seokchan Yoon for the report, Markus Holtermann for the
triage, and Jake Howard for the review.

Follow-up to CVE-2025-27556 and 39e2297210.

Backport of c880530ddd from main.
2025-11-05 09:28:56 -03:00
Hal Blackburn
12042b8978 [6.0.x] Fixed #36704 -- Fixed system check error for proxy model with a composite pk.
Proxy models subclassing a model with a CompositePrimaryKey were
incorrectly reporting check errors because the check that requires only
local fields to be used in a composite pk was evaluated against the proxy
subclass, which has no fields.

To fix this, composite pk field checks are not evaluated against
proxy subclasses, as none of the checks are applicable to proxy
subclasses. This also has the benefit of not double-reporting real check
errors from an invalid superclass pk.

Thanks Clifford Gama for the review.

Backport of 74564946c3 from main.
2025-11-04 11:59:49 -05:00
Patrick Rauscher
953d31028a [6.0.x] Fixed #36696 -- Fixed NameError when inspecting functions with deferred annotations.
In Python 3.14, annotations are deferred by default, so we should not
assume that the names in them have been imported unconditionally.

Backport of 6019147229 from main.
2025-10-31 08:45:13 -04:00
Mariusz Felisiak
11cfb573d2 [6.0.x] Refs #36680 -- Fixed admin_scripts tests crash when black is not installed.
Regression in 6436ec3210.
Backport of 3939cd2795 from main.
2025-10-30 08:41:02 -03:00
Jacob Walls
32ef95796a [6.0.x] Fixed #36680 -- Parametrized formatter discovery in AdminScriptTestCase.
Backport of 6436ec3210 from main.
2025-10-29 17:57:05 -03:00
Jacob Walls
69386758ef [6.0.x] Fixed #36678 -- Limited retries in ParallelTestRunner.
Thanks Natalia Bidart for the review.

Backport of 1aa69a7491 from main.
2025-10-29 09:12:12 -03:00
Mariusz Felisiak
500c5d325f [6.0.x] Made RemoteTestResultTest.test_pickle_errors_detection() compatible with tblib 3.2+.
tblib 3.2+ makes exception subclasses with __init__() and the default
__reduce__() picklable. This broke the test for
RemoteTestResult._confirm_picklable(), which expects a specific
exception to fail unpickling.

https://github.com/ionelmc/python-tblib/blob/master/CHANGELOG.rst#320-2025-10-21

This fix defines ExceptionThatFailsUnpickling.__reduce__() in a way
that pickle.dumps(obj) succeeds, but pickle.loads(pickle.dumps(obj))
raises TypeError.

Refs #27301. This preserves the intent of the regression test from
52188a5ca6 without skipping it.

Backport of 548209e620 from main.
2025-10-21 23:11:08 -03:00
Adam Johnson
bb4fcf5f67 [6.0.x] Fixed #36656 -- Avoided truncating async streaming responses in GZipMiddleware.
Backport of a0323a0c44 from main.
2025-10-21 10:46:37 -04:00
YashRaj1506
f5b6ed7820 [6.0.x] Fixed #36470 -- Prevented log injection in runserver when handling NOT FOUND.
Migrated `WSGIRequestHandler.log_message()` to use a more robust
`log_message()` helper, which was based of `log_response()` via factoring out
the common bits.

Refs CVE-2025-48432.

Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>

Backport of 9bb83925d6 from main.
2025-10-20 16:22:10 -03:00
Emmanuel Ferdman
c365139af7 [6.0.x] Removed duplicate display_raw key in expected data in GeometryWidgetTests.
Signed-off-by: Emmanuel Ferdman <emmanuelferdman@gmail.com>

Backport of 5625bd5907 from main.
2025-10-20 14:52:48 -03:00
Mariusz Felisiak
d2a69d730b [6.0.x] Fixed RelatedGeoModelTest.test_related_union_aggregate() test on Oracle and GEOS 3.12+.
Backport of 344ae16e1e from main
2025-10-20 16:05:11 +02:00
Mariusz Felisiak
195836b69a [6.0.x] Refs #36005 -- Bumped minimum supported versions of docutils to 0.22.
Backport of ca3e0484ef from main.
2025-10-19 20:16:37 +02:00
Mariusz Felisiak
a27c2ef906 [6.0.x] Refs #35844 -- Doc'd Python 3.14 compatibility.
Backport of 56977b466c from main.
2025-10-17 19:26:34 +02:00
Mariusz Felisiak
915d10a57d [6.0.x] Refs #35844 -- Relaxed GEOSIOTest.test02_wktwriter() test assertion.
Backport of 2d9c194d5a from main
2025-10-17 19:25:47 +02:00
Jacob Walls
887e897287 [6.0.x] Bumped minimum isort version to 7.0.0.
Added ignores relating to https://github.com/PyCQA/isort/issues/2352.

Backport of d980d68609 from main.
2025-10-16 14:59:48 -04:00
Jacob Walls
2cc90728de [6.0.x] Refs #36648 -- Removed hardcoded pk in CompositePKAggregateTests.
Backport of bee64561a6 from main.
2025-10-15 23:45:20 -04:00
Clifford Gama
5c114ce2d8 [6.0.x] Fixed 36622 -- Prevented LazyObject FileField storages from evaluating at boot time.
Co-authored-by: Fabien MICHEL <fmichel@adista.fr>

Backport of 6862d46dd9 from main.
2025-10-15 18:25:43 -03:00
Mariusz Felisiak
880c8fa088 Skipped GISFunctionsTests.test_geometry_type() test for MultiPoint on MariaDB and GEOS 3.12+.
GEOSWKTWriter_write() behavior was changed in GEOS 3.12+ to include
parentheses for sub-members (https://github.com/libgeos/geos/pull/903).

MariaDB doesn't accept WKT representations with additional parentheses
for MultiPoint. This is an accepted bug (MDEV-36166) in MariaDB that
should be fixed in the future:

- https://jira.mariadb.org/browse/MDEV-36166
2025-10-15 15:04:26 +02:00
Mariusz Felisiak
90f7a21b47 Moved object creation to subTest() in GISFunctionsTests.test_geometry_type() test. 2025-10-15 15:04:16 +02:00
Jacob Walls
28c95a35fb [6.0.x] Fixed #36648, Refs #33772 -- Accounted for composite pks in first()/last() when aggregating.
Backport of 02eed4f378 from main.
2025-10-14 15:49:48 -04:00
Thibaut Decombe
b077982b3e [6.0.x] Refs #31223 -- Added __class_getitem__() to SetPasswordMixin.
Backport of d0c8f89c94 from main.
2025-10-14 08:15:01 -04:00
Sarah Boyce
0fa339ce71 [6.0.x] Fixed #36611, Refs #36580 -- Added system check for multicolumn ForeignObject in Meta.indexes/constraints/unique_together.
ForeignObjects with multiple `from_fields` are not supported in these
options.

Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>

Backport of 5b51e6f759 from main.
2025-10-13 14:54:20 -03:00
Simon Charette
86e7406cfb [6.0.x] Fixed #36660 -- Fixed a regression in descending Index local field checks.
Regression in 8638d8bf74.

Refs #36273.

Thanks Federico Bond for the report.

Backport of edde2891c3 from main.
2025-10-13 10:51:22 -03:00
Mariusz Felisiak
851400194d [6.0.x] Refs #36491 -- Skipped ParallelTestSuiteTest.test_buffer_mode_reports_setupclass_failure() without tblib.
Backport of 6cb641ba75 from main
2025-10-02 13:20:55 +02:00
Sarah Boyce
af067f56c1 [6.0.x] Fixed CVE-2025-59682 -- Fixed potential partial directory-traversal via archive.extract().
Thanks stackered for the report.

Follow up to 05413afa8c.

Backport of 924a0c092e from main.
2025-10-01 08:17:44 -04:00
Mariusz Felisiak
4ceaaee7e0 [6.0.x] Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), aggregate(), and extra() against SQL injection in column aliases on MySQL/MariaDB.
Thanks sw0rd1ight for the report.

Follow up to 93cae5cb2f.

Backport of 41b43c74bd from main.
2025-10-01 08:17:15 -04:00
Mariusz Felisiak
2d502ed39d [6.0.x] Fixed assertIndexExists() crash when non-index constraint exists on the same columns.
Backport of 8b84364d46 from main
2025-09-29 23:01:42 +02:00
Shubham Singh
f8e91d0104 [6.0.x] Fixed #36491 -- Fixed crash in ParallelTestRunner with --buffer.
Thanks Javier Buzzi and Adam Johnson for reviews.

Co-authored-by: Simon Charette <charette.s@gmail.com>

Backport of be581ff473 from main.
2025-09-26 10:56:56 -04:00
SaJH
db2f206ee1 [6.0.x] Fixed #36434 -- Preserved unbuffered stdio (-u) in autoreloader child.
Signed-off-by: SaJH <wogur981208@gmail.com>

Backport of 68aae8878f from main.
2025-09-25 11:40:04 +02:00
Mridul Dhall
b15f8ba071 [6.0.x] Fixed #36543 -- Fixed time formats for fr_CA.
Thanks Chris Anderson for the report.

Backport of b67a36ec6f from main.
2025-09-23 16:53:58 +02:00
saJaeHyukc
e0f328d790 [6.0.x] Fixed #36264 -- Excluded proxy neighbors of parents from deletion collection when keep_parents=True.
Signed-off-by: saJaeHyukc <wogur981208@gmail.com>

Backport of 748551fea0 from main.
2025-09-23 16:45:23 +02:00
Ryan P Kilby
9575f813af [6.0.x] Fixed #35453 -- Made ManyToManyField.concrete False.
ManyToManyField was already excluded from fields, concrete_fields,
and local_concrete_fields in Options.

Backport of f9a44cc0fa from main
2025-09-22 21:52:21 -04:00
Simon Charette
ffac97bf63 [6.0.x] Fixed #36612 -- Fixed a KeyTextTransform crash on MySQL against annotations.
MySQL only supports the ->> when used directly against columns, this can be
inferred by the presence of lhs.output_field.model as model bounds fields are
directly tied to columns.

Purposely don't systematically switch to using JSON_QUOTE(JSON_EXTRACT(...))
as there might be functional indices out there that rely on the SQL remaining
stable between versions.

Thanks Jacob Tavener for the report.

Backport of af84cfba59 from main.
2025-09-22 09:02:01 +02:00
Samriddha9619
359c1c6ff9 [6.0.x] Fixed #36488 -- Fixed merging of query strings in RedirectView.
Co-authored-by: Ethan Jucovy <ethan.jucovy@gmail.com>
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>

Backport of a36df6890d from main.
2025-09-22 08:57:07 +02:00
Sarah Boyce
77ae09916d [6.0.x] Added cleanup of cache clearing to DjangoFilePrefixesTests.setUp().
Backport of 7528979153 from main.
2025-09-19 10:23:13 +02:00
Jacob Walls
b931156c20 Refs #35859 -- Removed support for Task enqueuing on transaction commit.
This removes the ability to configure Task enqueueing via a setting,
since the proposed `ENQUEUE_ON_COMMIT` did not support multi-database
setups.

Thanks to Simon Charette for the report.

Follow-up to 4289966d1b.
2025-09-17 13:28:58 -03:00
Simon Charette
4fcc2883fa Refs #27222 -- Restored Model.save()'s refreshing of db_returning fields even if a value is set.
The logic could likely be adjusted to assign the pre_save value in most cases
to avoid the database transit but it could break in subtle ways so it's not
worth the complexity it would require.

Regression in 94680437a4.

Co-authored-by: Tim Graham <timograham@gmail.com>
2025-09-17 07:50:08 -04:00
antoliny0919
1e7728888d Fixed #36601 -- Fixed color contrast of FilteredSelectMultiple widget chosen labels in TabularInlines.
Regression in a0f50c2a48.
2025-09-17 09:56:01 +02:00
Adam Zapletal
606fc35279 Fixed #36083 -- Ran system checks in ParallelTestSuite workers.
Workers created by ParallelTestSuite were not running system
checks in the spawn multiprocessing mode. In general this is
fine, but system checks can have side effects expected by tests.

This patch runs system checks inside of _init_worker, which is
only called by ParallelTestSuite.
2025-09-16 21:57:22 -04:00
Adam Johnson
2336d5d33a Refs #36606 -- Added tests for QuerySet.values_list(flat=True) without fields. 2025-09-16 20:58:40 -04:00
Jake Howard
4289966d1b Fixed #35859 -- Added background Tasks framework interface.
This work implements what was defined in DEP 14
(https://github.com/django/deps/blob/main/accepted/0014-background-workers.rst).

Thanks to Raphael Gaschignard, Eric Holscher, Ran Benita, Sarah Boyce,
Jacob Walls, and Natalia Bidart for the reviews.
2025-09-16 17:28:32 -03:00
GappleBee
218f69f05e Fixed #28041 -- Added Lexeme expression to contrib.postgres.search.
This expression automatically escapes its input and allows
fine-grained control over prefix matching and term weighting
via logical combinations.

Thanks Mariusz Felisiak, Adam Zapletal, Paolo Melchiorre,
Jacob Walls, Adam Johnson, and Simon Charette for reviews.

Co-authored-by: joetsoi <joetsoi@users.noreply.github.com>
Co-authored-by: Karl Hobley <karl@kaed.uk>
Co-authored-by: Alexandr Tatarinov <tatarinov1997@gmail.com>
2025-09-16 15:09:11 -04:00
blingblin-g
e08fa42fa6 Fixed #36426 -- Added support for further iterables in prefetch_related_objects().
Thanks Sarah Boyce for the review.
2025-09-16 14:14:23 -04:00